Overview
overview
7Static
static
79f0a09e850...e0.exe
windows7-x64
79f0a09e850...e0.exe
windows10-2004-x64
7$LOCALAPPD...ly.exe
windows7-x64
7$LOCALAPPD...ly.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...om.dll
windows7-x64
7$PLUGINSDI...om.dll
windows10-2004-x64
7$PLUGINSDI...dt.dll
windows7-x64
1$PLUGINSDI...dt.dll
windows10-2004-x64
1$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
7$PLUGINSDI...on.dll
windows10-2004-x64
7$_0_/exten...lts.js
windows7-x64
1$_0_/exten...lts.js
windows10-2004-x64
1background.html
windows7-x64
1background.html
windows10-2004-x64
1DealPlyIE.dll
windows7-x64
6DealPlyIE.dll
windows10-2004-x64
6vn-zugo.exe
windows7-x64
7vn-zugo.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
16/02/2024, 01:02
Behavioral task
behavioral1
Sample
9f0a09e850b205703f3bda335f8c62e0.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
9f0a09e850b205703f3bda335f8c62e0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/dealply.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
$LOCALAPPDATA/dealply.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/version.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/version.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral20
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
background.html
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
background.html
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
DealPlyIE.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral24
Sample
DealPlyIE.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
vn-zugo.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
vn-zugo.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
General
- Target background.html
- Size 1KB
- Sample240216-bd3xfadh46
- SHA256 67cb79577f26d6632168145a2b7b4d3ad6b46247f0244a9f6f25b45fceaeddc3
- MD5 b283e8f75dcc4349e1d88e72358ea3b8
- SHA1 b017c920e90daeae106ad152ecfb42a1d8d203a7
- SHA512 c714233bc1d7ae252695d7b56213523525beb4b8e198b11377213647418a76824e89c49dd75b82beb0fa205646ca458ba7f14d42fc350d6836a6921aa9524402
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe 2288 msedge.exe 2288 msedge.exe 4196 identity_helper.exe 4196 identity_helper.exe 664 msedge.exe 664 msedge.exe 664 msedge.exe 664 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe 2288 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 4780 2288 msedge.exe 84 PID 2288 wrote to memory of 4780 2288 msedge.exe 84 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 3564 2288 msedge.exe 85 PID 2288 wrote to memory of 1988 2288 msedge.exe 86 PID 2288 wrote to memory of 1988 2288 msedge.exe 86 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87 PID 2288 wrote to memory of 4864 2288 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\background.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87c1446f8,0x7ff87c144708,0x7ff87c1447182⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,18082601580601637518,8823321594775027836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1400 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2700
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120
- MD5 bcaf436ee5fed204f08c14d7517436eb
- SHA1 637817252f1e2ab00275cd5b5a285a22980295ff
- SHA512 7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 454c65864d876317230b2ddebb56d0b33bf22f31e11968a374d529bb8de5436f
- MD5 820760007928b24cabe0b6e77de921a7
- SHA1 e5e5c34e9947cd286d1440db2258a85aede97d9e
- SHA512 0f25de8f0e73b9a09f1ed13a32772d7a85cd11bca8afe39a94dc76352814c79c22ec6fedcc0c3e258795da7351f6d0f7e9a0655151eb2759aef24fdaaec1d1c4
- SSDEEP 96:nFkFc1TOwpvWMoiVmdeHOLUUWQyV+VD7AiEwb:nFkGROGWMXNrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 9986fe99c03ab00646a1bff6eed8707966ea0d14c2b51804d899204866e1ff8a
- MD5 23ddde1f595359025d5ddcd5fb7b7f26
- SHA1 c118998bfdd861fd82983c644a5366cbde4790e0
- SHA512 89929568603ac909b23c49c81c601ff9fc8338b3f5b6ca185e2f3d0b2861107514dc1722b94c57f8ebd033056bff4d8917d06c43a4f0b2a43ec885f09f1df9ba
- SSDEEP 96:nzkOc1TOwpvWMoiVmdeHOEUWQyV+VDCzia:nzk3ROGWMXlrj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 24KB
- SHA256 4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f
- MD5 b0ba6f0eee8f998b4d78bc4934f5fd17
- SHA1 589653d624de363d3e8869c169441b143c1f39ad
- SHA512 e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9
- SSDEEP 768:nJeWwk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaLlacrUo10SrZ/v:nJeWwku1ja3LsoGS9X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 fe72c167f6ec4e4207f62bda56491b876d882826b63af5372e50d7a5a717bbf9
- MD5 28d7418f0c4283bab1759b4fb88d093c
- SHA1 f13dd9e3ae0ddb4298a94e524555486076cd29b4
- SHA512 c0e48a959132247cc30f0da8c703ee162932c6667eeeeb4bfb176562962a670da9f9bf91bb1b138cb8e5f774823f99c2ae7da7f61a4b7ace722dc10c2b7357e4
- SSDEEP 192:toCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbgh3e2RUE/ybJq9xUX1MPJ:h9iIxuERzA83h09RZxYbgh/90q9E1Meo
- MD5 SHA1 SHA512 SSDEEP