Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 22:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1q90LG4n5g2v_O66RZ7cDG8tBh2cS5UAa/preview
Resource
win10v2004-20240802-en
General
-
Target
https://drive.google.com/file/d/1q90LG4n5g2v_O66RZ7cDG8tBh2cS5UAa/preview
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2808 msedge.exe 2808 msedge.exe 3560 msedge.exe 3560 msedge.exe 1196 identity_helper.exe 1196 identity_helper.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3560 wrote to memory of 3036 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3036 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 3972 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 2808 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 2808 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe PID 3560 wrote to memory of 5028 3560 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1q90LG4n5g2v_O66RZ7cDG8tBh2cS5UAa/preview1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfa9946f8,0x7ffdfa994708,0x7ffdfa9947182⤵PID:3036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:3972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:5028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4292
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:82⤵PID:508
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:4756
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4296
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:4260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:12⤵PID:5116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:12⤵PID:1160
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:12⤵PID:4464
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16370985730915851271,16675753118108444524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1948
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\221223dd-9d07-41fb-bf40-1dd7e40cb0f2.tmpFilesize
2KB
MD5960bab6305f6aaaad999fa41867f32ad
SHA174b03f728167c4321d3bdb6c107051549534f99e
SHA256753f5f3717893f1a369cb78de56fb040dfbb33cb441125cfff9ec6f1237ab977
SHA512683b494269fc1926b0cd983e076ab73cdbd4272d5247d598deb22c4aae0f994a0801ffe8ef3a326451f1154e3a42766c92beebf6dcc1439b9e2ea4847d82d187
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
360B
MD5760f4ed8ad0e2a62148ff4e3a82af8bb
SHA189656c173ae59ac5591c4c839658673aaa014a35
SHA2565dccce408b93557f11ff6054b6f821b38747c5350705cddb412d754435cddbe6
SHA512bf383240c28a95e20352466782a325cd852e06c6c4f92d085ca97669183f80266b252190c9da1067e002dd0e55d61f64e303373f2d2fcf564027945f9bf8f11f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
336B
MD5a2f3ea5f7a33844070c7acdb692ff216
SHA1f1e0d91797ffe33007438e0a934dea433b959e57
SHA2566de256d3fd9ca3a46002ea5a8fbdb09eb42adfa243dd6298ea1d9f676f461426
SHA512434f373e3c54d7cf4b9b765e24c958d62bf7afca43c6f12759dd5fac901981e7da7bc6c21b1a63225c23ace1984d20839fca79ea1052e345a51fb42022e31f34
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5a880cfb10338e2685238364e45556812
SHA11923540ed617e251fbd82705086483a25af748b6
SHA256be3b81625d27d81b854fa042c7877084679b55805a111442c97acee8b89809a5
SHA51259a5b136abb1cc840193bc1e56720e918e0471268be4949505f7015421d476b18f74171411c2ddfc53f634fbd4d99a32fbe6007b1cccc939a86900dba89a68f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD511e4c289df7d89a44844d270b25478b2
SHA19c682d380872d0afeddbc54163f5fc934d4082e2
SHA25651a06b3300eee08d70b8666005d198c2fa671659517059782d824927426f98bb
SHA512ccd0653471ec209a45fe6bd4e1ad7037b096b4e37513903684ef692db8e22ff3a665d83697396915dc39bc7d1e4af81b4fb36b14d5e41d7b9afafbad69b04859
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58dea624716936080eae361621d414c93
SHA18b888ee6c88a9dbac402f2e5817a742e014c41fd
SHA256c66a7f94a1b9b0014539f2e077581f03b2abcf2e8a3b4255127a979fdab66bdd
SHA5129280fcae8632a4bc260807e6514fb8d7487a2d3c05eb8859f633795608e4ebf76dbffc26eced042ad0df0f3b92f6c01ee6e176162271a6e6c00de77ef89ec5e5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD50ec61e2956103ce8e56025716b3230a7
SHA17b76d9d2ed43ba6a12645e1fe7367a615083f69e
SHA256d03a1e342978aba6e30f5f7d0aac89e9c9568a043ad7f93c6c31b0dc32e0af72
SHA51245d2b642c497e45cf7bf8da4377f6a8dd398217adc8a1af0da224fce2f63904f2e96f2453f69651f43a986739dedeb99d006f55e39896793f1602bce80f2cd40
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
869B
MD571bc6b6b538b095a6a19d61c64404866
SHA1e77f5cf43a11ab0e72f28ca5940c5f7dc48968d1
SHA256786284708e84aa4cc6b96b59a312b0c8d703ee2495fb5b6add0981289eeea673
SHA5128dc8643408b23c6539045770672ffea0217c2ca29df469c5cb6c76758632f6d1f3c4e74b63d6f827158ec69cc55e11de91e8a1d2a9827f13b10f5eaef25cdadd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583b6e.TMPFilesize
705B
MD513c1d117523e62c2610a9fce36ec1cf4
SHA17fd158c45d3a054c44df1889adee45d6f636eb78
SHA256c2d534836ed1c26da452d6fe2bb303ce0348dc647e127ba491c89c0d603dfb11
SHA5127cfe72ed1bcd2323c908cfa58ae7633417a4682bbe63a25b6f00dfcf0bb80b32adeb52f32b1585b06d8ebb7a23b2b7f04bd65e2ddb14ec6b29263a4a4999ce00
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5cfc2e5fce28e2de85b1900d5e9706e09
SHA10dd1fe96647b6f380faed9f9e4fa3f6209058741
SHA2561299074bd243a877feaef56e308a00d6aea71003bca6f2ddb81966e01359ccb2
SHA512be4b21d2be9c9a5a3779916461d675998552eded9c64d248112fd8f91ff25ddb5dc7838f103074f4f976e83c9f7fde796a23db06b3bfc21abb95d7ebb18aefd3
-
\??\pipe\LOCAL\crashpad_3560_KXRSMWVHDBNEQQYUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e