Overview
overview
7Static
static
7DreamMail4...er.exe
windows7-x64
1DreamMail4...er.exe
windows10-2004-x64
1DreamMail4/DM2005.exe
windows7-x64
6DreamMail4/DM2005.exe
windows10-2004-x64
3DreamMail4...rce.gb
windows7-x64
3DreamMail4...rce.gb
windows10-2004-x64
3DreamMail4...rce.pl
windows7-x64
3DreamMail4...rce.pl
windows10-2004-x64
3DreamMail4/Readme.rtf
windows7-x64
4DreamMail4/Readme.rtf
windows10-2004-x64
1DreamMail4...e.html
windows7-x64
1DreamMail4...e.html
windows10-2004-x64
1DreamMail4...c.html
windows7-x64
1DreamMail4...c.html
windows10-2004-x64
1DreamMail4...ed.exe
windows7-x64
1DreamMail4...ed.exe
windows10-2004-x64
1DreamMail4...or.dll
windows7-x64
1DreamMail4...or.dll
windows10-2004-x64
1DreamMail4...ib.dll
windows7-x64
3DreamMail4...ib.dll
windows10-2004-x64
3DreamMail4...ib.dll
windows7-x64
3DreamMail4...ib.dll
windows10-2004-x64
3DreamMail4...pi.dll
windows7-x64
3DreamMail4...pi.dll
windows10-2004-x64
3DreamMail4...er.dll
windows7-x64
3DreamMail4...er.dll
windows10-2004-x64
3DreamMail4...ib.dll
windows7-x64
1DreamMail4...ib.dll
windows10-2004-x64
1DreamMail4...d.html
windows7-x64
1DreamMail4...d.html
windows10-2004-x64
1DreamMail4...In.dll
windows7-x64
1DreamMail4...In.dll
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/02/2024, 18:47
Behavioral task
behavioral1
Sample
DreamMail4/AddIns/WinmailReader.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
DreamMail4/AddIns/WinmailReader.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
DreamMail4/DM2005.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
DreamMail4/DM2005.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
DreamMail4/Language/Resource.gb
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
DreamMail4/Language/Resource.gb
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
DreamMail4/Language/Resource.pl
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
DreamMail4/Language/Resource.pl
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
DreamMail4/Readme.rtf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
DreamMail4/Readme.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
DreamMail4/Rss/ListTree.html
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
DreamMail4/Rss/ListTree.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
DreamMail4/Rss/RssBasic.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
DreamMail4/Rss/RssBasic.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
DreamMail4/Sys/AccessFixed.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
DreamMail4/Sys/AccessFixed.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
DreamMail4/Sys/DbCreator.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
DreamMail4/Sys/DbCreator.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
DreamMail4/Sys/DmLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
DreamMail4/Sys/DmLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
DreamMail4/Sys/DmLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
DreamMail4/Sys/DmLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
DreamMail4/Sys/DmMapi.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
DreamMail4/Sys/DmMapi.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
DreamMail4/Sys/IPSearcher.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral26
Sample
DreamMail4/Sys/IPSearcher.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
DreamMail4/Sys/KsDHTMLEDLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
DreamMail4/Sys/KsDHTMLEDLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
DreamMail4/Sys/NameCard.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
DreamMail4/Sys/NameCard.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
DreamMail4/Sys/OfficeAddIn.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
DreamMail4/Sys/OfficeAddIn.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target DreamMail4/Rss/ListTree.html
- Size 281B
- Sample240228-xfbfvsbc98
- SHA256 d06856958c6ee2c521969b2ca2f269155eab2042a634e560a9731d590c3176e7
- MD5 d60e55a24dc0c9149cd5f346b44dd56e
- SHA1 a4a8eb48db1ad75a84ee587ce0a871be2b23a577
- SHA512 ca7b4ab9e721712a2a184e70b9ea76b2f792a0230156e7775b549969fb3646711c14accc5d1854e79270df7b5cceba2b6833698a1ca5e8bf43d2253c6cb7fa63
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 2300 msedge.exe 2300 msedge.exe 3160 identity_helper.exe 3160 identity_helper.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2380 2300 msedge.exe 17 PID 2300 wrote to memory of 2380 2300 msedge.exe 17 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1844 2300 msedge.exe 90 PID 2300 wrote to memory of 1112 2300 msedge.exe 91 PID 2300 wrote to memory of 1112 2300 msedge.exe 91 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92 PID 2300 wrote to memory of 3800 2300 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\DreamMail4\Rss\ListTree.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd864646f8,0x7ffd86464708,0x7ffd864647182⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13834990872583315996,1819035064678607810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4356
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
- MD5 9ffb5f81e8eccd0963c46cbfea1abc20
- SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
- SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
- MD5 e1b45169ebca0dceadb0f45697799d62
- SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
- SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 bcac654c4a4f878ca50c66153650f4d713bf80b1056e8a7ecd3d3bfc6ef5518e
- MD5 e958867bf5142492f0620a3b4e612a56
- SHA1 38ce8af6a16b9688b2b0a6e8d7808b493329d4f8
- SHA512 80e53c30ae93985b8f3253d2664de4339eab366acbfbb5ee5eee189739d8972af68e5dca39d19e7fe23de12b099e882222db4433cf4cf2ff5443ddf4af6ec1f7
- SSDEEP 96:nUk0o1+2wpvWMoiVmdeHOHTsDUWQyV+VD7ziEwb:nUkF82GWMXETert
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 32a90072b4c342598dc592d9a2e444098688f3485ee2b4c2291377c3a9e7032f
- MD5 3c76fc33c8cdc3538d4ba80347ec4202
- SHA1 a819a791c9ad12c5ef333ef014423855ef405b9e
- SHA512 27cc22cf0406604c93a855d7db768161ae558fd5489f1de8322e30ba175ab67bcee0c72237a457cf5af7240f7c89d16188dca9281a7619cb8aacb25f42487cbd
- SSDEEP 96:nUkYo1+2wpvWMoiVmdeHOHTsDUWQyV+VD7AiEwb:nUkx82GWMXETerg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 12KB
- SHA256 d4be74d8dd29861f7f5578588557980ea3ee34ba2700a5127b30c6eb12ac14ae
- MD5 5b4c7e12cec4fd01554f190030994435
- SHA1 e2cb37cdf1d3ea3b8eb7e0641048ab38f44f515d
- SHA512 fd13a6c04a03cc634e19f1e7a4517781d3d4f9e40b9ed4163546e664bb33c7ebabf9a971fbc1faba4bc451310a5d231c17fbbe399459d7c0639ffc6b9563aee0
- SSDEEP 384:A9iIxuERzA83h09RZxYnI8agdOo09E1MeuBOjK:rIxuERzA83h09RZxYI3gwo0TOjK
- MD5 SHA1 SHA512 SSDEEP