Overview
overview
3Static
static
3webApp/app...e.html
windows7-x64
1webApp/app...e.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...h.html
windows7-x64
1webApp/app...h.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...n.html
windows7-x64
1webApp/app...n.html
windows10-2004-x64
1webApp/app...s.html
windows7-x64
1webApp/app...s.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...one.js
windows7-x64
3webApp/app...one.js
windows10-2004-x64
3webApp/app...jzx.js
windows7-x64
3webApp/app...jzx.js
windows10-2004-x64
3webApp/app...gzx.js
windows7-x64
3webApp/app...gzx.js
windows10-2004-x64
3webApp/app...stx.js
windows7-x64
3webApp/app...stx.js
windows10-2004-x64
3Analysis
- max time kernel
146s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2024, 12:18
Behavioral task
behavioral1
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
webApp/app/MobInfo/html/jh.html
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
webApp/app/MobInfo/html/jh.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral16
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
webApp/app/MobInfo/html/zb.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
webApp/app/MobInfo/html/zb.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
webApp/app/MobInfo/html/zt.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
webApp/app/MobInfo/html/zt.html
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral28
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral30
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win10v2004-20240419-en
windows10-2004-x64
General
- Target webApp/app/MobInfo/html/ggzx_dstx.html
- Size 1KB
- Sample240507-pg14xaaa73
- SHA256 87491b126f350c8c73466a2ca2eb987037fc829dddfc0473232134dba261426e
- MD5 65389ed3826e5b660e7b58f8b72e03e2
- SHA1 43399b70b092bdd14e21101d83efb6da398905c3
- SHA512 501f76de3f0381a700ff2835dd9c2b8337ddc90f1d05168993aebea324d9d632339db3201008d45ad6adc9e246b28042bfb4a50b7f87a8426a142e8cf229467f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3092 msedge.exe 3092 msedge.exe 3384 msedge.exe 3384 msedge.exe 4056 identity_helper.exe 4056 identity_helper.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3384 wrote to memory of 4388 3384 msedge.exe 88 PID 3384 wrote to memory of 4388 3384 msedge.exe 88 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 1640 3384 msedge.exe 89 PID 3384 wrote to memory of 3092 3384 msedge.exe 90 PID 3384 wrote to memory of 3092 3384 msedge.exe 90 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91 PID 3384 wrote to memory of 2888 3384 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\webApp\app\MobInfo\html\ggzx_dstx.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb07446f8,0x7ffdb0744708,0x7ffdb07447182⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:82⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:12⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4765987112186148854,13529803555314482574,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4380
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
- MD5 2a70f1bd4da893a67660d6432970788d
- SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
- SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
- MD5 fbe1ce4d182aaffb80de94263be1dd35
- SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
- SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 13f12a334b81ad7d6d02c84e43d17496727f2d530f9d9a3ca57590fdb5b23459
- MD5 ec75a8c1ae8c924c590aa81472973a3d
- SHA1 2170ab89bc40c3b674fd564651d936c6df5b2cab
- SHA512 ad2783ac2805393c5b50c40eec29225302b560e9bf074c98f7cfba48a18946c89e1565e9af08ed45ac532bf048630a65b8f25428664ea772e257b878b9ba2e27
- SSDEEP 96:n0bkhEIY156niK1wpvWMoiVmdeHdt7uUWQyV+VDCziEwb:n0bkCfT1kGWMXbqro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6ea71aa930bef21afa6b402b59bdb5ca22bd02c1862f3a467ff72f322438d100
- MD5 5975030e1cddb8e37413e0de5d2af9c4
- SHA1 a9fc108d40c383dd2f342f2401d2b0c811c8fe28
- SHA512 d8f462c4f6a4f3ff1ad1fd574d90ed0346320c0564addd2b007ed8a3276235bc890ca1c5d2029502c6ac4617973fbaf8cc8eb8cd1eac2cec438bf0c844e97689
- SSDEEP 96:n0bksEIY156niK1wpvWMoiVmdeHdt7uUWQyV+VD7AiEwb:n0bkjfT1kGWMXbqrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 bd6d934fbc83a667b86e0454d57d89636942ad69acc401257a171cbea39789f0
- MD5 2676adc781d609f5586d141dc3b27325
- SHA1 2528c0c645aeed8d80a66c85731b4fc173f33973
- SHA512 8e145033266030f7317f43724a0a86fcabf21bebab4e1e42fe65a7f02514989918312d38f8a60d8dda8e70b5bc0ee7a951456b7b2a3ce1641404a591270ba468
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupleBcae2RUtOif+OblfBhDj:A9iIxuERzA83h09RZxYlo+f/XDafEBFv
- MD5 SHA1 SHA512 SSDEEP