Resubmissions

11-09-2024 10:27

240911-mhhmvawdjc 10

11-09-2024 10:23

240911-mfajfswcjf 10

Analysis

  • max time kernel
    389s
  • max time network
    381s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 10:27

General

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zilmap-sols-2943.pages.dev/?dco=ofgpuapw&[email protected]
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff381446f8,0x7fff38144708,0x7fff38144718
      2⤵
        PID:3008
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
        2⤵
          PID:3100
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3016
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
          2⤵
            PID:1456
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
            2⤵
              PID:1368
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
              2⤵
                PID:4464
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                2⤵
                  PID:4676
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
                  2⤵
                    PID:2356
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2612
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
                    2⤵
                      PID:1060
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
                      2⤵
                        PID:4888
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                        2⤵
                          PID:2256
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
                          2⤵
                            PID:2536
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                            2⤵
                              PID:412
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
                              2⤵
                                PID:1368
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                                2⤵
                                  PID:1060
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
                                  2⤵
                                    PID:2960
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
                                    2⤵
                                      PID:3936
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
                                      2⤵
                                        PID:5172
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                        2⤵
                                          PID:5180
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
                                          2⤵
                                            PID:5344
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,2410586099519209841,13187391064834663698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6252 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6068
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:872
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:4972

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              eeaa8087eba2f63f31e599f6a7b46ef4

                                              SHA1

                                              f639519deee0766a39cfe258d2ac48e3a9d5ac03

                                              SHA256

                                              50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

                                              SHA512

                                              eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              b9569e123772ae290f9bac07e0d31748

                                              SHA1

                                              5806ed9b301d4178a959b26d7b7ccf2c0abc6741

                                              SHA256

                                              20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

                                              SHA512

                                              cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                              Filesize

                                              23KB

                                              MD5

                                              804d770c7f79fc9eaf0b2e0b97e8fdd6

                                              SHA1

                                              1ad26882599046e003bc8abf32a592c203e42e7a

                                              SHA256

                                              d06dbe4c8d10211adb5308a063ffde54cccf45e6f3f084179e6d232f6fc8715a

                                              SHA512

                                              d9b8d7f13f54874c2c1de077623de1d1c8ae4a72bbaad00c55a9367041e9ad426ae6e20d7547cf1b274e45849b3797bc970dc8ccfd10e07f3555386c79f4b9b9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                              Filesize

                                              34KB

                                              MD5

                                              6d972955f10384db8fa31e0e0307ad0e

                                              SHA1

                                              6e97d009d7d8a6f383307d6721ce88e7987c3d8a

                                              SHA256

                                              073106154a795ef01d427c117b971c6cf70637c0cdc1397043ed5ceb6db04af1

                                              SHA512

                                              62c31f3900df445f12be5a48f006233c5e8de0b1ecb18125ae65067ca604e4ad5f2697ecb4065e32e7be5d707bb03777da417d0b4dde1d06d64478b8aae317f9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                              Filesize

                                              39KB

                                              MD5

                                              93ce597d19589ea55c83e1dd9247efb0

                                              SHA1

                                              c0deb5a3b4bdf914994de9d9e31fb5e1f67fa8ef

                                              SHA256

                                              9203d5f1eec352adb9e5588a96960ed31738b81754418515f336f4992ca8b713

                                              SHA512

                                              e72de02ee944d0803e570ae66079efbbd9bef31256926b22e8f7d291b25f8d884230f907fa130b99901a517e0a04b3a0e6319f841e38f859d92a24b64c0f0cb2

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                              Filesize

                                              212KB

                                              MD5

                                              08ec57068db9971e917b9046f90d0e49

                                              SHA1

                                              28b80d73a861f88735d89e301fa98f2ae502e94b

                                              SHA256

                                              7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

                                              SHA512

                                              b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              744B

                                              MD5

                                              16d55187325b4dad4126e4fcdf4e9635

                                              SHA1

                                              2226120965960d6bea7759077dc811d011dc7dad

                                              SHA256

                                              7882b96d2f0562c9cdb813becc79b9fade23496b2ceb6ba442a7f1f00dc2b268

                                              SHA512

                                              0eb577b64b29d054ef49578ae6fc3437f4fd7c36673d8ea2e9fe7507f5a776e07b7012f5c94d550a9e0354c2f9de61d6cd9ee35d53768728341a42a7065d2400

