Overview
overview
5Static
static
3vlc-3.0.21-win64.exe
windows7-x64
4vlc-3.0.21-win64.exe
windows10-2004-x64
4$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3NEWS.vbs
windows7-x64
1NEWS.vbs
windows10-2004-x64
1axvlc.dll
windows7-x64
5axvlc.dll
windows10-2004-x64
5libvlc.dll
windows7-x64
1libvlc.dll
windows10-2004-x64
1libvlccore.dll
windows7-x64
1libvlccore.dll
windows10-2004-x64
1lua/http/custom.js
windows7-x64
3lua/http/custom.js
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...m.html
windows7-x64
3lua/http/d...m.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 06:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
vlc-3.0.21-win64.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
vlc-3.0.21-win64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
NEWS.vbs
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
NEWS.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
axvlc.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
axvlc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
libvlc.dll
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
libvlc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
libvlccore.dll
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
libvlccore.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
lua/http/custom.js
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
lua/http/custom.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
lua/http/dialogs/batch_window.html
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
lua/http/dialogs/batch_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral25
Sample
lua/http/dialogs/browse_window.html
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
lua/http/dialogs/browse_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
lua/http/dialogs/create_stream.html
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
lua/http/dialogs/create_stream.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral29
Sample
lua/http/dialogs/equalizer_window.html
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
lua/http/dialogs/equalizer_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
lua/http/dialogs/error_window.html
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral32
Sample
lua/http/dialogs/error_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target lua/http/dialogs/create_stream.html
- Size 14KB
- Sample240809-gysj4a1dpg
- SHA256 fdfc3417223b88d2e8f0421ced4711760ab11a3c18a50dc05b805a0f4f1a5134
- MD5 c38a93ae302612a55ccf7f11bdb79c37
- SHA1 f6064e146909323276c6c43410f314666e35b5a4
- SHA512 9c38a52c10455ffa179f0bad0d09d50defddad25d850248a4a15ebf5aefbe0165e12ee7eace516ced181362062b7651c9f246c4a1c77a6da867bc8ad978d56be
- SSDEEP 192:jvlSM2AtdS0E2jSC+J3kuC6qSSSKyf+yO3zy6CGuGek+3LbnAilKyc7aSCWM2kco:jvlIATE2jJAhuDqx3J0vHEF
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4252 msedge.exe 4252 msedge.exe 4236 msedge.exe 4236 msedge.exe 4352 identity_helper.exe 4352 identity_helper.exe 2592 msedge.exe 2592 msedge.exe 2592 msedge.exe 2592 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4236 wrote to memory of 976 4236 msedge.exe 84 PID 4236 wrote to memory of 976 4236 msedge.exe 84 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4952 4236 msedge.exe 85 PID 4236 wrote to memory of 4252 4236 msedge.exe 86 PID 4236 wrote to memory of 4252 4236 msedge.exe 86 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87 PID 4236 wrote to memory of 3928 4236 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\create_stream.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffdbc9b46f8,0x7ffdbc9b4708,0x7ffdbc9b47182⤵PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13818016333771295872,4106353811872488813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
- MD5 d7114a6cd851f9bf56cf771c37d664a2
- SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
- SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
- MD5 719923124ee00fb57378e0ebcbe894f7
- SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
- SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 be773923b9a03cbf6859e06c55a82b8e9e5f35fca79bbffc98c650a7ffa9ced1
- MD5 8861e10b8a314b0fd957a7efd6ac2861
- SHA1 67554348c7e57ec4654afcb3acb72173d851a67a
- SHA512 c2944621fddaf038f59a9d8a5cfcf674501a1aa88178d11bef7814ab4be7aee65e7603f3597105e3ed6bae6b153af7bb2727c6063de948bb0d6d1fb7dfc10a43
- SSDEEP 96:nIkzDxm/LQYmqR1SQLSFhPwpvWMoiVmdeH/bq/UWQyV+VDCziEwb:nIkzwAWERFhPGWMXm/ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 c90c8f1e9f05cb9454c5c6402619b607edfc97d10cf87f08cea720ad7c1d8db5
- MD5 5708d9a2d8bc6c6f3d9440c4fa97c96b
- SHA1 36c17156b15a84244212634892cf3b614a29eeff
- SHA512 98af2fda4ae99e773e39edf18399f0ff71efc2a9577f62f4a3e98d7ee28b03f854c01c962e678a8f69d6fa624022439e2ee064cae215be1e516d76f6b310c602
- SSDEEP 96:nIkzDxm/L6mqR1SQLSFhPwpvWMoiVmdeH/bq/UWQyV+VD7AiEwb:nIkzwFWERFhPGWMXm/rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 9c01748475565da6cde276d13ed26e98839919312a4fecd27a2e7b533046fd9c
- MD5 b8529210449debdfb36ab1cb320ccc3a
- SHA1 05af91c71834b49d6867cd3241551c04bf09aabb
- SHA512 3f784d97f305403d44ba4080027328986b73bfd45ce736b02e79efa4079112907eae0d88426d967f436712801540378065734a83a57ddd17eccf0ca89b368dfc
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBte2RUBxNPru8z8ZJnbK:A9iIxuERzA83h09RZxYBpAPPz8PbK
- MD5 SHA1 SHA512 SSDEEP