Overview
overview
7Static
static
720240402-L...5a.exe
windows7-x64
720240402-L...5a.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$R0.dll
windows7-x64
1$R0.dll
windows10-2004-x64
6CefSharp.B...re.dll
windows7-x64
1CefSharp.B...re.dll
windows10-2004-x64
1CefSharp.B...ss.exe
windows7-x64
1CefSharp.B...ss.exe
windows10-2004-x64
1CefSharp.C...me.dll
windows7-x64
1CefSharp.C...me.dll
windows10-2004-x64
1CefSharp.Core.dll
windows7-x64
1CefSharp.Core.dll
windows10-2004-x64
1CefSharp.O...en.dll
windows7-x64
1CefSharp.O...en.dll
windows10-2004-x64
1CefSharp.Wpf.dll
windows7-x64
1CefSharp.Wpf.dll
windows10-2004-x64
1assets/ani...x.html
windows7-x64
1assets/ani...x.html
windows10-2004-x64
1assets/ga2...x.html
windows7-x64
1assets/ga2...x.html
windows10-2004-x64
1assets/ga2...2.html
windows7-x64
1assets/ga2...2.html
windows10-2004-x64
1assets/ga2...3.html
windows7-x64
1assets/ga2...3.html
windows10-2004-x64
1assets/ga2...dex.js
windows7-x64
3assets/ga2...dex.js
windows10-2004-x64
3assets/ga2...min.js
windows7-x64
3assets/ga2...min.js
windows10-2004-x64
3assets/ga2...ex2.js
windows7-x64
3assets/ga2...ex2.js
windows10-2004-x64
3Analysis
- max time kernel
146s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 19:02
Behavioral task
behavioral1
Sample
20240402-L-Connect 3-x64-v2.0.13-6658985a.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
20240402-L-Connect 3-x64-v2.0.13-6658985a.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$R0.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$R0.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
CefSharp.BrowserSubprocess.Core.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
CefSharp.BrowserSubprocess.Core.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
CefSharp.BrowserSubprocess.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
CefSharp.BrowserSubprocess.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
CefSharp.Core.Runtime.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral12
Sample
CefSharp.Core.Runtime.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
CefSharp.Core.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
CefSharp.Core.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
CefSharp.OffScreen.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
CefSharp.OffScreen.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
CefSharp.Wpf.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral18
Sample
CefSharp.Wpf.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
assets/animation/index.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
assets/animation/index.html
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
assets/ga2v/Rain3D/index.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
assets/ga2v/Rain3D/index.html
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
assets/ga2v/Rain3D/index2.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
assets/ga2v/Rain3D/index2.html
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
assets/ga2v/Rain3D/index3.html
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral26
Sample
assets/ga2v/Rain3D/index3.html
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
assets/ga2v/Rain3D/js/index.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
assets/ga2v/Rain3D/js/index.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
assets/ga2v/Rain3D/js/index.min.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
assets/ga2v/Rain3D/js/index.min.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
assets/ga2v/Rain3D/js/index2.js
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
assets/ga2v/Rain3D/js/index2.js
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target assets/ga2v/Rain3D/index3.html
- Size 2KB
- Sample240519-xp13wada61
- SHA256 2b247f51d247c8f05f0064000240dc135d8620c641fb0b760b7f3f842de12f4b
- MD5 83ac9584d1c673e705cdf4896bee21e6
- SHA1 3a8a2461faea4f364d8cf93b1fd214be08a737b9
- SHA512 6353cf621e5ed03379ca1e4979b8aabb1e41310ee71cad7b14e77c4455a5a289ea0f8fd5860f939e28e8a39af3c086c33f560f33e7173b6ab71311c9d04b0bba
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 936 msedge.exe 936 msedge.exe 1980 msedge.exe 1980 msedge.exe 4060 identity_helper.exe 4060 identity_helper.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe 1980 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1980 wrote to memory of 4472 1980 msedge.exe 87 PID 1980 wrote to memory of 4472 1980 msedge.exe 87 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 1136 1980 msedge.exe 88 PID 1980 wrote to memory of 936 1980 msedge.exe 89 PID 1980 wrote to memory of 936 1980 msedge.exe 89 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90 PID 1980 wrote to memory of 4304 1980 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\assets\ga2v\Rain3D\index3.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff950c646f8,0x7ff950c64708,0x7ff950c647182⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:1136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:82⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:12⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:12⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,2594046543299628489,7442121708853685017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4076 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4596
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 ef955527649fca3d6ef6101777618ef744ed91c367128b499397a1abc6c709f2
- MD5 7aca26187d8c446e919ab1db5f8976c6
- SHA1 e8cb30ac9aa30766815d74efd946dafcdacf17c4
- SHA512 c176884b63bf4ec22460a02dcc4b075692df62bc8f5e45324c1cced39d51f3e0ef13cf22afc6d2227bcc68c1f30ca37f9223fb106127c8a85ae19f684f4045df
- SSDEEP 96:nXkKzBY1bD9wpvWMoiVmdeHpRQAD4UWQyV+VDCziEwb:nXktFD9GWMXptD4ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 aace226fac55c30975dcfcea710c3621f7a6f5e1ad7b5beb5d509cebd2b38ccb
- MD5 288f15c388b847a0775bad5ae2ad5829
- SHA1 01f641b482e0702d6bcea07dec3f815f1608dece
- SHA512 871042cda5503ccd9c851307b719336a416fb94760cba4f33965e538bffce4007b4ec278024635207114d94e37279e1cc3e0004e068b55dbd8fad17a8b0bd09b
- SSDEEP 96:nXkhzBY1bD9wpvWMoiVmdeHpRQAD4UWQyV+VD7AiEwb:nXk4FD9GWMXptD4rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 755bb56595c3ef63caf878bfcb94ac5f0f4a52cb11ad914c19233a5ef0ddad7a
- MD5 ea960317a1837e055ed1d4585f4d7797
- SHA1 1c4ce723f0d9113bf8cc9fb914befd4655bdafa8
- SHA512 ba29f187d0c72193e5a316ff9c3f9297c4d4ca6f4f5f818812bf11ac480f643b15e2c74a8afa174b716c3f6cdd2f0ae58bafa1e2bb22360003cc7940476664c4
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXhje2RUlqTa+OblfBhDaaK:A9iIxuERzA83h09RZxYXhzda/XDafEBK
- MD5 SHA1 SHA512 SSDEEP