Overview
overview
3Static
static
3webApp/app...e.html
windows7-x64
1webApp/app...e.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...h.html
windows7-x64
1webApp/app...h.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...n.html
windows7-x64
1webApp/app...n.html
windows10-2004-x64
1webApp/app...s.html
windows7-x64
1webApp/app...s.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...one.js
windows7-x64
3webApp/app...one.js
windows10-2004-x64
3webApp/app...jzx.js
windows7-x64
3webApp/app...jzx.js
windows10-2004-x64
3webApp/app...gzx.js
windows7-x64
3webApp/app...gzx.js
windows10-2004-x64
3webApp/app...stx.js
windows7-x64
3webApp/app...stx.js
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 11:13
Behavioral task
behavioral1
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
webApp/app/MobInfo/html/jh.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
webApp/app/MobInfo/html/jh.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
webApp/app/MobInfo/html/zb.html
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
webApp/app/MobInfo/html/zb.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
webApp/app/MobInfo/html/zt.html
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
webApp/app/MobInfo/html/zt.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win10v2004-20240508-en
General
-
Target
webApp/app/MobInfo/html/zt.html
-
Size
979B
-
MD5
9617be84895d3208d1be40bea4c93e0a
-
SHA1
0af99a94cdb05094154cb9471378ce11ba27d26c
-
SHA256
4a80d14763d9f094e42fd8a17a9cc1b368a3af1f96bd6891aef7e8f1fa1b12ef
-
SHA512
2b4298274ec1f40ab474c9109faafc487f9dbc76da645136441c27cd4c9f877eb627518cbd7076cc8a620effa964ad015124e94e550fa249acfe0781c43c376b
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4380 msedge.exe 4380 msedge.exe 2052 msedge.exe 2052 msedge.exe 4760 identity_helper.exe 4760 identity_helper.exe 2372 msedge.exe 2372 msedge.exe 2372 msedge.exe 2372 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2052 wrote to memory of 2172 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2172 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 2672 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 4380 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 4380 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe PID 2052 wrote to memory of 1240 2052 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\webApp\app\MobInfo\html\zt.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6e4446f8,0x7ffe6e444708,0x7ffe6e4447182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3807709234497988912,15260432669749890168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3424 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5813479ac05df4c4d304f93a7f0e3977b
SHA1c10faf5e9da168e5dc4bfbd5e79427d372734778
SHA2560e93afde992972857e40fa7ffca57a4ead464df16e351bb1750edf2daea950a7
SHA512dc302de14cf38aa9bce3a3e46967fa18379d700b78d2131b8beaa90f74cafbd1ba73d33ac49cdf6c3552d4d9882bc06b00a9e3f04f1e7d01a517d6bf12c42ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52f55943fd3c89f8ed91fb6a32d04591c
SHA17b4d489f517e3daeb8b9da25852ce785d9587ef3
SHA256f3bad5bae51c50bee50dad7a8ab80422e56e7f5147ec43c46d91cd040d99b3e4
SHA512dabd8882ab377c6f58ff691a11398e4dbd564ef3cb42fec7a6430076802a4f35a9b23b505891fdf10e622365cea9ef0852af82b7ef8572299d109f2a93cc3ca2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmpFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5ea5fd96d0a64234c43bfc4ed95e6a872
SHA16da32f8ed0ba9d9aff3e0ff3cf0df8ade907dcf2
SHA256b68ac2d7b64151dc3111b042e6b35279c7e4d6e4652994cdee091a36e64b3fd4
SHA51204cf20b472495f5f45958397acb85ebf7961a10c9f6f375744a2cb99d52f68d13d38b32d7d0bd3ea67b7a6a5cdb4d3e2351b707cd0c6c6dc0d8fac072c7c4f0f
-
\??\pipe\LOCAL\crashpad_2052_BIMEBIAYLAEIZMHSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e