Overview
overview
3Static
static
1readme/新...��.url
windows7-x64
1readme/新...��.url
windows10-2004-x64
1upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
1upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/dat...x.html
windows7-x64
3upload/dat...x.html
windows10-2004-x64
3upload/ded...it.vbs
windows7-x64
1upload/ded...it.vbs
windows10-2004-x64
1upload/ded...dd.ps1
windows7-x64
3upload/ded...dd.ps1
windows10-2004-x64
3upload/ded...do.ps1
windows7-x64
3upload/ded...do.ps1
windows10-2004-x64
3upload/ded...it.ps1
windows7-x64
3upload/ded...it.ps1
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
readme/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
readme/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
upload/data/admin/index.html
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
upload/data/admin/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
upload/data/backupdata/index.html
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
upload/data/backupdata/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
upload/data/cache/index.html
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
upload/data/cache/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
upload/data/index.html
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
upload/data/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
upload/data/js/index.html
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
upload/data/js/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
upload/data/mark/index.html
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
upload/data/mark/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
upload/data/rss/index.html
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
upload/data/rss/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
upload/data/sessions/index.html
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
upload/data/sessions/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
upload/data/textdata/index.html
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
upload/data/textdata/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
upload/data/tplcache/index.html
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
upload/data/tplcache/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
upload/data/ziptmp/index.html
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
upload/data/ziptmp/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
upload/dede/ad_edit.vbs
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
upload/dede/ad_edit.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
upload/dede/archives_add.ps1
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
upload/dede/archives_add.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
upload/dede/archives_do.ps1
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
upload/dede/archives_do.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
upload/dede/archives_edit.ps1
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
upload/dede/archives_edit.ps1
Resource
win10v2004-20240802-en
General
-
Target
upload/data/backupdata/index.html
-
Size
3B
-
MD5
736007832d2167baaae763fd3a3f3cf1
-
SHA1
7ee737c83ee689c96ef37d3a029068c390ebc8f8
-
SHA256
2b64c6d9afd8a34ed0dbf35f7de171a8825a50d9f42f05e98fe2b1addf00ab44
-
SHA512
6beba489cd62566c108b652b7143cb97e007396a0b16ce250d2d0ac6e51ed999e41e96eb497b29efa99d2a15f276d6d531aa9ead15e2c13d77b3846ee45f64ac
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3180 msedge.exe 3180 msedge.exe 4932 msedge.exe 4932 msedge.exe 3140 identity_helper.exe 3140 identity_helper.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4932 wrote to memory of 3864 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3864 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3220 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3180 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 3180 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe PID 4932 wrote to memory of 4992 4932 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\upload\data\backupdata\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa85a46f8,0x7ffaa85a4708,0x7ffaa85a47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13373958737145655247,17517097375955359443,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5fcfb238c69144ab78fe5cd74e3bec8b7
SHA12d943df827deec0849625a147887cf799d01f63e
SHA25624411559294dfeedb2ba1256f90f6cbc6e19be15a22490e487245241c2ae46b1
SHA5126113607b7b2e8e81441034eeb217eed82d6bd857f60366ddfe91eb28bbbf45a29260da59cf1f1eb072eb5cf6fa41b4f404a4751f900c8d6691dd0f3982e3b55b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5df9f06fdddd7b2cb91ac1538acf13184
SHA1ee8023dea6a4da8e5a4e3048b876382710dfaf36
SHA256908f3bb29658fcb1b37ec66a6c6c7abfd5a73a9d43dab11df0a4dd33ac39fa92
SHA51225b0d284f8a22d6af69fb80d90448f5893ac61aead7d29d366c1325cc2036e8772752ed1a14ba12499c1575f2e70b8feb628399de57441c136a6ae290c7bc31f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD59e0cfc4a1294181783a295b8f47e9038
SHA1d3defb7f9c78348df59bbb1d44b40037d22601ee
SHA256c5c0abe224b477666282990409144cc483d2ba4a39b729acc2abc652d2415839
SHA5125a95d10424180d1f3d0c72e124096dda375877cbde50dd61c5762b7be6bde7a218da0edcb0ddd493e0defcab8ef46ea48e2626ebb882302337aca7346e52a758
-
\??\pipe\LOCAL\crashpad_4932_SHTELHZFJAIGAOSCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e