Overview
overview
8Static
static
3Winamp592_...us.exe
windows11-21h2-x64
8$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...ch.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...os.dll
windows11-21h2-x64
3$PLUGINSDI...ip.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...mp.dll
windows11-21h2-x64
3$PLUGINSDI...dl.dll
windows11-21h2-x64
3Components/ssdp.dll
windows11-21h2-x64
1Elevator.exe
windows11-21h2-x64
1Microsoft....40.dll
windows11-21h2-x64
3Microsoft....40.dll
windows11-21h2-x64
3Microsoft...._1.dll
windows11-21h2-x64
1Microsoft...._2.dll
windows11-21h2-x64
1Microsoft....it.dll
windows11-21h2-x64
1Microsoft....ds.dll
windows11-21h2-x64
3Microsoft....40.dll
windows11-21h2-x64
3Microsoft....40.dll
windows11-21h2-x64
3Microsoft....90.dll
windows11-21h2-x64
1Microsoft....90.dll
windows11-21h2-x64
1Plugins/AV...er.dll
windows11-21h2-x64
3Plugins/AV...ap.dll
windows11-21h2-x64
3Plugins/AVS/texer.dll
windows11-21h2-x64
3Plugins/AV...r2.dll
windows11-21h2-x64
3Plugins/Fr...pe.dll
windows11-21h2-x64
1Plugins/Mi...op.dll
windows11-21h2-x64
1Plugins/Mi...p.html
windows11-21h2-x64
1Plugins/Mi...g.html
windows11-21h2-x64
1Analysis
- max time kernel
145s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
19/05/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
Winamp592_10042_final_full_en-us.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/Dialer.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ShellDispatch.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/execDos.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/extstrip.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_winamp.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Components/ssdp.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
Elevator.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
Microsoft.VC142.CRT/concrt140.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
Microsoft.VC142.CRT/msvcp140.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
Microsoft.VC142.CRT/msvcp140_1.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
Microsoft.VC142.CRT/msvcp140_2.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
Microsoft.VC142.CRT/msvcp140_atomic_wait.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
Microsoft.VC142.CRT/msvcp140_codecvt_ids.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
Microsoft.VC142.CRT/vccorlib140.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
Microsoft.VC142.CRT/vcruntime140.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
Microsoft.VC90.CRT/msvcp90.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
Microsoft.VC90.CRT/msvcr90.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
Plugins/AVS/AddBorder.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
Plugins/AVS/colormap.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
Plugins/AVS/texer.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
Plugins/AVS/texer2.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Plugins/Freeform/wacs/freetype/freetype.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
Plugins/Milkdrop2/data/vms_desktop.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
Plugins/Milkdrop2/docs/milkdrop.html
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
Plugins/Milkdrop2/docs/milkdrop_preset_authoring.html
Resource
win11-20240508-en
windows11-21h2-x64
General
- Target Plugins/Milkdrop2/docs/milkdrop_preset_authoring.html
- Size 110KB
- Sample240519-srcqvach2z
- SHA256 c7fac4c6360f7018235ed404bb505fa97bcfa60e10ef61914f2b6184a34566c4
- MD5 0118c32a94c9bf2f399a09984b1ea910
- SHA1 e469102034bdbd3f48c3de00ba02ec2548dddacd
- SHA512 463f7976eb783fdb23d4eba54cc74b0a0261e7fb779898710d5178a6474d7485fc3c8fb50a910091344290bf91a06916389ee44ef2bce66860fd139c581eedb8
- SSDEEP 3072:uzltOWUTLjoj6qYefG5kqp+OqbXmRyVlvNk:gulP5qYetH/TlvG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1468 msedge.exe 1468 msedge.exe 2732 msedge.exe 2732 msedge.exe 4972 identity_helper.exe 4972 identity_helper.exe 4124 msedge.exe 4124 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe 2732 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2368 2732 msedge.exe 81 PID 2732 wrote to memory of 2368 2732 msedge.exe 81 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 420 2732 msedge.exe 82 PID 2732 wrote to memory of 1468 2732 msedge.exe 83 PID 2732 wrote to memory of 1468 2732 msedge.exe 83 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84 PID 2732 wrote to memory of 3004 2732 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Plugins\Milkdrop2\docs\milkdrop_preset_authoring.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba8823cb8,0x7ffba8823cc8,0x7ffba8823cd82⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:22⤵PID:420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:82⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:12⤵PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,15018028787282113873,12197707150771197243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5024
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e
- MD5 0d84d1490aa9f725b68407eab8f0030e
- SHA1 83964574467b7422e160af34ef024d1821d6d1c3
- SHA512 f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d
- MD5 0c705388d79c00418e5c1751159353e3
- SHA1 aaeafebce5483626ef82813d286511c1f353f861
- SHA512 c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 72a6572a23afe62ca80255a2dbdb117b1c547863d8e01b10f080ee56db20c8d6
- MD5 2f2775771bfad20339a7ebbaab31d6fd
- SHA1 20833cc13d3b7662dd2bca47d72aa698d179d249
- SHA512 8d0a449ce41400eb203dee40501722bb8cbc7a7f60765f7253acd9e2e3f5ffcd4590eae442feec6d2f6ef41e382c564eb2c0f53b4da5c18e685b74dfb5c26b76
- SSDEEP 96:n+k3nYV1kvnwSv0MoiVmdHIfJsp0WQyV+VuziX3wI3:n+k3a1kvnv0MAIxwLM93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 26df6fa3b89747d6072eef1ca638149ab40fe305e6481bc732eb6380e7b18b20
- MD5 2cc9e82ce8452fac2944c661f2322891
- SHA1 dffe0f19ff883d0dadb112a7d0134a00f4676435
- SHA512 50de53491a0160f017fe879a315d4830004c3a21ddfc1a0c7e45288c74e95adacd2c37dcf541eca8513406bd656756349f806f00d73932b5111f77d5f19485fb
- SSDEEP 96:n+k35V1k3nwSv0MoiVmdHIfJsp0WQyV+VpAiX3wI3:n+k3f1k3nv0MAIxwLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 5f408162ac34a3c31e870c622fb00659319f91580f206c26e2645dbe8d0ea6f3
- MD5 8233381e72ac965c36bf5e79264e7d28
- SHA1 62396feb5bc5b48288332dc36d22742376848b44
- SHA512 045329762b40b1da9892ece5d9324b815aab4eeb5fd2888ac3fa895778263568428d2f3b436fd42b2787e5936785720a00eb3f3d1c3998fdc55f5b6e71a6c8e3
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGuSjze2RUv2R9DDK02TacHlGC:M9iIxuERzA83h09RZxASG3/6QK00VGz+
- MD5 SHA1 SHA512 SSDEEP