Overview
overview
3Static
static
1网络同�...u.html
windows7-x64
3网络同�...u.html
windows10-2004-x64
1网络同�...p.html
windows7-x64
3网络同�...p.html
windows10-2004-x64
3网络同�...inc.js
windows7-x64
3网络同�...inc.js
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...unc.js
windows7-x64
3网络同�...unc.js
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...ex.htm
windows7-x64
3网络同�...ex.htm
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3网络同�...inc.js
windows7-x64
3网络同�...inc.js
windows10-2004-x64
3网络同�...inc.js
windows7-x64
3网络同�...inc.js
windows10-2004-x64
3网络同�...nc.ps1
windows7-x64
3网络同�...nc.ps1
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2024 22:30
Static task
static1
Behavioral task
behavioral1
Sample
网络同居程序/admin_menu.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
网络同居程序/admin_menu.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
网络同居程序/admin_top.html
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
网络同居程序/admin_top.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
网络同居程序/bbs/admin/advertisements.inc.js
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
网络同居程序/bbs/admin/advertisements.inc.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
网络同居程序/bbs/admin/counter.inc.ps1
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
网络同居程序/bbs/admin/counter.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
网络同居程序/bbs/admin/ecommerce.inc.ps1
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
网络同居程序/bbs/admin/ecommerce.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
网络同居程序/bbs/admin/forums.inc.ps1
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
网络同居程序/bbs/admin/forums.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
网络同居程序/bbs/admin/global.func.js
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
网络同居程序/bbs/admin/global.func.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
网络同居程序/bbs/admin/groups.inc.ps1
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
网络同居程序/bbs/admin/groups.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
网络同居程序/bbs/admin/index.htm
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
网络同居程序/bbs/admin/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
网络同居程序/bbs/admin/members.inc.ps1
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
网络同居程序/bbs/admin/members.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
网络同居程序/bbs/admin/moderate.inc.ps1
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
网络同居程序/bbs/admin/moderate.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
网络同居程序/bbs/admin/passport.inc.ps1
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
网络同居程序/bbs/admin/passport.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
网络同居程序/bbs/admin/prune.inc.ps1
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
网络同居程序/bbs/admin/prune.inc.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
网络同居程序/bbs/admin/settings.inc.js
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
网络同居程序/bbs/admin/settings.inc.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
网络同居程序/bbs/admin/templates.inc.js
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
网络同居程序/bbs/admin/templates.inc.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
网络同居程序/bbs/admin/threads.inc.ps1
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
网络同居程序/bbs/admin/threads.inc.ps1
Resource
win10v2004-20240802-en
General
-
Target
网络同居程序/bbs/admin/index.htm
-
Size
1B
-
MD5
7215ee9c7d9dc229d2921a40e899ec5f
-
SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6
-
SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
-
SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2588 msedge.exe 2588 msedge.exe 1788 msedge.exe 1788 msedge.exe 2872 identity_helper.exe 2872 identity_helper.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe 1788 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1788 wrote to memory of 2620 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2620 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 1832 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2588 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2588 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe PID 1788 wrote to memory of 2604 1788 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\网络同居程序\bbs\admin\index.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90d3046f8,0x7ff90d304708,0x7ff90d3047182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17099229421638261197,3327389924938458743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5184d8de10232055c602903e45c2deb3d
SHA15b03b0ae24d43552eced8df80537b39e9ef85bc2
SHA256381ef88d475170bfe741f86230882924071fed6689ccd9e4bf2e08733ec1c513
SHA51299ade39b511d00dfabc52d14a9e868e6dea3d65190275ee6e2ef476fcc42ff0a965c00ef45ed43ea54499dfcd3fea0604356174cc01aeff44619dbd8bf485f5b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52d4b94667a29c075b489223a61400670
SHA158565bcf7a3b081a07de547cff107c4f51dda2f7
SHA256e1ef0619bddec7bb7992e3744017fff84bce258e381e95476be87e605ef04d94
SHA5125bd60b7e1438310c6d819936483fc82f1d4c0260147fa06703b22c002553644da952d83ec31e929fd2b1bc8a2859cfa30c4e1bc976138fa56280b03651fad043
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d548d451c2cec8d896e3a62e127c2ee0
SHA1a51614dd32780f0ccb42d5263bf5a8b8e68c1241
SHA2563bb8b9555a4540793141de8f66b87270ca22bebaff5b901caf68eb123eeb1354
SHA51284d98b6811d8b3e89af384ec56f7fdfd9a245b1bda31d3946c86c67edbb3a8bc8ab2c6742f58859681d9db9309e91eec7e420557b79d4251029541f1267aefa9
-
\??\pipe\LOCAL\crashpad_1788_MBSFUPNVKWBIADAEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e