Overview
overview
3Static
static
1data/新云软件.url
windows7-x64
1data/新云软件.url
windows10-2004-x64
1images/fon...ex.htm
windows7-x64
3images/fon...ex.htm
windows10-2004-x64
3images/fon...ex.htm
windows7-x64
3images/fon...ex.htm
windows10-2004-x64
1images/fon...ex.htm
windows7-x64
3images/fon...ex.htm
windows10-2004-x64
3images/js/uc.js
windows7-x64
3images/js/uc.js
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3inc/add.js
windows7-x64
3inc/add.js
windows10-2004-x64
3inc/index.js
windows7-x64
3inc/index.js
windows10-2004-x64
3include/db...ass.js
windows7-x64
3include/db...ass.js
windows10-2004-x64
3include/gi...ass.js
windows7-x64
3include/gi...ass.js
windows10-2004-x64
3include/se...ass.js
windows7-x64
3include/se...ass.js
windows10-2004-x64
3include/te...ass.js
windows7-x64
3include/te...ass.js
windows10-2004-x64
3install/in...ls.ps1
windows7-x64
3install/in...ls.ps1
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 20:19
Static task
static1
Behavioral task
behavioral1
Sample
data/新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
data/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
images/fonts/ch/index.htm
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
images/fonts/ch/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
images/fonts/en/index.htm
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
images/fonts/en/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
images/fonts/index.htm
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
images/fonts/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
images/js/uc.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
images/js/uc.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
images/seccode/background/index.htm
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
images/seccode/background/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
images/seccode/gif/OCR_A_Extended/index.htm
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
images/seccode/gif/OCR_A_Extended/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
images/seccode/gif/Small_Fonts/index.htm
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
images/seccode/gif/Small_Fonts/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
images/seccode/index.htm
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
images/seccode/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
inc/add.js
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
inc/add.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
inc/index.js
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
inc/index.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
include/db_mysql.class.js
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
include/db_mysql.class.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
include/gifmerge.class.js
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
include/gifmerge.class.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
include/seccode.class.js
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
include/seccode.class.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
include/template.class.js
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
include/template.class.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
install/includes/config_rglobals.ps1
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
install/includes/config_rglobals.ps1
Resource
win10v2004-20240802-en
General
-
Target
images/seccode/index.htm
-
Size
1B
-
MD5
7215ee9c7d9dc229d2921a40e899ec5f
-
SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6
-
SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
-
SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3528 msedge.exe 3528 msedge.exe 2612 msedge.exe 2612 msedge.exe 3820 identity_helper.exe 3820 identity_helper.exe 872 msedge.exe 872 msedge.exe 872 msedge.exe 872 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2612 wrote to memory of 3832 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 3832 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 632 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 3528 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 3528 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe PID 2612 wrote to memory of 2092 2612 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\images\seccode\index.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90d8d46f8,0x7ff90d8d4708,0x7ff90d8d47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4034881235852574498,11649956359452430080,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c420b67d2604ff6c1f273ebcadaf688b
SHA1e6e8d3b0eb8d8400e08a49ac4c218c03b4f0bddd
SHA2562eeaa4e16873dfb5d6d2d913625e64a219aa7c3ae4f4b4b08a4cf6b1cba124ed
SHA51237fc7bdfea95f40efa489452fccecd0a3c379d4d80b9090a500cdd5cc982d88e13b4c24ddd41dbecb9501f156ef85bc27190a154bc2dc9031f894b17f49c2163
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5562e28a98fde9f406edff2165db61c30
SHA1edf69a0e25a8a2f0b5fb824c2cd725146c19b735
SHA2562ee44e1636273e80c0b1a909a182b5f40ff1d37affc8403ec9a8d98ea540ba2a
SHA512b50f414647fed4a27dd9ee8c9f8aeb221543958557adb58c38e20a6348593a7d05b07a4c7ce4c42ff89c7e0f922b6c2dc8d95ef39977ac6e204d5e987d2963e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD54629d6650bec45daed82f8973275d193
SHA1ab3815de612eba0e18340c6946f7cd0f51988327
SHA2564b075ab65fca601452e576667217f0fc3b85ba39ff64cfcc2067591be2599d18
SHA512c0298270c545a9582f35c11fcf31d8b61799d56dc39519478012795ac208dc7c5c44855d7ca50ec7b08c4b2b9003e1746cf490e3dcbc6a04037769622d2fdfa6
-
\??\pipe\LOCAL\crashpad_2612_IAGOLAJKYIBZWSNQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e