Overview
overview
3Static
static
344017993/D...lp.htm
windows7-x64
144017993/D...lp.htm
windows10-2004-x64
144017993/D....2.exe
windows7-x64
144017993/D....2.exe
windows10-2004-x64
144017993/c...ge.url
windows7-x64
144017993/c...ge.url
windows10-2004-x64
144017993/c...rd.exe
windows7-x64
144017993/c...rd.exe
windows10-2004-x64
144017993/c...32.dll
windows7-x64
144017993/c...32.dll
windows10-2004-x64
144017993/�...lp.htm
windows7-x64
144017993/�...lp.htm
windows10-2004-x64
144017993/�....2.exe
windows7-x64
144017993/�....2.exe
windows10-2004-x64
144017993/�...it.vbs
windows7-x64
144017993/�...it.vbs
windows10-2004-x64
144017993/�...pp.exe
windows7-x64
144017993/�...pp.exe
windows10-2004-x64
144017993/�...ng.vbs
windows7-x64
144017993/�...ng.vbs
windows10-2004-x64
144017993/�...in.vbs
windows7-x64
144017993/�...in.vbs
windows10-2004-x64
144017993/�...RT.exe
windows7-x64
144017993/�...RT.exe
windows10-2004-x64
144017993/�...Io.dll
windows7-x64
144017993/�...Io.dll
windows10-2004-x64
144017993/�...Io.sys
windows7-x64
144017993/�...Io.sys
windows10-2004-x64
144017993/�...ra.vbs
windows7-x64
144017993/�...ra.vbs
windows10-2004-x64
144017993/�...ps.vbs
windows7-x64
144017993/�...ps.vbs
windows10-2004-x64
1Analysis
- max time kernel
145s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
01/07/2024, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/help.htm
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/help.htm
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/串口调试助手V2.2.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/串口调试助手V2.2.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
44017993/comwizard/Century Soar Homepage.url
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral6
Sample
44017993/comwizard/Century Soar Homepage.url
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
44017993/comwizard/ComWizard.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral8
Sample
44017993/comwizard/ComWizard.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
44017993/comwizard/MSCOMM32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
44017993/comwizard/MSCOMM32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
44017993/串口调试助手V2.2/help.htm
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
44017993/串口调试助手V2.2/help.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
44017993/串口调试助手V2.2/串口调试助手V2.2.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
44017993/串口调试助手V2.2/串口调试助手V2.2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
44017993/第1章 串口编程调试精灵/Hexedit.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral16
Sample
44017993/第1章 串口编程调试精灵/Hexedit.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
44017993/第1章 串口编程调试精灵/SerialApp.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral18
Sample
44017993/第1章 串口编程调试精灵/SerialApp.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
44017993/第1章 串口编程调试精灵/dlgSetting.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
44017993/第1章 串口编程调试精灵/dlgSetting.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
44017993/第1章 串口编程调试精灵/frmMain.vbs
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral22
Sample
44017993/第1章 串口编程调试精灵/frmMain.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
44017993/第2章 智能安防报警系统/ALERT.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral24
Sample
44017993/第2章 智能安防报警系统/ALERT.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
44017993/第2章 智能安防报警系统/WinIo.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral26
Sample
44017993/第2章 智能安防报警系统/WinIo.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
44017993/第2章 智能安防报警系统/WinIo.sys
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral28
Sample
44017993/第2章 智能安防报警系统/WinIo.sys
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
44017993/第2章 智能安防报警系统/frmBufpara.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral30
Sample
44017993/第2章 智能安防报警系统/frmBufpara.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
44017993/第2章 智能安防报警系统/frmCommProps.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
44017993/第2章 智能安防报警系统/frmCommProps.vbs
Resource
win10v2004-20240611-en
windows10-2004-x64
General
- Target 44017993/DownMe.com_12804scommv22/串口调试助手/help.htm
- Size 2KB
- Sample240701-wly9fa1fme
- SHA256 aab51cbf9ac03982408f19d1a217bc5b9fcb0e5bde30fb727661c5e6088b5087
- MD5 1967d1b996b0965129e23f0d0b4e65ca
- SHA1 db649579192d7941e0466d81764333e867d5b915
- SHA512 8ca9f5bb9775940b7c2edc4e25e708d78061a6061cba49b1e31ae2ba9590d6b68c6b55a85bf6caf0b0dcdf613c8db65d6aabc3640f2744be59490362dc7c38c7
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3828 msedge.exe 3828 msedge.exe 3932 msedge.exe 3932 msedge.exe 1032 identity_helper.exe 1032 identity_helper.exe 4828 msedge.exe 4828 msedge.exe 4828 msedge.exe 4828 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3932 wrote to memory of 1028 3932 msedge.exe 82 PID 3932 wrote to memory of 1028 3932 msedge.exe 82 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 4540 3932 msedge.exe 84 PID 3932 wrote to memory of 3828 3932 msedge.exe 85 PID 3932 wrote to memory of 3828 3932 msedge.exe 85 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86 PID 3932 wrote to memory of 5112 3932 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\44017993\DownMe.com_12804scommv22\串口调试助手\help.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4be046f8,0x7ffb4be04708,0x7ffb4be047182⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:12⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:82⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:12⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,849611159530533716,8870778600385577316,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1468
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b5f588222ed90d98c7692674e9116ac1004e4a651dab77d641b81d8ad069a503
- MD5 e6e9ab8edce47fcd94546109aadd7897
- SHA1 84c6bccd2260fe2d70eadca4f4bdcae9888f93ea
- SHA512 4538bc2f51976d5abe80c1af4b943e94ad11f3295b2c9e69a111e699282f847064d6907a1f0593544f5707e81d8a3a4b1975cb0f51d0de3c7bdc9b784ebb7b79
- SSDEEP 96:n5kjzPrt1CGmwpvWMoiVmdeH1DSUWQyV+VDCziEwb:n5kBQGmGWMXEro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ded6c2e575de14287581e9c5470cf4c8d91bb3da476af0f42506dab250e1b0f6
- MD5 585e9de571d82693aec9c222c6768fe8
- SHA1 e6700309d1468d2f3175320147b61f231fdbbd75
- SHA512 63a9ff0719184c26140397519144c95da1c200fccd1718db9f135399f60093eeafc9d2f90ca0076c45fd5f68ea7beba87cb1e7fbf3b7a35dece09c172efd8ad2
- SSDEEP 96:n5kjzPCt1CnmwpvWMoiVmdeH1DSUWQyV+VD7AiEwb:n5kaQnmGWMXErg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 369599313047a8ae9598f52d7b95719c77e6a2d867148e89002d785294b03201
- MD5 7b3e989e208e12e9e1032cd8e3db9845
- SHA1 362d7c86773c59bb1c47d500dd802ea146f4b15e
- SHA512 83f855fe4a84e7dc9b97938b3881ed24dfecf1da1ea10d2a4a094396bf0b8772b9a38ccad400b5a7a1c7c91677a54a2d0c462fa020013a1da5765826bbc7f39f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZde2RUeSRsrygu/Vw6GR:A9iIxuERzA83h09RZxYDaG5TTR
- MD5 SHA1 SHA512 SSDEEP