Overview
overview
3Static
static
1data/新云软件.url
windows7-x64
1data/新云软件.url
windows10-2004-x64
1images/fon...ex.htm
windows7-x64
3images/fon...ex.htm
windows10-2004-x64
3images/fon...ex.htm
windows7-x64
3images/fon...ex.htm
windows10-2004-x64
1images/fon...ex.htm
windows7-x64
3images/fon...ex.htm
windows10-2004-x64
3images/js/uc.js
windows7-x64
3images/js/uc.js
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3images/sec...ex.htm
windows7-x64
3images/sec...ex.htm
windows10-2004-x64
3inc/add.js
windows7-x64
3inc/add.js
windows10-2004-x64
3inc/index.js
windows7-x64
3inc/index.js
windows10-2004-x64
3include/db...ass.js
windows7-x64
3include/db...ass.js
windows10-2004-x64
3include/gi...ass.js
windows7-x64
3include/gi...ass.js
windows10-2004-x64
3include/se...ass.js
windows7-x64
3include/se...ass.js
windows10-2004-x64
3include/te...ass.js
windows7-x64
3include/te...ass.js
windows10-2004-x64
3install/in...ls.ps1
windows7-x64
3install/in...ls.ps1
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
14/08/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
data/新云软件.url
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
data/新云软件.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
images/fonts/ch/index.htm
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
images/fonts/ch/index.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
images/fonts/en/index.htm
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
images/fonts/en/index.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
images/fonts/index.htm
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
images/fonts/index.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
images/js/uc.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
images/js/uc.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
images/seccode/background/index.htm
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
images/seccode/background/index.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
images/seccode/gif/OCR_A_Extended/index.htm
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
images/seccode/gif/OCR_A_Extended/index.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
images/seccode/gif/Small_Fonts/index.htm
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
images/seccode/gif/Small_Fonts/index.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
images/seccode/index.htm
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
images/seccode/index.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
inc/add.js
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
inc/add.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
inc/index.js
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
inc/index.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
include/db_mysql.class.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
include/db_mysql.class.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
include/gifmerge.class.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
include/gifmerge.class.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
include/seccode.class.js
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
include/seccode.class.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
include/template.class.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
include/template.class.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
install/includes/config_rglobals.ps1
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
install/includes/config_rglobals.ps1
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target images/fonts/ch/index.htm
- Size 1B
- Sample240814-y4bbfasdjf
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4696 msedge.exe 4696 msedge.exe 3140 msedge.exe 3140 msedge.exe 3216 identity_helper.exe 3216 identity_helper.exe 4044 msedge.exe 4044 msedge.exe 4044 msedge.exe 4044 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3140 wrote to memory of 4924 3140 msedge.exe 86 PID 3140 wrote to memory of 4924 3140 msedge.exe 86 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 3336 3140 msedge.exe 88 PID 3140 wrote to memory of 4696 3140 msedge.exe 89 PID 3140 wrote to memory of 4696 3140 msedge.exe 89 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90 PID 3140 wrote to memory of 4312 3140 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\images\fonts\ch\index.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaae9546f8,0x7ffaae954708,0x7ffaae9547182⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1719397745618954777,3151351271532547928,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2364 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4108
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
- MD5 eeaa8087eba2f63f31e599f6a7b46ef4
- SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
- SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
- MD5 b9569e123772ae290f9bac07e0d31748
- SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
- SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6dc2115e24e329f3d72fe392734fab300e52f621279958587e929603ebab33fe
- MD5 fb5231eeeea0e7fa2c28262cd0acce90
- SHA1 1df679ba0ae945be3cf8d1722abb588374f14601
- SHA512 7d84ecb83ac09090f645c8c5016c7b3555a69c51bedd8c662f5be41b7973840d0989571a00645a3e001bb6ad16b8a01f1a1e1910cac9907936148f1c9d5cf27f
- SSDEEP 96:nFkzDxm/LQYmqn1r6wpvWMoiVmdeHk8HUWQyV+VD7ziEwb:nFkzwAAx6GWMXNrt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 46f0b06e58ac829d2bb85bc4ad28af0fa8b70c42c06ce864403f04459d81746f
- MD5 f713eadde1fb5bd21d89aa85ced6fcac
- SHA1 798398622a4336868a958be2733170dfc1eb7863
- SHA512 1076a4921c1aabfc455e1de9650926def418a62024729e287f53d6ed6a248d53517982be217219f8ceca93172ceb647d232f4534a7331840d93b9822bddd849c
- SSDEEP 96:nFkzDxm/L6mqn1r6wpvWMoiVmdeHk8HUWQyV+VD7AiEwb:nFkzwFAx6GWMXNrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 8dc15feed2e76457319e140b1c8388c7e9e783f084d6a03aaddd990f23519912
- MD5 585e338d9b971f5c08bb7b210591a853
- SHA1 f7876bad71b45642c58cfa24991b4aa7a179861f
- SHA512 7c2a096e4414290456b69b5f0a1449aa0faea3124f15d8c80f7744a0754fcab5d51b77053bf0356d8d3a331009d8ba3aa1403abe4b6dd16dc7652955606182cc
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupde2RUfxnhru8z8ZJj6S:A9iIxuERzA83h09RZxY5khPz8r6S
- MD5 SHA1 SHA512 SSDEEP