Overview
overview
3Static
static
3webApp/app...e.html
windows7-x64
1webApp/app...e.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...h.html
windows7-x64
1webApp/app...h.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...n.html
windows7-x64
1webApp/app...n.html
windows10-2004-x64
1webApp/app...s.html
windows7-x64
1webApp/app...s.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...one.js
windows7-x64
3webApp/app...one.js
windows10-2004-x64
3webApp/app...jzx.js
windows7-x64
3webApp/app...jzx.js
windows10-2004-x64
3webApp/app...gzx.js
windows7-x64
3webApp/app...gzx.js
windows10-2004-x64
3webApp/app...stx.js
windows7-x64
3webApp/app...stx.js
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 11:13
Behavioral task
behavioral1
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
webApp/app/MobInfo/html/jh.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
webApp/app/MobInfo/html/jh.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
webApp/app/MobInfo/html/zb.html
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
webApp/app/MobInfo/html/zb.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
webApp/app/MobInfo/html/zt.html
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
webApp/app/MobInfo/html/zt.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win10v2004-20240508-en
General
-
Target
webApp/app/MobInfo/html/yaowen.html
-
Size
1KB
-
MD5
94e48d9d1310d6325f16d0f741b12d02
-
SHA1
75f9f247f6fb97e73f8b0408bcb27cffd6c621c8
-
SHA256
d7aff22a92f67353d8a6872e144f2b9931d7163db69f8bab8c556dfc053d35f1
-
SHA512
edd6bbddcee604aecf79dc07c0be181a1818a6f310a7b012e1b48c9925a4668544e392f7a59421f645f20dd8b1a9d410ec9920b85352a24f5362c61d08258a18
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4668 msedge.exe 4668 msedge.exe 3892 msedge.exe 3892 msedge.exe 532 identity_helper.exe 532 identity_helper.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3892 wrote to memory of 1920 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 1920 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4672 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4668 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 4668 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe PID 3892 wrote to memory of 2696 3892 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\webApp\app\MobInfo\html\yaowen.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9afb046f8,0x7ff9afb04708,0x7ff9afb047182⤵PID:1920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:4672
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:2696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2196
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:440
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:1368
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:12⤵PID:4200
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:12⤵PID:2728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:3132
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:3324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6099847554778929650,6277955695958176885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58d250fe48b36a71dd29f95bcc912300f
SHA171ca73ae6d5c4380a84c8bd22089d57d845122f1
SHA25649526425b2650c3080d1e62c4fe5606367380f7f8a5004e25f2d3c3b4faeddb8
SHA512716240f13dd3fbaf50fcd3bf7e80339bc306a1f02ee3d1cd5d008d50dc9ef8212c92060986f2bb5d00f153f128e5eb5284b04ed4e89aa68c02e2e69cf5d485c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD507d76669d7a914358f045ab5753d8fef
SHA11c41d0b433d78718bf71e6a16628a8470cca9485
SHA2560b288cf969f9356092bf5bc1c628561c86498ffc07477a46333125535489dd28
SHA51221e3b15ca17d80a6d0dda87134c71e6b692381ca7ab3ad15b1480c039c7372ce6e7de2da8853643c27a51db3c9e703ed941f728139b181d5d544899295b843c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD59fb826fa2fc222970bf30787452f7c55
SHA1201a77877a509a415ba7f80936437efd5846b851
SHA2569a8aead92169084fb25da532d4f073b67e05225152c4b39aa156cf9fa2e7a145
SHA5129be27ab5353f0ac887e75a54c0b5cb8a401988069c4b1784ca0a5c862a4891186533825102819bebe568699588a973a1693b65a65f1076a2c69c5d5d1af0a45e
-
\??\pipe\LOCAL\crashpad_3892_WCNNPBTFXBSQDFLLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e