Overview
overview
5Static
static
3vlc-3.0.21-win64.exe
windows7-x64
4vlc-3.0.21-win64.exe
windows10-2004-x64
4$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3NEWS.vbs
windows7-x64
1NEWS.vbs
windows10-2004-x64
1axvlc.dll
windows7-x64
5axvlc.dll
windows10-2004-x64
5libvlc.dll
windows7-x64
1libvlc.dll
windows10-2004-x64
1libvlccore.dll
windows7-x64
1libvlccore.dll
windows10-2004-x64
1lua/http/custom.js
windows7-x64
3lua/http/custom.js
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...m.html
windows7-x64
3lua/http/d...m.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.21-win64.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
vlc-3.0.21-win64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
NEWS.vbs
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
NEWS.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
axvlc.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral16
Sample
axvlc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libvlc.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral18
Sample
libvlc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
libvlccore.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
libvlccore.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
lua/http/custom.js
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral22
Sample
lua/http/custom.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
lua/http/dialogs/batch_window.html
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
lua/http/dialogs/batch_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
lua/http/dialogs/browse_window.html
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral26
Sample
lua/http/dialogs/browse_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
lua/http/dialogs/create_stream.html
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
lua/http/dialogs/create_stream.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
lua/http/dialogs/equalizer_window.html
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral30
Sample
lua/http/dialogs/equalizer_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
lua/http/dialogs/error_window.html
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral32
Sample
lua/http/dialogs/error_window.html
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target lua/http/dialogs/error_window.html
- Size 501B
- Sample240809-gysj4a1dpg
- SHA256 75d1a1ab807cd97801bc37ed547b26c7b357497e82d01221ac064497c9480304
- MD5 ad9769b13838d62653857ff47718c6c0
- SHA1 a4683573d5b43aca9e256d4a45dc5ac46db927ed
- SHA512 58a7d9ce56936da79a8f46f0f5c1e465d63ee1b8f68701627ffa00e1c43267899a64a3dfe601bf660bfee66b5ea365a27ba8d68f7d598ab6e3a917b52d6e9fc0
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1864 msedge.exe 1864 msedge.exe 4856 msedge.exe 4856 msedge.exe 2792 identity_helper.exe 2792 identity_helper.exe 316 msedge.exe 316 msedge.exe 316 msedge.exe 316 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4948 4856 msedge.exe 84 PID 4856 wrote to memory of 4948 4856 msedge.exe 84 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 2096 4856 msedge.exe 85 PID 4856 wrote to memory of 1864 4856 msedge.exe 86 PID 4856 wrote to memory of 1864 4856 msedge.exe 86 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87 PID 4856 wrote to memory of 2524 4856 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\error_window.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade6e46f8,0x7ffade6e4708,0x7ffade6e47182⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:2524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,15137291850881985944,5529955290247609631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:316
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
- MD5 9e3fc58a8fb86c93d19e1500b873ef6f
- SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
- SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
- MD5 27304926d60324abe74d7a4b571c35ea
- SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
- SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e4aab3f8e328096f5e367aabae4e36f44eb44fcc1f8540ef87302a77297d5a9d
- MD5 487e695d80d30f28277799f1bcd57347
- SHA1 a2cf3e98fc1087ad06b8f64a8afe51e51ac5ce08
- SHA512 baa8da4d3a508d18ac50dceb48913302bb16cd24d38bd7080b137a1e38a9b0f48f0f3bb2222ac10b875deb62f922aaf2a13a893a8bed2cafa130c7a9da0cdccf
- SSDEEP 96:nrkRDxm/LQYmqIY1CxwpvWMoiVmdeH4piNHUWQyV+VDCziEwb:nrkRwAYsxGWMX4kpro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 24bdcabfb2f95e58c0cd2e52ac637a00e9bd03bc29ac9d0b19beaf9faa615763
- MD5 f1dbf7492228d4052f80edb354632244
- SHA1 f9f7a0c4b804a077241c9a27081364291614298e
- SHA512 d3630d5eb2cdcc1aa0f02ae9006d0be832799d2d8b49f3592c02de00870c4fa9691a319908081635aa952301cfcad5dde6cf341edd2a7ed760d338f9bb411d25
- SSDEEP 96:nrkRDxm/L6mqIY1CxwpvWMoiVmdeH4piNHUWQyV+VD7AiEwb:nrkRwFYsxGWMX4kprg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ddc559b0e54dfa68729560615fad87f7806a6ae5e33bb687d51235c4e5676425
- MD5 6609aaab82f216b73817ee100e8190a0
- SHA1 4c7321ca44f841cc78d7c6ea6ea1d2c43cef12a6
- SHA512 e101d691cb3c69c31c401c877d89e91e04663cce11c7b3c33e919614a3748fd8bc10966356a85d1a9925788a9ea6492f75c24d19ca3c6dbe84f3d33d006f28c9
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupICe2RUqc8cdru8z8ZJZJR:A9iIxuERzA83h09RZxYI8t8Pz8hJR
- MD5 SHA1 SHA512 SSDEEP