Overview
overview
3Static
static
3e40cc6f16d...cs.exe
windows7-x64
3e40cc6f16d...cs.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3agents.dll
windows7-x64
3agents.dll
windows10-2004-x64
3atl90.dll
windows7-x64
1atl90.dll
windows10-2004-x64
1audio.dll
windows7-x64
3audio.dll
windows10-2004-x64
3core.dll
windows7-x64
3core.dll
windows10-2004-x64
3defaultUrl...s.html
windows7-x64
1defaultUrl...s.html
windows10-2004-x64
1defaultUrl...s.html
windows7-x64
1defaultUrl...s.html
windows10-2004-x64
1defaultUrl...s.html
windows7-x64
1defaultUrl...s.html
windows10-2004-x64
1defaultUrl..._.html
windows7-x64
1defaultUrl..._.html
windows10-2004-x64
1fileclient.dll
windows7-x64
3fileclient.dll
windows10-2004-x64
3flui.dll
windows7-x64
1flui.dll
windows10-2004-x64
1los.dll
windows7-x64
3los.dll
windows10-2004-x64
3lregistry.dll
windows7-x64
3lregistry.dll
windows10-2004-x64
3lstart.exe
windows7-x64
1lstart.exe
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
16/05/2024, 15:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e40cc6f16d1e74d9180e98f6a9835090_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
e40cc6f16d1e74d9180e98f6a9835090_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
agents.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
agents.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
atl90.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
atl90.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
audio.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
audio.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
core.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
core.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
defaultUrl/pcservices.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
defaultUrl/pcservices.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
defaultUrl/teachingres.html
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
defaultUrl/teachingres.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
defaultUrl/teachservices.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
defaultUrl/teachservices.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
defaultUrl/teachservices_.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
defaultUrl/teachservices_.html
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
fileclient.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
fileclient.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
flui.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
flui.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
los.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
los.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
lregistry.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
lregistry.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
lstart.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
lstart.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target defaultUrl/teachservices.html
- Size 17KB
- Sample240516-te8hescb91
- SHA256 09334c107ec9dd40b8274d521ca8aaba219ed6fffc01c631c7a37060504308d4
- MD5 190d1761f41e3bbf838726c275aa0c35
- SHA1 8247b6183b31c7539e1b8f0058fedc9b5dd13fcf
- SHA512 5f8a8f77e936f1b921af7c06f8d7149cdfae1a14fab1ef1da495cc859828f3bcd01a0ee3cbe5b0875d7f5847c480882f93ee31f8be8878535de8566bb4df058f
- SSDEEP 384:SIo5mZxzhNLoXOLoOCLoBMLokzAPTH+LoZzl5VgQFvpMQFzP2wQFK6SQFEcTQFbv:SKl
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3964 msedge.exe 3964 msedge.exe 3756 msedge.exe 3756 msedge.exe 1948 identity_helper.exe 1948 identity_helper.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3756 wrote to memory of 4644 3756 msedge.exe 83 PID 3756 wrote to memory of 4644 3756 msedge.exe 83 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 4500 3756 msedge.exe 84 PID 3756 wrote to memory of 3964 3756 msedge.exe 85 PID 3756 wrote to memory of 3964 3756 msedge.exe 85 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86 PID 3756 wrote to memory of 3432 3756 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\defaultUrl\teachservices.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9eb546f8,0x7ffd9eb54708,0x7ffd9eb547182⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9175492009885355436,4126194602608570987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3332 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1228
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
- MD5 c9c4c494f8fba32d95ba2125f00586a3
- SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
- SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
- MD5 4dc6fc5e708279a3310fe55d9c44743d
- SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
- SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b5449c95014d928d4fb2aa826055acd895558d8d9e0992ec19f3acb8cfbc6fdf
- MD5 bd49e10a75a1ba0c510500e33bf56a1b
- SHA1 c0452ad832fc518383f49de8e173c28f4a2daf3f
- SHA512 63e26942638abcfa8abc2b679d97e9f3dc420fd6b6128fd5fe1dbe21bb157bb40e7bc328bb87597927ea8fbc7f61315564e4c84d53a6ff9652db51ce258f1ac2
- SSDEEP 96:nAkSv21kxwpvWMoiVmdeHm0+UWQyV+VDCziEwb:nAkBixGWMXaro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 90891deedf19591921fefd129c6f0298450a04d1dbd1cd481631c349d4e26516
- MD5 c5511d276ceb76104b1b6e9edf093b84
- SHA1 65196e69f6ff29cc993f32b865df98a2ae570915
- SHA512 0e1b9cf9feeebaf5427b554d72241f9e953602421e743089ab13d5c34f978bcd397fd64c156638403370448da7c810d9f42c8c78795500882f3564ed531eba55
- SSDEEP 96:nAkpv21kcwpvWMoiVmdeHm0+UWQyV+VD7AiEwb:nAkUicGWMXarg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ed9cf076b38cb64155f7fb5d5f2f4bbbfba76081b0b4b9e3d0bddb2e49c2bd61
- MD5 592af0f2711473f67f5b0b062e1ffeec
- SHA1 694e19dcb091b51d0c5dbd05d6632df7931358c9
- SHA512 d0886d4e61aa7ea330ff60ebcbac5517f98e059f50232f4cc9f4c0b53ba88153429e064b7ed3dc84d6806516667de491541dd24b8e013016798f9d0062c08a2e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupToe2RU5ezw+OblfBhDaavI:A9iIxuERzA83h09RZxYi/w/XDafEBCh
- MD5 SHA1 SHA512 SSDEEP