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              2KB

                                              MD5

                                              7f668549877fab633c7b2a4db5167123

                                              SHA1

                                              59aa408497c6db5fad48a9161c0206d81a3ce2b7

                                              SHA256

                                              1d4fc07f9031b02b0edc1dc6898a164b46399e47d64dec82a59f59994016f339

                                              SHA512

                                              2aa1a2c361c7c6decee2d9a7f412ea051b1d011a60e664ee2206356a6c49041e90d1c39c8f7615a74bc8f6575ea67508da2780c07369b49e8a7b3f837252bc84

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              0052b90b296f0b559c6965b9760c2745

                                              SHA1

                                              efa279e275e7d6a9b47e48856f5c6c246e0be48a

                                              SHA256

                                              c48a312111071afd4c3792b47d4c18f02b3d996928e4998f8b36a5d64075dfdd

                                              SHA512

                                              543438467eabbb7d5e7bf154063eabda40c6f018a01fa35ad6813450f17b3d6ed4f7582c349200772b4bba6df61e8fd8901e9e49a2d9158aac8140d7ee0ceff5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              7a74764bf00feadf66df17ea14f42bc9

                                              SHA1

                                              471b8fcda5fdaf4bf558bffb8549f6b853dac6a4

                                              SHA256

                                              ce756c7a09d7e4f22a3e68c2ebf5491a9a15a6df683dc7a1bf339a49d71f9719

                                              SHA512

                                              df43d1df1fa27a558995a7cf55c72586cf4b3f55c8dbe5aab4c6f9482e0abbca73cdde8ec8051bb9573f0085f8bbf4a38f863b175a4841737133c319d7921a1e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              9KB

                                              MD5

                                              75c10fc1d4acfccc86d25e101a97be3a

                                              SHA1

                                              f4b386b6590a9ddb2047d12e69cd6b8b6153a24f

                                              SHA256

                                              a8203a973bdc4d90ab548e7fa0382e4daa7d420b518f7a1b89ff391a3b5d69fb

                                              SHA512

                                              62ae6df0b61f2f7f24f57ce98c53f7f2499b1e6dc0bdb687b48535774523d1af6101cec5478c19b6c8b2bf4eb62792348896319b2c5c73f4fb85b2516810bdb0

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              705B

                                              MD5

                                              71ecceda63c1d9aa88138b0f76702371

                                              SHA1

                                              221bb86a5d45bbbb1113204fa11522893c810978

                                              SHA256

                                              122d15ffe2aa566d0cd6cb536d24a30735ffe4b4c480265826f761b4dbf90de9

                                              SHA512

                                              94a5bc0e1dd36a016dc26a66e15dd8bac32d6de6554762597a680c3c833354abba180d670903e09c58dd113ab0e0ad5b5c22bbdba79173353b345e8d91434c65

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ea8f.TMP

                                              Filesize

                                              705B

                                              MD5

                                              7683949bdb2e61b1478a282948063c60

                                              SHA1

                                              c59f8e40abc9dfbae955532f5d97495c06a71b3d

                                              SHA256

                                              1b46053499d59bc649e5aa6e3be3f69e60613665943323b6534a80fe3007becf

                                              SHA512

                                              4ca6d23ff1cdc2e34b80a13cd8c980db9568446e68ab3244cfef2d95817151af41ceb6450bbc783b346f0f291fea414482632c55cdf4a2a992f0caea4fbd71ef

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              c6e14cf72ad6be8532a442f7e99ae580

                                              SHA1

                                              28874c8655eb5d1cea24d3f683e4078d24fb6dde

                                              SHA256

                                              7d4311bfd8916d48b4cb6924d6722769f0edfe8c189e8a6f24b75261744eccec

                                              SHA512

                                              312fd176f4fff0251eaed84a4631fb1eae2d7346e9ec7c50df12d6956f02101702a9796857d266d623da57f3680e96eca807a5e10da1585af6e29f7e35ba127b

                                            • \??\pipe\LOCAL\crashpad_4868_JRYKFYWSKQIDAQPS

                                              MD5

                                              d41d8cd98f00b204e9800998ecf8427e

                                              SHA1

                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                              SHA256

                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                              SHA512

                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e