Overview
overview
3Static
static
3Add-on/Md5Check.exe
windows7-x64
3Add-on/Md5Check.exe
windows10-2004-x64
3Add-on/新...��.url
windows7-x64
1Add-on/新...��.url
windows10-2004-x64
1upgrade/upgrade3.ps1
windows7-x64
3upgrade/upgrade3.ps1
windows10-2004-x64
3upgrade/up...34.ps1
windows7-x64
3upgrade/up...34.ps1
windows10-2004-x64
3upgrade/up...40.ps1
windows7-x64
3upgrade/up...40.ps1
windows10-2004-x64
3upgrade/upgrade4.ps1
windows7-x64
3upgrade/upgrade4.ps1
windows10-2004-x64
3upgrade/up...41.ps1
windows7-x64
3upgrade/up...41.ps1
windows10-2004-x64
3upload/api.../uc.js
windows7-x64
3upload/api.../uc.js
windows10-2004-x64
3upload/api...x.html
windows7-x64
3upload/api...x.html
windows10-2004-x64
3upload/api...g.html
windows7-x64
3upload/api...g.html
windows10-2004-x64
3upload/api...ent.js
windows7-x64
3upload/api...ent.js
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ass.js
windows7-x64
3upload/api...ass.js
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 23:57
Static task
static1
Behavioral task
behavioral1
Sample
Add-on/Md5Check.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Add-on/Md5Check.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Add-on/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Add-on/新云软件.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
upgrade/upgrade3.ps1
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
upgrade/upgrade3.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
upgrade/upgrade32to34.ps1
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
upgrade/upgrade32to34.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
upgrade/upgrade34to40.ps1
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
upgrade/upgrade34to40.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
upgrade/upgrade4.ps1
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
upgrade/upgrade4.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
upgrade/upgrade40to41.ps1
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
upgrade/upgrade40to41.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
upload/api/passports/ucenter/api/uc.js
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
upload/api/passports/ucenter/api/uc.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
upload/api/passports/ucenter/index.html
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
upload/api/passports/ucenter/index.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
upload/api/passports/ucenter/template/setting.html
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
upload/api/passports/ucenter/template/setting.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
upload/api/passports/ucenter/uc_client/client.js
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
upload/api/passports/ucenter/uc_client/client.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
upload/api/passports/ucenter/uc_client/control/index.htm
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
upload/api/passports/ucenter/uc_client/control/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
upload/api/passports/ucenter/uc_client/data/cache/index.htm
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
upload/api/passports/ucenter/uc_client/data/cache/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
upload/api/passports/ucenter/uc_client/data/index.htm
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
upload/api/passports/ucenter/uc_client/data/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
upload/api/passports/ucenter/uc_client/index.htm
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
upload/api/passports/ucenter/uc_client/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
upload/api/passports/ucenter/uc_client/lib/db.class.js
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
upload/api/passports/ucenter/uc_client/lib/db.class.js
Resource
win10v2004-20240709-en
General
-
Target
upload/api/passports/ucenter/index.html
-
Size
1B
-
MD5
7215ee9c7d9dc229d2921a40e899ec5f
-
SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6
-
SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
-
SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 668 msedge.exe 668 msedge.exe 3184 msedge.exe 3184 msedge.exe 4340 identity_helper.exe 4340 identity_helper.exe 1304 msedge.exe 1304 msedge.exe 1304 msedge.exe 1304 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe 3184 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3184 wrote to memory of 2920 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2920 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 3000 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 668 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 668 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe PID 3184 wrote to memory of 2272 3184 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\upload\api\passports\ucenter\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffae0c946f8,0x7ffae0c94708,0x7ffae0c947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2291246855597712044,3654623215161533053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d406f3135e11b0a0829109c1090a41dc
SHA1810f00e803c17274f9af074fc6c47849ad6e873e
SHA25691f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4
SHA5122b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57f37f119665df6beaa925337bbff0e84
SHA1c2601d11f8aa77e12ab3508479cbf20c27cbd865
SHA2561073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027
SHA5128e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD598f23df7a5745c729c36bd00d1d9dfc6
SHA17a469b37e4e68b8201d708d7f9cc5a133a7a493f
SHA2568ab78c45d7d35fbe5e191645c63f73bab81ec4830711691f61740f2eeffb859d
SHA51283a5399ed159072c1fb280157ae88cd1b82b330d51c7278ad64f0bd664fcc523029fac27d0a50bea1b4fb854e9b5f36e2da39e98581585e6c6c110e8720e92c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD503cc68bc350218610195535d49ee3e3e
SHA1e78de95bf97122ef099b51277a8deec6411ab1b2
SHA25650a9adbcf2c4b93cbbe5034848ad165f52e6dadd616524830c33e144d4bbf238
SHA51260f5ed2a7123709d835dcde8fe337c4a2ee5fe165842352eff67fa6b9b723baae2b0afa3693fbff60c624a428489cfb7218672575aba66e7a0b078d091903661
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD52848a6c955f6c8c23af4d653b4b36429
SHA1911b4196553614d7710d4dc644c40029e917694c
SHA256aa06d80e48693926fa26576338c486457fd337fe4c68aa4fdd292ad52a2b6383
SHA51202e658792dd59aa1cfca026ec8f699748c643dc3d9f8909c98d92b0c923d9e01cb7260772e9be30eb94fedec28673e26ab8c6cbb9b70d5433b7a1de27b92611e
-
\??\pipe\LOCAL\crashpad_3184_LMNQSDGKFQHDSUSRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e