Overview
overview
3Static
static
3125/125.exe
windows7-x64
1125/125.exe
windows10-2004-x64
1125/Addons...e.html
windows7-x64
1125/Addons...e.html
windows10-2004-x64
1125/Addons...32.dll
windows7-x64
1125/Addons...32.dll
windows10-2004-x64
1125/Addons...ge.dll
windows7-x64
1125/Addons...ge.dll
windows10-2004-x64
1125/Addons...32.dll
windows7-x64
1125/Addons...32.dll
windows10-2004-x64
1125/Addons...ge.dll
windows7-x64
1125/Addons...ge.dll
windows10-2004-x64
1125/Addons...32.dll
windows7-x64
3125/Addons...32.dll
windows10-2004-x64
3125/Addons...ge.dll
windows7-x64
3125/Addons...ge.dll
windows10-2004-x64
3125/Addons...wt.dll
windows7-x64
1125/Addons...wt.dll
windows10-2004-x64
1125/Addons...ci.dll
windows7-x64
3125/Addons...ci.dll
windows10-2004-x64
3125/Addons...vm.dll
windows7-x64
3125/Addons...vm.dll
windows10-2004-x64
3125/Addons...pr.dll
windows7-x64
1125/Addons...pr.dll
windows10-2004-x64
1125/Addons...se.dll
windows7-x64
3125/Addons...se.dll
windows10-2004-x64
3125/Addons...oy.dll
windows7-x64
3125/Addons...oy.dll
windows10-2004-x64
3125/Addons...em.dll
windows7-x64
3125/Addons...em.dll
windows10-2004-x64
3125/Addons...et.dll
windows7-x64
1125/Addons...et.dll
windows10-2004-x64
1Analysis
- max time kernel
145s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
125/125.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
125/125.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
125/Addons/Welcome.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral4
Sample
125/Addons/Welcome.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
125/Addons/bin/JAWTAccessBridge-32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
125/Addons/bin/JAWTAccessBridge-32.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
125/Addons/bin/JAWTAccessBridge.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral8
Sample
125/Addons/bin/JAWTAccessBridge.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
125/Addons/bin/JavaAccessBridge-32.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral10
Sample
125/Addons/bin/JavaAccessBridge-32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
125/Addons/bin/JavaAccessBridge.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
125/Addons/bin/JavaAccessBridge.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
125/Addons/bin/WindowsAccessBridge-32.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
125/Addons/bin/WindowsAccessBridge-32.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
125/Addons/bin/WindowsAccessBridge.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral16
Sample
125/Addons/bin/WindowsAccessBridge.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
125/Addons/bin/awt.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral18
Sample
125/Addons/bin/awt.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
125/Addons/bin/bci.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
125/Addons/bin/bci.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
125/Addons/bin/client/jvm.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
125/Addons/bin/client/jvm.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
125/Addons/bin/dcpr.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral24
Sample
125/Addons/bin/dcpr.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
125/Addons/bin/decora_sse.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
125/Addons/bin/decora_sse.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
125/Addons/bin/deploy.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
125/Addons/bin/deploy.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
125/Addons/bin/dt_shmem.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral30
Sample
125/Addons/bin/dt_shmem.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
125/Addons/bin/dt_socket.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
125/Addons/bin/dt_socket.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
General
- Target 125/Addons/Welcome.html
- Size 983B
- Sample240520-hqdlmsgf63
- SHA256 f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
- MD5 3cb773cb396842a7a43ad4868a23abe5
- SHA1 ace737f039535c817d867281190ca12f8b4d4b75
- SHA512 6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4092 msedge.exe 4092 msedge.exe 3816 msedge.exe 3816 msedge.exe 2056 identity_helper.exe 2056 identity_helper.exe 5212 msedge.exe 5212 msedge.exe 5212 msedge.exe 5212 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3816 wrote to memory of 1504 3816 msedge.exe 83 PID 3816 wrote to memory of 1504 3816 msedge.exe 83 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 3624 3816 msedge.exe 84 PID 3816 wrote to memory of 4092 3816 msedge.exe 85 PID 3816 wrote to memory of 4092 3816 msedge.exe 85 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86 PID 3816 wrote to memory of 5032 3816 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\125\Addons\Welcome.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa038d46f8,0x7ffa038d4708,0x7ffa038d47182⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:82⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:12⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3523216102197514269,14286240402395876511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5212
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5064
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1a6f354b397c222a322eea610b05e29238a2e95f9e99cbaeb41ab990073724c2
- MD5 9cf590bef66f7da30bf529ac57ae2d2e
- SHA1 507a9a90c332a9897425b82818657c89917ee1ac
- SHA512 334a842642e38cf9fe8f4e131c787d28b12ee6dc651e86eb437bd9c94081f5168ae142d956a53dfc931cf6b540dd4236bef5aa14c64fa019ab1485089f4888b1
- SSDEEP 96:nD/ks31cFwpvWMoiVmdeHBrzLUWQyV+VD7AiEwb:njkOyFGWMXJrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 bb367fe9a0ef8b91bb2e55de51d4f009399ece1d878de9150046c3f65a6ca5db
- MD5 c8ceeade212972ccf808addfcad0f89b
- SHA1 ade67d4c05460fba4fbc7340f5023f665224b37c
- SHA512 7c4a9baf9fb970b1ac7f7b11768e27a7fc90a7b279a241c5bfbd2cf666ef60b874a48af7e8f3871bddced2e4e42f313a470d863cac97258576068f9c7a9e3a6d
- SSDEEP 96:nD/kh31c1wpvWMoiVmdeHBrzLUWQyV+VDCziEwb:njkBy1GWMXJro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 09167ac4a13c8754de477c253b65d9145212df9c77fb54969fd50f195e3c8ad1
- MD5 1b798846a1bd13da26f4fe3c16df8147
- SHA1 a20bdbc976ec6b19712a54990f161f795ce7a1a4
- SHA512 20e26f056305c7194d49ea7e4aa4ab6650a3a69e1394a7a45a47852881316462f337419e39401359a92e093a5373e2737b6d5e013c8699667ffb819fd007ccae
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuppH8e2RUmMj2c3z2OMDCRHJ:A9iIxuERzA83h09RZxYpHiAycaOMWRHJ
- MD5 SHA1 SHA512 SSDEEP