Overview
overview
3Static
static
3webApp/app...e.html
windows7-x64
1webApp/app...e.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...h.html
windows7-x64
1webApp/app...h.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...n.html
windows7-x64
1webApp/app...n.html
windows10-2004-x64
1webApp/app...s.html
windows7-x64
1webApp/app...s.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...one.js
windows7-x64
3webApp/app...one.js
windows10-2004-x64
3webApp/app...jzx.js
windows7-x64
3webApp/app...jzx.js
windows10-2004-x64
3webApp/app...gzx.js
windows7-x64
3webApp/app...gzx.js
windows10-2004-x64
3webApp/app...stx.js
windows7-x64
3webApp/app...stx.js
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 11:13
Behavioral task
behavioral1
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
webApp/app/MobInfo/html/jh.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
webApp/app/MobInfo/html/jh.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
webApp/app/MobInfo/html/zb.html
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
webApp/app/MobInfo/html/zb.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
webApp/app/MobInfo/html/zt.html
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
webApp/app/MobInfo/html/zt.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win10v2004-20240508-en
General
-
Target
webApp/app/MobInfo/html/ggzx.html
-
Size
1KB
-
MD5
9d04cae1eb27219428d28d485417d931
-
SHA1
5cb0a7315aeee21d7d55d9a3c0a29ffb0f61bc8c
-
SHA256
4cfd67dca198773e8f6bb962883fa42372cbe187a60f8346b0895c30965ec03e
-
SHA512
fdb4e0178d71714f43788a09520ff80b8a09a741df309bc5fb973ae9f1a33cc1680435762aaec392f2a0bcd203a0a49034a06f54968b98e29dae81502cf9d409
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3736 msedge.exe 3736 msedge.exe 2224 msedge.exe 2224 msedge.exe 2440 identity_helper.exe 2440 identity_helper.exe 5488 msedge.exe 5488 msedge.exe 5488 msedge.exe 5488 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2224 wrote to memory of 2612 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2612 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3092 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3736 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3736 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2836 2224 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\webApp\app\MobInfo\html\ggzx.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d0046f8,0x7ff84d004708,0x7ff84d0047182⤵PID:2612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:3092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:2836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:4396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1968
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 /prefetch:82⤵PID:2992
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵PID:448
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:12⤵PID:4280
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:2332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:1344
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,546855365552444268,4696934545228927362,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5488
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4036
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5d809e3922aff4663ff31087c18149793
SHA16bf6784099b7f7f85edcbb5124fa2f4dd80ad726
SHA256a00b20b041185e8876cadc28f625f0e2be65cf53ef30ef0507647d9d6cc9a650
SHA512e311fde91a1c3b3e1f3474d84085f3d3e224a10610b0cb8bdc03c54217cb49a476f5ccb8d45d8dc271e5c85c734cdce48c619025a7f0c88cc5f1ef9489dc54cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54a0674d2512b02ee734384a8694ebafd
SHA16c69f04af06daba606e2247f8f02834020454012
SHA256def684065909a349a744558b00d9e87b071e32d576e5986e02154bc82e334bfb
SHA512f2d3f0da801c6f20f9fc18125547ad6841f9dcce00196836372ab4209e3e96e22f05d3722e74d4ba2d749b8b33c747edd3000b015c6f49dfea6f985231441eb6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD51f3e2f3cbce7a86ffa50cc5b115e47c1
SHA185ec9daeb326d6874ecba3a8fdf5ff1bf40b04fe
SHA2562de90f4a34b97d65d9982676f1c361a601d494e67ea68d16c9c47d3e54df3029
SHA512895ace5bf33781b7c063bc1ac1aadeb9ff83639d7824a14a730c14892a592414a29f63325a799bc06542b06d5e7296bc2d3cfa13f787ac634d6111c9df94063d
-
\??\pipe\LOCAL\crashpad_2224_JMYAKVFYPWEJYUOSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e