Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01-09-2024 16:22

General

  • Target

    https://is.gd/ryPFTs

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://is.gd/ryPFTs
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd63393cb8,0x7ffd63393cc8,0x7ffd63393cd8
      2⤵
        PID:1992
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:4980
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3532
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
          2⤵
            PID:3472
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:4220
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
              2⤵
                PID:3640
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
                2⤵
                  PID:3216
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2944
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:668
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
                  2⤵
                    PID:2044
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
                    2⤵
                      PID:3528
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
                      2⤵
                        PID:1444
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
                        2⤵
                          PID:4356
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7710231197629789847,10527364454389233750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5040 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1236
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3064
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1624

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                            Filesize

                            328B

                            MD5

                            20e2bfd2b5f33fa5379849fd3553454e

                            SHA1

                            cdea2716789dfaf882cb6a58aad1d8ea2cfeefb8

                            SHA256

                            28f1273b62f639a267f8c573fe50a2df23c45208a9779b047f035863b2f41c23

                            SHA512

                            4019f46e45533f24eebc415735da7a8861d24eb9419335f691f3f8efbbf54e49628dae195adb2ba66a432fc4e65eafe06cdee2034352b8852b5f4df0f9af1e56

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            d30a5618854b9da7bcfc03aeb0a594c4

                            SHA1

                            7f37105d7e5b1ecb270726915956c2271116eab7

                            SHA256

                            3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

                            SHA512

                            efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            03a56f81ee69dd9727832df26709a1c9

                            SHA1

                            ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

                            SHA256

                            65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

                            SHA512

                            e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                            Filesize

                            51KB

                            MD5

                            39b81d65634260b15593cfb1f361e410

                            SHA1

                            a5e6654e7109c8f410a973ab8dd40a9d4edc533c

                            SHA256

                            d8f023e34ad28c370d0185dfaf17ecb5ab67037885a1651199e4c735c6852437

                            SHA512

                            4c7d23ef62006d3c0f9a6b1f3eff7d81b9d3b80d7b002b2665d76f3156ef122ae9cb8f4189e31ce43225742c16527d690e637a97f5e6a9a3faa8d860cbc86dea

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                            Filesize

                            86KB

                            MD5

                            1cd9bb105a2c23b8d94346c17cc055ad

                            SHA1

                            fa6fdc73bfa3741b5ce28f3b2ba702395c1294fb

                            SHA256

                            d0c010e405504fb5e0ea6be0959cab061e051eb4506d928ab61c56327ae0e4f1

                            SHA512

                            0a198012c5c1b96c45e553cf5af04b49aeaabe347eaf07604a772d9961c18dcfc27305170f0036354368a6391125d4932485c068a5e9c6aa4be592b56cc84c02

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            3KB

                            MD5

                            a3952e847428ae9da8d08f446aaa6379

                            SHA1

                            dba645854b73095e8ae64508c0b208a823630309

                            SHA256

                            0b09be6b0ed565d55d0b3acdcbee248250278dcc18197e9b61d28311a6c5eb6b

                            SHA512

                            40d7b9860f1d4fa01c78f0055ca9ebe836a435f57bcc7d5a9cc111d467be12086e26bff399c4a598b2e4d3190cfc38d9f7e18723d6c1917fb01afc3af1cde702

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            3KB

                            MD5

                            5e8cc1164fe2162cdcf52726d3243de8

                            SHA1

                            68526915d1203403190c7a415fa5d78598705158

                            SHA256

                            93021a9113daeebc0b7cf09d6aeb19873b2fcc82aa5a4b0bd29aad83478493be

                            SHA512

                            e8b6d37075987494ed43f69e8dccbf375c934e40eaa1a2fe95f2b4a9d65632fac3244028566920c93c78e7c26866617e222b6a1b909ff6d749953d145fb016f7

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            c2924e871d9e7cfeb0503fb3db60d531

                            SHA1

                            18b0573296fa10d2ff25a841125cfc1e53203dd7

                            SHA256

                            05e45f0db8ad3e45503d6bf6564aca4bd2835201df8fb605e1b72f835c936f2a

                            SHA512

                            73efc09001f208cf09621fed4badc4d77bf17b754aae259d1f1dd66254005457d1cbe67ac93722f03621a39f97abe79bea2fb19a30d0afbf24bd445db914857b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            f697ea63ac325ed618dd625690a5dacc

                            SHA1

                            1b5be3fb8ef964b31bcb35eaeae72a5b5450a2ca

                            SHA256

                            b338546c8d74ed1d01b86bc9fb8ec51f7705886779321645834376b1638d77ad

                            SHA512

                            f40d4c8a4302be6f4251d7f9252b660f598a86a174bcd1ed3cc02f2878cde98a2e469af36b47f6beb2b108d9063fb8087152ab2cd2f035109b767017c696d90d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            741d2dfeeee51d8d647fac634c7621fa

                            SHA1

                            bcb55483a01f177bfedf45c139113b4bdafb591f

                            SHA256

                            54aa091a26e16f2332416c4bb1a4eff2dd9143e39b4f423ab4a0fd44c61db8cf

                            SHA512

                            fe5f25553e1912e7b4201d4f031896e1c5d8517a43baaaf11908be5cbe4381980de74c260767d347c83e18bfddf7376f9b50cfb6b4715a1f6c00534cc5b3d574

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            a95bb35ed584d6e390f83cb7fa481d03

                            SHA1

                            c0e027ee31d1f963a9b1bdaaca7f2269e4d7531c

                            SHA256

                            f7f96110ca8d304af7cbd1a509d23027de32ddc07ab20fbd7435bfc0ce1a4271

                            SHA512

                            e77eede92954160e82ef0897db4e35e157ac5c05f96b407ee75984491ad5372a9219651e21a47d38411f2bbbe6ca8c2a6c3aa6ddcb3d14cebbdb58bc5911f192

