Overview
overview
3Static
static
1php168_sha...che.js
windows7-x64
3php168_sha...che.js
windows10-2004-x64
3php168_sha...ass.js
windows7-x64
3php168_sha...ass.js
windows10-2004-x64
3php168_sha...ass.js
windows7-x64
3php168_sha...ass.js
windows10-2004-x64
3php168_sha...x.html
windows7-x64
3php168_sha...x.html
windows10-2004-x64
3php168_sha...es.ps1
windows7-x64
3php168_sha...es.ps1
windows10-2004-x64
3php168_sha...he.ps1
windows7-x64
3php168_sha...he.ps1
windows10-2004-x64
3php168_sha...ed.ps1
windows7-x64
3php168_sha...ed.ps1
windows10-2004-x64
3php168_sha...st.ps1
windows7-x64
3php168_sha...st.ps1
windows10-2004-x64
3php168_sha...st.ps1
windows7-x64
3php168_sha...st.ps1
windows10-2004-x64
3php168_sha...st.ps1
windows7-x64
3php168_sha...st.ps1
windows10-2004-x64
3php168_sha...em.ps1
windows7-x64
3php168_sha...em.ps1
windows10-2004-x64
3php168_sha...x.html
windows7-x64
3php168_sha...x.html
windows10-2004-x64
3php168_sha...r.html
windows7-x64
3php168_sha...r.html
windows10-2004-x64
3php168_sha...y.html
windows7-x64
3php168_sha...y.html
windows10-2004-x64
3php168_sha...er.ps1
windows7-x64
3php168_sha...er.ps1
windows10-2004-x64
3php168_sha...ule.js
windows7-x64
3php168_sha...ule.js
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
php168_sharp_1220/upload/admin/cache.js
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
php168_sharp_1220/upload/admin/cache.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
php168_sharp_1220/upload/admin/inc/menu.class.js
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
php168_sharp_1220/upload/admin/inc/menu.class.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
php168_sharp_1220/upload/admin/inc/navigation_menu.class.js
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
php168_sharp_1220/upload/admin/inc/navigation_menu.class.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
php168_sharp_1220/upload/admin/index.html
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
php168_sharp_1220/upload/admin/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
php168_sharp_1220/upload/admin/md5_files.ps1
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
php168_sharp_1220/upload/admin/md5_files.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
php168_sharp_1220/upload/admin/member_menu_cache.ps1
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
php168_sharp_1220/upload/admin/member_menu_cache.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
php168_sharp_1220/upload/admin/memcached.ps1
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
php168_sharp_1220/upload/admin/memcached.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
php168_sharp_1220/upload/admin/module_list.ps1
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
php168_sharp_1220/upload/admin/module_list.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
php168_sharp_1220/upload/admin/plugin_list.ps1
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
php168_sharp_1220/upload/admin/plugin_list.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
php168_sharp_1220/upload/admin/system_list.ps1
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
php168_sharp_1220/upload/admin/system_list.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
php168_sharp_1220/upload/admin/template_system.ps1
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
php168_sharp_1220/upload/admin/template_system.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
php168_sharp_1220/upload/api/index.html
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
php168_sharp_1220/upload/api/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
php168_sharp_1220/upload/api/member_panel_jumper.html
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
php168_sharp_1220/upload/api/member_panel_jumper.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
php168_sharp_1220/upload/api/member_panel_proxy.html
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
php168_sharp_1220/upload/api/member_panel_proxy.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
php168_sharp_1220/upload/ask/modules/answer/controller.ps1
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
php168_sharp_1220/upload/ask/modules/answer/controller.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
php168_sharp_1220/upload/ask/modules/answer/module.js
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
php168_sharp_1220/upload/ask/modules/answer/module.js
Resource
win10v2004-20240802-en
General
-
Target
php168_sharp_1220/upload/api/index.html
-
Size
1B
-
MD5
7215ee9c7d9dc229d2921a40e899ec5f
-
SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6
-
SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
-
SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3968 msedge.exe 3968 msedge.exe 4908 msedge.exe 4908 msedge.exe 5116 identity_helper.exe 5116 identity_helper.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4908 wrote to memory of 5052 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 5052 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3124 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3968 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 3968 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe PID 4908 wrote to memory of 2112 4908 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\php168_sharp_1220\upload\api\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b3ca46f8,0x7ff8b3ca4708,0x7ff8b3ca47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14175351697532614490,16798243770001929978,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c1256df56a10f79c059890a435116541
SHA16eb0f5261f4ef1bb4b95c62d46dbc242376282dc
SHA256b3e1753fd70a6dac2680dcadb6d242a8fd8ca8bc78826539ceb3a49a3aa6f29b
SHA512e349aa3df473562e817296ef5dc8575562e2f392851c30673fcbbb1364c8bd64140fc00f09586281b8a11d2247fa6a8a413ed14402f28c11cab896729bd17c46
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5a55f094eb98ba72db4c87bd92851235d
SHA170a9705e7637122414ebcb4d7a097717d0d22d4c
SHA256df0d110f3c490f1d7b9b8e20d0ea69b07877422578a82397b7f1bb1c3ec8cd51
SHA512d1d96580d5a73088ad574358b98792390134dc50ccb0a0e3fe51a96a3417b1fa4d4cb51d9071759211f74ca3ad0a89601acca8c2633753e4de38a1f586750597
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5b1f1b587ad9fedc25a3dd23b65a216b5
SHA1635e2c54a186449c11bb32fe58768149f39349a0
SHA25653860f8fef0fcec79f77529f42bdaa8407324855156fdd1c0f4c748745980377
SHA5125624713a752730f55162dab06542f29d593978ba2056e3495fe3fc9708d390d04a70f2c276ce677dc3317351add2daf6d8cad5696565a73b3ac526435e4fcb34
-
\??\pipe\LOCAL\crashpad_4908_ABIAASLEYDEXDTZIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e