Overview
overview
3Static
static
3e40cc6f16d...cs.exe
windows7-x64
3e40cc6f16d...cs.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3agents.dll
windows7-x64
3agents.dll
windows10-2004-x64
3atl90.dll
windows7-x64
1atl90.dll
windows10-2004-x64
1audio.dll
windows7-x64
3audio.dll
windows10-2004-x64
3core.dll
windows7-x64
3core.dll
windows10-2004-x64
3defaultUrl...s.html
windows7-x64
1defaultUrl...s.html
windows10-2004-x64
1defaultUrl...s.html
windows7-x64
1defaultUrl...s.html
windows10-2004-x64
1defaultUrl...s.html
windows7-x64
1defaultUrl...s.html
windows10-2004-x64
1defaultUrl..._.html
windows7-x64
1defaultUrl..._.html
windows10-2004-x64
1fileclient.dll
windows7-x64
3fileclient.dll
windows10-2004-x64
3flui.dll
windows7-x64
1flui.dll
windows10-2004-x64
1los.dll
windows7-x64
3los.dll
windows10-2004-x64
3lregistry.dll
windows7-x64
3lregistry.dll
windows10-2004-x64
3lstart.exe
windows7-x64
1lstart.exe
windows10-2004-x64
1Analysis
- max time kernel
145s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
16/05/2024, 15:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e40cc6f16d1e74d9180e98f6a9835090_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
e40cc6f16d1e74d9180e98f6a9835090_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
agents.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
agents.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
atl90.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
atl90.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
audio.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
audio.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
core.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
core.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
defaultUrl/pcservices.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
defaultUrl/pcservices.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
defaultUrl/teachingres.html
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
defaultUrl/teachingres.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
defaultUrl/teachservices.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
defaultUrl/teachservices.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
defaultUrl/teachservices_.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
defaultUrl/teachservices_.html
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
fileclient.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
fileclient.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
flui.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
flui.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
los.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
los.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
lregistry.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
lregistry.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
lstart.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
lstart.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target defaultUrl/teachingres.html
- Size 11KB
- Sample240516-te8hescb91
- SHA256 dd03b9fe11bb200cd382b61643bd7ec8e580887d5470ebea93dd4ef55507467e
- MD5 9b3210b89be540580aabbb09c3d21314
- SHA1 5f19b0fbfea2638be25220aedfd82848068d388f
- SHA512 442c083ef2e8e7e1e8691bb1f942edabd9c3e355bc9ea6084ea8738e8d4bc6b2bea08593a325771854fa5773f001934fa57196b05e79470bc11095596b531db5
- SSDEEP 192:SuyU/YLXwVhg0Rvv2pLodJ7jtQI6VDf+Jp9dea:SuP35qLot5
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4912 msedge.exe 4912 msedge.exe 4980 msedge.exe 4980 msedge.exe 1640 identity_helper.exe 1640 identity_helper.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4952 4980 msedge.exe 86 PID 4980 wrote to memory of 4952 4980 msedge.exe 86 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 1028 4980 msedge.exe 89 PID 4980 wrote to memory of 4912 4980 msedge.exe 90 PID 4980 wrote to memory of 4912 4980 msedge.exe 90 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91 PID 4980 wrote to memory of 4680 4980 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\defaultUrl\teachingres.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e1b46f8,0x7ffd5e1b4708,0x7ffd5e1b47182⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:82⤵PID:4680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3180997694051753695,11037279673027381361,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3340
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
- MD5 4f7152bc5a1a715ef481e37d1c791959
- SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
- SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
- MD5 ea98e583ad99df195d29aa066204ab56
- SHA1 f89398664af0179641aa0138b337097b617cb2db
- SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 7a25278c0866c9c210134d6c51f84c0f2f60fbaf5c56bf4670f4a68e099fe3bd
- MD5 4308704675b05cfdb52a06d339cab5e1
- SHA1 fed189313dda0569b334a56a531da260b0f74553
- SHA512 3e019669e745440e6f13c078c4011fdf1bcb4159c6ef7df9c777fad39fd16039131943b4a833c6e29da20e3e20590ee3f23bea7132d959ab052e62a90212da9a
- SSDEEP 96:n0kKd1633XwpvWMoiVmdeHp1kfYUWQyV+VD7ziEwb:n0ki4nXGWMXpyYrt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e78068a859623f305724c1521612f7d607988fc089d624fdb2cf680711b128f4
- MD5 de3b4b444517ad7db5e7e6f83a1a8d9c
- SHA1 5c95edbb11dbbe170bd91eeeb2dfc41b3b4bb609
- SHA512 4d959eb1fffbfba6abc32a0c83cc16835536be49de8a1b2a0e4d9ddfd19e13b36a618ebbe497d6667ea16b9205aad4826689430b164f0f5828ec75c0dc847939
- SSDEEP 96:n0khd1633XwpvWMoiVmdeHp1kfYUWQyV+VD7AiEwb:n0kL4nXGWMXpyYrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 454b86c701b0dfab1d8fdda21f234b29b00251199e7bc2179150a14fe3725e86
- MD5 f498a8be7141cb07aa1e7fe023c47680
- SHA1 5eb28b274e3a517011108977385c19eb54623616
- SHA512 c0a56fcaa7e403e0c598dfb4bed617ca082aafe091b57f6498e23c2c50348c47036e11677de655be2f19af85dba0049a7f8e3142a1c277c1ea2861dc7f2bd59c
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupR77e2RUpn/o5x+OblfBhDp:A9iIxuERzA83h09RZxYRn+nwx/XDafEZ
- MD5 SHA1 SHA512 SSDEEP