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            2739ab8461ffcedd0e5aa956656388fd

                            SHA1

                            974d951c01632e2b18c01be7d098fa606564262f

                            SHA256

                            f9bdff750d7a77cb5d39a728a790c59e043f166ae2314177c4434bbf77520798

                            SHA512

                            b4dd4e3fa7d6203665b7c28ff02a03837bb23390e09d4a9efc8096143e9213cc7bd009b658112e26ed2eb5abb1cf2bfcb0420b6c655da7b1eb2d1313a7ee5bb4

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            ea67ea159434262703ed661e490e3bbf

                            SHA1

                            40e2f309cab118b10fc31157e25de08e21785338

                            SHA256

                            b6a28312737ccd0cb02958ad1fa09636a4f03632ba8c04f0f93b92a4dd04c14b

                            SHA512

                            cec36ebb1f2b59d5e1ac4639eb11d2055cb19cdb9844624780a73af0561f0a41fc2bfb2bfa78f37349246afc26d283decf21306243a339f34ad2735ce8404a05

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            613c90c6cec5c23235592a68421773bb

                            SHA1

                            e8f69638146dd51c21964e0eef806ea4a0c0bc2c

                            SHA256

                            d85a259b927c3c3eac4b019831009c603eece83daf73de50c71ea2c44536c082

                            SHA512

                            e2e56aac3c5f2603841d2bc69ffa90127d12e6f76685ed6d2ffb4c7fb00c01d75bf3fc99b1d2ab5b2c947eddd5413fa28ae4454b7fea54bf911158a3840148ab

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            ff78c5a4913237d11e39f60ac65e8388

                            SHA1

                            66b04d250d2e9fec2e598f4f5eb40698cf823d8d

                            SHA256

                            445fc89e6d61cfda9e100b9b152e6bb8025198fd50f34675b386e27a88289475

                            SHA512

                            788ab73db04b0aed5e5d2f8cf8afde3b48494705da2e295f793547a16ff4e06771489d80d47eb17e1dcbbc51cb1d185ab1a732998b86a6c79741f51654216e84

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            e81fd5f3f4e3a20546027c5c12ef4b04

                            SHA1

                            a37f5312d69cc1d01336005b3995d9df567651ea

                            SHA256

                            91fa1dbe7c9afb82d73deb15a127ba0df5bf04cb1dee546460fa9f0443909649

                            SHA512

                            466f3f3861862b00431c60c8f578666972a94f77e862daa1e55262237adf1ab9ae76b05da036515f6a020c5ac2912275d352a56a0af2f7d2a29ffcdeea1ac990

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            bf2fbd535a315433f1c945a95c68b7ca

                            SHA1

                            a81bab54213e563800622494f9ef77b4e54b1b9a

                            SHA256

                            3ad566d4e71dc90b3ca910075bde1358f9ccffa9885d9e16ccb6e2393899b656

                            SHA512

                            4e93e2c3b204089d36a2ffbbdad0a133ef197df68eb7d929e55be465a7f57350023a76e6f0a864e3879b60e394774b10ae0f67c4386536dd94e90cdc935d5b0b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            9274bc8e0150a7ed61c2bd3cf50d65cf

                            SHA1

                            ad9a13c4958813639e4a52933f58960610531dd8

                            SHA256

                            c3d34e1856759ded7a44a34ca819e36e2b1518fbd22eb0b074eed884d42f8290

                            SHA512

                            cba90af00192c2338009fe0728eb2a6e590447acb99a654095c89b15f6e9bee558924c74c967b8e17d0e42590e7ab50acf6f5be26aaaae859d19f87bc81b5d3b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d9e5.TMP

                            Filesize

                            1KB

                            MD5

                            092acf3520ca45c6bc7ba9cacff8491b

                            SHA1

                            1b082d818bd4a0ab6b0f2bdf960fd7f2cc7dfd99

                            SHA256

                            11149fac3ae2051545ab6c687a813005911ea602098afbfa5e4e5327fb56d0d8

                            SHA512

                            dd8e14d1b46861c7c536bf83937e56b805c563f8449f645ec07557ed4af227ca14c3194467894eb1fb09e5e0a3f9fe6dfdf0d94dbf40ab2514779b3c27ff7a08

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            b77823fdb47620d49fac5e6bd8cdcb5a

                            SHA1

                            ea48fe2e84d5fdbe90ff0680bf8e5bb2643d468f

                            SHA256

                            6696aafeb74d6197852514d847f1467c5d8da1b8a8d6501d19f2f871a70f1612

                            SHA512

                            34092c42b60e07dc213e03a496723b9731571d82c5e18712c09e9bf674969b40a1fa7025c12f333be4160a38dd882ea5f3d4a0b4dd6f54633792f74e347c9cbe

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            11KB

                            MD5

                            683f8cf403e3c3b15592c5e4efac7b17

                            SHA1

                            4f2086634b9c6d74393ccc0b82fde02f6359a1b5

                            SHA256

                            1210cf38d569c31f6bafd690db094a696edfb102c0b1d68a059e9308a21f736a

                            SHA512

                            aaa7ca8b7963a6c6b05757d6dd988fb0db114594e8ec47fb13fbc782a693d7271c2a52019657e98d38c3099fcdefbddd2db94da05fff6e8c58562b5145f4ab43

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                            Filesize

                            2B

                            MD5

                            f3b25701fe362ec84616a93a45ce9998

                            SHA1

                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                            SHA256

                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                            SHA512

                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                          • \??\pipe\LOCAL\crashpad_4476_GZGWXTIZZBPIWZKF

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e