Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 13:57
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
HTTP links in PDF interactive object 1 IoCs
Detects HTTP links in interactive objects within PDF files.
Processes:
resource yara_rule C:\Users\Admin\Downloads\PDF_DOWNLOAD.pdf pdf_with_link_action -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 2768 msedge.exe 2768 msedge.exe 320 msedge.exe 320 msedge.exe 952 identity_helper.exe 952 identity_helper.exe 4532 msedge.exe 4532 msedge.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
Processes:
msedge.exepid process 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
msedge.exepid process 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe 320 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 320 wrote to memory of 4536 320 msedge.exe msedge.exe PID 320 wrote to memory of 4536 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2996 320 msedge.exe msedge.exe PID 320 wrote to memory of 2768 320 msedge.exe msedge.exe PID 320 wrote to memory of 2768 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe PID 320 wrote to memory of 3448 320 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://update-download.transfernow.net/dl/2024062555L3ah5I1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb32ac46f8,0x7ffb32ac4708,0x7ffb32ac47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5812 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4624 /prefetch:62⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11329999829262054799,11073306433454002810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c5abc082d9d9307e797b7e89a2f755f4
SHA154c442690a8727f1d3453b6452198d3ec4ec13df
SHA256a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b4a74bc775caf3de7fc9cde3c30ce482
SHA1c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA51255578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5e3e0e8fc2aea6836bb712659534bfe15
SHA15117ffe24a4a700a0a0d90adefa5ab28a510ecf7
SHA256484f62ec26102eeb3afef21b9276c8e3503fd3a9f8eec5450985525ada0afd6d
SHA5122d780eb5bac98cc4be51853f526cc87d006705b9f3c21ad28f42eb7e55b61290cf8627a0344d215f67a9351c221468d3656dcf4bba856950b0b73f596dfbcdd0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5c76414796f2550818b5098ace87bd968
SHA1e787938671d0d615b6c355a4c2037408e56c76ae
SHA256928077e0819fc4c24358d238773f0855d45565d53c1d76ef25aa1bcf75b42239
SHA5120dbef04ef2ba2580cb5f3c103f61a6487959a854e380b7ebad04519dec4ab7632bd0cb94dde003c482de5228a36fcabd1d2f52bd5a333b09416cf4e581e96793
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5829671d290910d6ff49bacbb7635e01b
SHA195cb3f0987f1f818f1225f1c573268f785476f4c
SHA2565058fb885b28c7e972ece5c0678a7d4b8460509ebd05a97d71e4370110ab090c
SHA51210760571ca7715978365f057e6e0ea6bd8664f26ae3eb3259d66c4640e77c5e9d938f5f96e9ce203ba0f49392ac3731fa5a87f1475a19f0a47496037186a024a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5a0b189a612fe76c408ca815489cd8071
SHA1077253c0a9dbcece0aba8c32c482ae620b91c238
SHA256fccf44b8ad5b807b387838f94bd3ef766311429178314ae45f2bd430fed40d62
SHA512127af9d3b6d16a87be62f69647bf2051d453a33ebc61aaf7ce15687f471b683a3694572a55312ae7758a7c21ac465e723817edabf4057b28389b44b6f5cc4e37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5c7d70ea23196e05889217aaf38c1125e
SHA1dcf46d22cb9fa78f35fe000c92f73053def65f7f
SHA25659da843809b8594ddefd42db9961c2f33e6e806940ce9827024546cf12212146
SHA51221fe063609155f7ca301b53c8fecd2a78cd6cd00285dd798e9b92c30d1c8362f8b31e789d2526e4fbc63657df61c7bcba88a035e2dd1fc135369c8435e96c37f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD557a3f713e4494b05ee3a6e19dac34051
SHA10bcf7dd45028a4a213058c555e8a1fbfd59401c6
SHA256a06e29bc9bd3c14f3b337905fa038108bd9bbf359a9babde3feaf7e1c49c1f1f
SHA5125786277a80404683177b88058ec8e9985fed3f01d3154d8385b551b76f5458ce379257fe9aa498a713c8af05d6b30f81ff833bd5d82317bd5aad4e0352bb1389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a894.TMPFilesize
537B
MD5e778fa487e5c0e9c6e9812b9ea7ff84e
SHA1b5b93db1faa3e38cf4fecc90034104c390351412
SHA256694bbef2d2271e8c47955a6ec9b46b93ce7cfcafb1f12a3c10f5798c771dafd9
SHA512563e4782cd7b698c2397f8587183dce79382e77fe8b9a17a2817e9c6c4f9a1a6c428e997c7a7c0cf793498946896e30d532e9207a2746b84e4cd5c730afd7a20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD566d7a2e941851a322b40f1c0f709a43e
SHA1714ca76349eac8b83f2ae5efaa227680b9a9b627
SHA256a6753e2a220db42a4f06ab0f498dab0a4c5e2c2fd310b4071c52ba69fd9f70f1
SHA51201b2042a0dfe3743ff5e5421e80fd10b4738ef5ebbbba8097dfa72f1b793f868d58eee31e1f19f90249112e64447ab95de0acf4ecd97212e1a8a024ee22c1ae2
-
C:\Users\Admin\Downloads\PDF_DOWNLOAD.pdfFilesize
63KB
MD5d37369d17d33f883162c1068af3b0704
SHA1de562b2a4310331c1eecf962a41d16e2359f2e62
SHA256acba900636c9dd7627ae4bd769a0d141bc05c6f958c9c6dc8dd0a6ab188191d4
SHA512ed184df77d979ed331212d380ae0217a622f62e4fa0148f544e62d4a4cc6bb3247b90ce8df9f40defca4bccacd18824d3eca7dadb17bcf11614cebebff4f6a37
-
\??\pipe\LOCAL\crashpad_320_XXHKTPBJURCIISJRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e