Overview
overview
7Static
static
3SecuriteIn...36.exe
windows7-x64
7SecuriteIn...36.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Installer.exe
windows7-x64
1Installer.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/af.ps1
windows7-x64
3locales/af.ps1
windows10-2004-x64
3locales/uk.ps1
windows7-x64
3locales/uk.ps1
windows10-2004-x64
3resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Resubmissions
28/07/2024, 17:32
240728-v397layfmg728/07/2024, 17:11
240728-vqcqkayakd711/07/2024, 10:44
240711-mstg4avhlf7Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
28/07/2024, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan-Dropper.Win64.Agentb.aa.4220.26436.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan-Dropper.Win64.Agentb.aa.4220.26436.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Installer.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Installer.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
locales/af.ps1
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
locales/af.ps1
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
locales/uk.ps1
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
locales/uk.ps1
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
vulkan-1.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample240728-v397layfmg
- SHA256 c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
- MD5 312446edf757f7e92aad311f625cef2a
- SHA1 91102d30d5abcfa7b6ec732e3682fb9c77279ba3
- SHA512 dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333
- SSDEEP 24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4796 msedge.exe 4796 msedge.exe 2928 msedge.exe 2928 msedge.exe 1412 identity_helper.exe 1412 identity_helper.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 1876 2928 msedge.exe 86 PID 2928 wrote to memory of 1876 2928 msedge.exe 86 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 632 2928 msedge.exe 89 PID 2928 wrote to memory of 4796 2928 msedge.exe 90 PID 2928 wrote to memory of 4796 2928 msedge.exe 90 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91 PID 2928 wrote to memory of 1668 2928 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9999146f8,0x7ff999914708,0x7ff9999147182⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:22⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,1027638247264911146,8249523049714373145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3
- MD5 04b60a51907d399f3685e03094b603cb
- SHA1 228d18888782f4e66ca207c1a073560e0a4cc6e7
- SHA512 2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261
- MD5 9622e603d436ca747f3a4407a6ca952e
- SHA1 297d9aed5337a8a7290ea436b61458c372b1d497
- SHA512 f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 ac8b78ee056f8b10fc932cb02c17840e091747915236516b4f64a2ce9af90d6f
- MD5 40888b2be453b2853836011b761d0a18
- SHA1 a1569eb087d6271c1a7e1b6593153acc33c80505
- SHA512 8db24390b00c33311cdfa421de9e33443b0c47d19de06278347dfe2f0de1c4c2d68737945693c3fe781674150e1b74098dabea97b07a93415d9ab63d7a06bc21
- SSDEEP 96:nGkO01SEawpvWMoiVmdeHz5HYRUWQyV+VDCziEwb:nGkPMHGWMXz6Rro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b216c548b4c28492b43f49b803755c530d64ecf24b91d7116402bb3a9616e252
- MD5 0131336c7c8713de6cf8592f9133f75c
- SHA1 efe5d234c11eb162a124ded2415bfaaaddbde73f
- SHA512 94f0ecfa6370d630150970ae85346430d725e0394fe5f9196121b15522570181339dfb21feea7f9703457bfbb4e9a991e7cf4f0f0d3fdbd5ac1ab2b9e080d0b7
- SSDEEP 96:nGkF01SsawpvWMoiVmdeHz5HYRUWQyV+VD7AiEwb:nGkaMPGWMXz6Rrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 ab4b34f0bd97cd35aef3b6e7aeaedd4d7552a031c907f34182fda3e7f51c9e7d
- MD5 3b390a761d60af371e6b833285400db5
- SHA1 1baecbc1bbaa8191f46147563356b025967e9b70
- SHA512 d2510c119c8701857c1471e8727567eb4f6cca7ec549b1337e0e51bd2e0cd5ebbb79040c325b3a51617d08c9ba7d1510eda8ca6cbd6bb928a81f8414eae06d9a
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFe2RUysjxL+CpFXWx3Apd:A9iIxuERzA83h09RZxYhTs1dQ3Apd
- MD5 SHA1 SHA512 SSDEEP