Overview
overview
5Static
static
3vlc-3.0.21-win64.exe
windows7-x64
4vlc-3.0.21-win64.exe
windows10-2004-x64
4$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3NEWS.vbs
windows7-x64
1NEWS.vbs
windows10-2004-x64
1axvlc.dll
windows7-x64
5axvlc.dll
windows10-2004-x64
5libvlc.dll
windows7-x64
1libvlc.dll
windows10-2004-x64
1libvlccore.dll
windows7-x64
1libvlccore.dll
windows10-2004-x64
1lua/http/custom.js
windows7-x64
3lua/http/custom.js
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...m.html
windows7-x64
3lua/http/d...m.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.21-win64.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
vlc-3.0.21-win64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
NEWS.vbs
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
NEWS.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
axvlc.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral16
Sample
axvlc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libvlc.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral18
Sample
libvlc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
libvlccore.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
libvlccore.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
lua/http/custom.js
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral22
Sample
lua/http/custom.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
lua/http/dialogs/batch_window.html
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
lua/http/dialogs/batch_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
lua/http/dialogs/browse_window.html
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral26
Sample
lua/http/dialogs/browse_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
lua/http/dialogs/create_stream.html
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
lua/http/dialogs/create_stream.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
lua/http/dialogs/equalizer_window.html
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral30
Sample
lua/http/dialogs/equalizer_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
lua/http/dialogs/error_window.html
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral32
Sample
lua/http/dialogs/error_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target lua/http/dialogs/browse_window.html
- Size 1KB
- Sample240809-gysj4a1dpg
- SHA256 d93c774a7aeb4594f56b37e81838ba03b6855c2bbd91eb8cb803dbd413c5e571
- MD5 78f476640b27adfdcfe6e26edf4cc7e6
- SHA1 414d54995cc46fcf5a12b826df9b8f6f2be21100
- SHA512 daeddd3974908fa314d072b37accaf3dc0f3ab694fcd8acde02a77176d54710fc9115c2ab915b3b063fe3ea89308cee9e3fd67da1641735027af74fc6bb8080f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1636 msedge.exe 1636 msedge.exe 4244 msedge.exe 4244 msedge.exe 408 identity_helper.exe 408 identity_helper.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe 4244 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 2628 4244 msedge.exe 84 PID 4244 wrote to memory of 2628 4244 msedge.exe 84 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 4508 4244 msedge.exe 85 PID 4244 wrote to memory of 1636 4244 msedge.exe 86 PID 4244 wrote to memory of 1636 4244 msedge.exe 86 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87 PID 4244 wrote to memory of 1428 4244 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\browse_window.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb948946f8,0x7ffb94894708,0x7ffb948947182⤵PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:12⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:82⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:12⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:3932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,18161768893697655547,10644611735094529324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5092
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
- MD5 53bc70ecb115bdbabe67620c416fe9b3
- SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
- SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
- MD5 e765f3d75e6b0e4a7119c8b14d47d8da
- SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
- SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 98e1c305c2aa11b63fb84605829e33b565e73d7fe700e03c61e51c6523308527
- MD5 7eacc86625740be756da762b7d81fbbf
- SHA1 120ea42f752feeab3a73420f467e6847e9cd486c
- SHA512 510ae35a1821f013925def2dd73ce85d3a4cfd6f6ee02f28149736cd6f08a04ac70235ef901354643f7294a8d956f09304215c35d89c94c8107b841a93c4a049
- SSDEEP 96:nBkzDxm/LQYmqZ1rRQwpvWMoiVmdeH85qq6EUWQyV+VDCziEwb:nBkzwAOFRQGWMXGnro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fe8d545bc5d3ba92851153dc4d7a6d80f43843545eb638b058c1da3faa268854
- MD5 2fa3703f1668c6caa9a76eb600ad3e8e
- SHA1 c7864ba8c2469294f48dbda518067e77d14cdcea
- SHA512 898650611f20ebe56338f1a0d75801946f1a35a6292e98a696e9d0d48c38e483289a0560ff44fd6f27373eba5ddf07695b78240ee11ac9923523c6479b75db0b
- SSDEEP 96:nBkzDxm/L6mqZ1rRQwpvWMoiVmdeH85qq6EUWQyV+VD7AiEwb:nBkzwFOFRQGWMXGnrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d182bf0d11167ca26a8c9f3e47d8f693527b033f9c0801ef8ba6f416003c06ed
- MD5 8f0d38db379234b7c7b5ddfc1889ea7c
- SHA1 52df3ee92b8ba44fb8a783878a5f85bc69b91a2f
- SHA512 6b1477dcf6aafbc3029f3659fc71d63268dd82c5aa7ac4552ee8a63600aad1c3c33426ac445a89b9aaa1209ebd240f1156e04a7f63d991d40f1e827e66a5a3d4
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprvRclpe2RUgB7i+0ru8z8c:A9iIxuERzA83h09RZxYdo9jlV0Pz8JZk
- MD5 SHA1 SHA512 SSDEEP