Overview
overview
7Static
static
7acman2007/Agent.exe
windows7-x64
1acman2007/Agent.exe
windows10-2004-x64
1acman2007/acman.chm
windows7-x64
1acman2007/acman.chm
windows10-2004-x64
1acman2007/acman.exe
windows7-x64
1acman2007/acman.exe
windows10-2004-x64
1acman2007/dxtmsft.dll
windows7-x64
1acman2007/dxtmsft.dll
windows10-2004-x64
1acman2007/ms.htm
windows7-x64
1acman2007/ms.htm
windows10-2004-x64
1acman2007/...60.dll
windows7-x64
1acman2007/...60.dll
windows10-2004-x64
1acman2007/msvcp50.dll
windows7-x64
3acman2007/msvcp50.dll
windows10-2004-x64
3acman2007/...��.url
windows7-x64
1acman2007/...��.url
windows10-2004-x64
1Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
14/03/2024, 23:25
Behavioral task
behavioral1
Sample
acman2007/Agent.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
acman2007/Agent.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
acman2007/acman.chm
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
acman2007/acman.chm
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
acman2007/acman.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
acman2007/acman.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
acman2007/dxtmsft.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
acman2007/dxtmsft.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
acman2007/ms.htm
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
acman2007/ms.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral11
Sample
acman2007/msvbvm60.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
acman2007/msvbvm60.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
acman2007/msvcp50.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
acman2007/msvcp50.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
acman2007/新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
acman2007/新云软件.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target acman2007/ms.htm
- Size 92B
- Sample240314-3efl3sad41
- SHA256 68f49103618d2ef6618a6dc0d314210b26e88bf3f43f4d2e86dcc47975260bfe
- MD5 a8110c6daa78ac26bdf832f263c78ef6
- SHA1 d422bb41ce5f921593d796e3e69c9932a254f506
- SHA512 65eeb44bbb0ebdc0c039627055d65e516dccaf22771317f21535afe7cea16bad7de03052e5e178b018b97ab1fe386f1e8f7204a97b7da0205534472d4221cf77
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3620 msedge.exe 3620 msedge.exe 3124 msedge.exe 3124 msedge.exe 5520 identity_helper.exe 5520 identity_helper.exe 6048 msedge.exe 6048 msedge.exe 6048 msedge.exe 6048 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4852 3124 msedge.exe 88 PID 3124 wrote to memory of 4852 3124 msedge.exe 88 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 2172 3124 msedge.exe 89 PID 3124 wrote to memory of 3620 3124 msedge.exe 90 PID 3124 wrote to memory of 3620 3124 msedge.exe 90 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91 PID 3124 wrote to memory of 1016 3124 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\acman2007\ms.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e26046f8,0x7ff9e2604708,0x7ff9e26047182⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:22⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:82⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:12⤵PID:5484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:5376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,629250908432756496,14324913078475470639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1336 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3624
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
- MD5 73c8d54f775a1b870efd00cb75baf547
- SHA1 33024c5b7573c9079a3b2beba9d85e3ba35e6b0e
- SHA512 191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
- MD5 4b206e54d55dcb61072236144d1f90f8
- SHA1 c2600831112447369e5b557e249f86611b05287d
- SHA512 c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 699a404ca38a1e689ad658c16fd7e3d073461b805303d5158c6d86ae2f83ec18
- MD5 9921b0eb3e28c38196c58271d0ead33a
- SHA1 a2d90bd9f906e895f2c5724d8807beb99d7f16c4
- SHA512 9820e096f299eacf71b0cb16174e13d43dc4f0f7594680b0547ea44ddead127993a676e745e924e4f552ac8315910bfe0384a0a62bcf5fa4bbc32364c6581eee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 84b428b8083b4d167e0803e2f816966c877e0aeca49212fe007a849f6a9d7738
- MD5 e265fbd6cca1afbae872d3b5571dab87
- SHA1 087b281052d6b3775912db36fb11295f753b11ed
- SHA512 13bd4173a2f41ddb25926fff8fa37b690d9ef2ebb6c4cab810373fcc979810a004f463a6b21f7e69f63c07030e062fba4fa690e45483266cf0619b5c33ae87c7
- SSDEEP 96:nIkIi1yZKowpvWMoiVmdeHDMIUWQyV+VD7ziEwb:nIkrQZrGWMXJrt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 64a6bead5c52e9c7534c90a0b76d4bfcdf4f33bac93af5e2fd0c268dbc3c1ed1
- MD5 f49f3e5566459f7ff69c7f271c436f66
- SHA1 52d08fb74779a12df9883cbed6b19b865eb86d5f
- SHA512 96581f592299a05cbc5ffa33ea80c6284d5b4d042d4631cecb43e2d533471f2653ae499412923200d5c722994ec90dc92268010567d8c67fc8379b40abcf78df
- SSDEEP 96:nIkji1yZKowpvWMoiVmdeHDMIUWQyV+VD7AiEwb:nIkGQZrGWMXJrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 84dd55384d2a754e07385a4af15f792072e5f87658c8b8871037d1f9d8ba9a40
- MD5 49e2811367864deabd6fb60321f4d645
- SHA1 9636eafc9a8b84e4a5739e154151c9aae9e599a1
- SHA512 a08ba2289b55a8b0f63268c725a5069aab07a38cbcdeb192234e325a0cb0ffc2e9831bb7d66af2d4efc08fa3e0caf2b056b684ea47470e59e217b0b335592c75
- SSDEEP 96:nIkAi1yZaowpvWMoiVmde3kqDfIUWQyV+VD7AiEwb:nIkzQZbGWMHkqsrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 124c5c8e095411b2b6de2e1136b8e32a539fa6d5f167cf546f110b8390e7264f
- MD5 e054d7ec7508d12a003fdca02e7fe7f2
- SHA1 9e65380936a62425dfdd1e548bdbabf68943c2b6
- SHA512 584b8c55c60d1fccaec3f695469bbf876124763b2ec267e7467393d2f299177dbd17b77fc3038e082f75e05ebc458b472cb08cfb38cddda4944f5ee55247881c
- SSDEEP 96:nIkji1yZaowpvWMoiVmde3kqDMIUWQyV+VD7AiEwb:nIkGQZbGWMHkqJrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 1aaad7064e3b818bfa1a954e7e5f88d3f7698918a7058daec1d68a4c31811892
- MD5 ee8eae77559a9469924cc0ca6d156dba
- SHA1 e78732c9806d4d6957b973bb3746a6eb5651b5dc
- SHA512 a230b5a43baf7805019a6763b961e9735e858f70bcc76fa763c5eeff6bde8a898c38be34cf4fc56076d9a2bb75a7acc493bb5de56a467b4f55b294168a13312f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6rpe2RUL+bpq9xUX1MPeuf:A9iIxuERzA83h09RZxYS93q9E1MeuBO2
- MD5 SHA1 SHA512 SSDEEP