Overview
overview
3Static
static
3Add-on/Md5Check.exe
windows7-x64
3Add-on/Md5Check.exe
windows10-2004-x64
3Add-on/新...��.url
windows7-x64
1Add-on/新...��.url
windows10-2004-x64
1upgrade/upgrade3.ps1
windows7-x64
3upgrade/upgrade3.ps1
windows10-2004-x64
3upgrade/up...34.ps1
windows7-x64
3upgrade/up...34.ps1
windows10-2004-x64
3upgrade/up...40.ps1
windows7-x64
3upgrade/up...40.ps1
windows10-2004-x64
3upgrade/upgrade4.ps1
windows7-x64
3upgrade/upgrade4.ps1
windows10-2004-x64
3upgrade/up...41.ps1
windows7-x64
3upgrade/up...41.ps1
windows10-2004-x64
3upload/api.../uc.js
windows7-x64
3upload/api.../uc.js
windows10-2004-x64
3upload/api...x.html
windows7-x64
3upload/api...x.html
windows10-2004-x64
3upload/api...g.html
windows7-x64
3upload/api...g.html
windows10-2004-x64
3upload/api...ent.js
windows7-x64
3upload/api...ent.js
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ex.htm
windows7-x64
3upload/api...ex.htm
windows10-2004-x64
3upload/api...ass.js
windows7-x64
3upload/api...ass.js
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 23:57
Static task
static1
Behavioral task
behavioral1
Sample
Add-on/Md5Check.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Add-on/Md5Check.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Add-on/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Add-on/新云软件.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
upgrade/upgrade3.ps1
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
upgrade/upgrade3.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
upgrade/upgrade32to34.ps1
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
upgrade/upgrade32to34.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
upgrade/upgrade34to40.ps1
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
upgrade/upgrade34to40.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
upgrade/upgrade4.ps1
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
upgrade/upgrade4.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
upgrade/upgrade40to41.ps1
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
upgrade/upgrade40to41.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
upload/api/passports/ucenter/api/uc.js
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
upload/api/passports/ucenter/api/uc.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
upload/api/passports/ucenter/index.html
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
upload/api/passports/ucenter/index.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
upload/api/passports/ucenter/template/setting.html
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
upload/api/passports/ucenter/template/setting.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
upload/api/passports/ucenter/uc_client/client.js
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
upload/api/passports/ucenter/uc_client/client.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
upload/api/passports/ucenter/uc_client/control/index.htm
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
upload/api/passports/ucenter/uc_client/control/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
upload/api/passports/ucenter/uc_client/data/cache/index.htm
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
upload/api/passports/ucenter/uc_client/data/cache/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
upload/api/passports/ucenter/uc_client/data/index.htm
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
upload/api/passports/ucenter/uc_client/data/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
upload/api/passports/ucenter/uc_client/index.htm
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
upload/api/passports/ucenter/uc_client/index.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
upload/api/passports/ucenter/uc_client/lib/db.class.js
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
upload/api/passports/ucenter/uc_client/lib/db.class.js
Resource
win10v2004-20240709-en
General
-
Target
upload/api/passports/ucenter/uc_client/control/index.htm
-
Size
1B
-
MD5
7215ee9c7d9dc229d2921a40e899ec5f
-
SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6
-
SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
-
SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3012 msedge.exe 3012 msedge.exe 5112 msedge.exe 5112 msedge.exe 2948 identity_helper.exe 2948 identity_helper.exe 1648 msedge.exe 1648 msedge.exe 1648 msedge.exe 1648 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5112 wrote to memory of 1932 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 1932 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 5056 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 3012 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 3012 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe PID 5112 wrote to memory of 2200 5112 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\upload\api\passports\ucenter\uc_client\control\index.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94f7246f8,0x7ff94f724708,0x7ff94f7247182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10809199174102539190,16963151734574906859,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5508 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56c86c838cf1dc704d2be375f04e1e6c6
SHA1ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD527f3335bf37563e4537db3624ee378da
SHA157543abc3d97c2a2b251b446820894f4b0111aeb
SHA256494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA5122bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52f6266a8e5dea8ec5f7f988a57df39fd
SHA107e8fffe737e3e89c5d53c0b9426f509aa7358c9
SHA25651e4f55b639e977ac6ab4f6ff27c1882e13c19c6939698e169c2f72256c0db84
SHA512a8e9fd08f18580bfeceefa282c27d9c52af1b30092c70dcbc184a91d9aad21b6fb018fce92933462430146795ebfdf5641076787ceaab2fd965cd2f8c86daa02
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e4e3aa0a6ba23800966662fa5fd8bd1f
SHA14658db50b5ee5a3bd79feeab4e65e0daf75289dc
SHA256a8a0890a3918fd833b69904b5d0ca904c6f0fbfff76c013d11c7f9178726438d
SHA5127a205341f10985f0f9b0b8f055a1501a40dc8943f834284c08560bafd302ab28c410d7f00dc591bfa556c8ed5943a287bedf5d48ff356dcd19fc8e8bad7bea59
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD53b70bfcb698b783e622620f11c3c30a2
SHA19a5d646637ccd3bcf00ef88a74fa27070cc0dc69
SHA256395f098b91807ec569506c267f876d815bfdef1ba5fa74e71a10057db88f7a48
SHA5128afc057bb7b2b6a78990b838dcf532c8468fe5ed5283ea87818a7ccffcdb7d17ca38913e7946641db7d0b15bdbb52057c90070c5036b98ce492b43961361dfeb
-
\??\pipe\LOCAL\crashpad_5112_BYBTOPTIPGPBHPHGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e