Overview
overview
10Static
static
374bcda5c9a...cs.exe
windows7-x64
1074bcda5c9a...cs.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3advertising.html
windows7-x64
1advertising.html
windows10-2004-x64
1modernizr-...min.js
windows7-x64
3modernizr-...min.js
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 03:13
Static task
static1
Behavioral task
behavioral1
Sample
74bcda5c9a93045fe2417b8f021e5320_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
74bcda5c9a93045fe2417b8f021e5320_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
advertising.html
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
advertising.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
modernizr-2.7.1.min.js
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
modernizr-2.7.1.min.js
Resource
win10v2004-20240426-en
General
-
Target
advertising.html
-
Size
18KB
-
MD5
76a9e698aed5a0b37a34b9c8cdf7be65
-
SHA1
0f925741416d97871e2a81eb85287e343e36d139
-
SHA256
6419ebc8fd319b4b65209dffda5a5b327e959feafbdab72cfed28dcd86663ec0
-
SHA512
136291bf0d0ccc678ba4e8ccd6490267061eda0589309b87b9639bde4922adddf4b2d5e2539ec5f7f7254e10a4d1d3b314217eb4434502e7ccf6b5193eb17c0d
-
SSDEEP
384:b1EuQ0x6gDUC2tuMnCg9CYlCCl8qzbcNKneJIaEBCAmw0me61YVUv1fVvL:b1ESsC2tnxlRCJFj+0m11PTL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4592 msedge.exe 4592 msedge.exe 1496 msedge.exe 1496 msedge.exe 4892 identity_helper.exe 4892 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe 1496 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1496 wrote to memory of 636 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 636 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4524 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4592 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 4592 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe PID 1496 wrote to memory of 1564 1496 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\advertising.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb84cd46f8,0x7ffb84cd4708,0x7ffb84cd47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6804 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13129051598512334636,5009605279482367973,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5496 /prefetch:22⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05797bdc-27d9-4cf1-a40e-3bfe616debef.tmpFilesize
6KB
MD5abf55b09d091b42ef62ccc370c971324
SHA1e0127a17e290646659ca0582264e4d2fefd912f2
SHA256367f44eecd7087f3db7e9405b7960c9367a7e56ddb8dfebfbe4d872e7f957aad
SHA51215c9ed5ebd2b58ee41de476abc5cea5eb02fff938fa3e58d217cffe7ce09d6b2ef2f0ab693bc61fb61400cf7768ef9413055a6637bf42ead8091d4b4a9bf395c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD5c2ff15eff4387ef72a50b6e03c1e206e
SHA1d7735c6b7627e63fff5cef9b8e691193d39d7134
SHA256f7716233de395b2487e1de265fbc395169a30e8905554acd78929eead6b5eb45
SHA512f279955b0107b08ddda36b1219d8f45752ff7c15028e123f5e451a40292c94df475a9d7e3eb93975f1d7a274f50d464a3253620ab660d053df0e741ff644a873
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD51a3317e6e5e19e7e2a10c03cdc987875
SHA1c747fa01861d92178651f8d112750db21cfc8c62
SHA256ece03316a484fad016dd44dbe7b65bf14e4d6e33c3c9227850cc329cdd304d1a
SHA512cc014010ad00f980946e6e0196e3d5197301c94fd7f6910a14c2a82ae356888868224f586306b1024227a80bbd73ca515fc77a72cebcc1354390d356ca9dd3d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5f2798f907533cc870452b30a1a0a9b75
SHA131ef33a5165a68b6485d476c37b8ff1a7be1ae96
SHA256e8835d5399434a4c7cbcfa2fa2aeceb94811436eacacdec44f3d3b414f1b1dea
SHA51231c5c7a898a5e708e213bf70a5a21122baad9e3f4d5321e78da1133bd8969f8b434392f433a2cd731ddaa8fd7816b162ce7dfffb208264afd3310d5eb8e3338a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5559d93c265104f759e0eea663e49cf13
SHA173c908ecfb76185e722365c348c6730fa7953ecd
SHA256424bbefa1d588437fa2b72931fdfb753cbbccb6ff8a310c4c3a89313627b208f
SHA512f08c838761e51533b216e3f1fe1a65e4e73cb1226d0e8082cc92f81680e3b75f5eb17a8fc8bcc8e42188ceee7ac98cdbea893e234e335621f9e3f92946ef76c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5afe7b546059ce313a7f542427ff492d1
SHA1ed2ea2b673956b5d4508165ba661605742d7c5de
SHA25670d2a3ffd391d95fc5f1a1804a02af8ddac35924c6e113357c5784a9bcf456a6
SHA51212698bbfcbab224d0ca14cceccda020462886916650b87a965e66efc07f1745083748ae27a7638cb8494457238e4be2e8f08a7730de7f37860e1cab364364497
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5d448db048f00811f59cf16d7869de25e
SHA1b6a212fb45eeca4c12e8bab25c3c60bfee6eed94
SHA25640b8a60faecb9e28eb58ed74f89dd6700e708a8debc71da6512b3b0cf52d4d00
SHA512142a5d8f2c93167111e1b729f9c9044b8c3daca67cbe52e58d004966975bbd5e360152f51b073a08576483fd72e24bbd91710dff353bfd31eb307ee0bd732141
-
\??\pipe\LOCAL\crashpad_1496_UFBIACJGILDNMKBFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e