Overview
overview
7Static
static
7vpnclient/28ip.html
windows7-x64
3vpnclient/28ip.html
windows10-2004-x64
3vpnclient/gonggao.htm
windows7-x64
3vpnclient/gonggao.htm
windows10-2004-x64
3vpnclient/ip.html
windows7-x64
3vpnclient/ip.html
windows10-2004-x64
3vpnclient/ssm.html
windows7-x64
3vpnclient/ssm.html
windows10-2004-x64
3vpnclient/top.htm
windows7-x64
3vpnclient/top.htm
windows10-2004-x64
3vpnclient/...p.html
windows7-x64
3vpnclient/...p.html
windows10-2004-x64
3vpnclient2/28vpn.exe
windows7-x64
7vpnclient2/28vpn.exe
windows10-2004-x64
7vpnclient2....0.exe
windows7-x64
7vpnclient2....0.exe
windows10-2004-x64
vpnclient2....0.exe
windows7-x64
7vpnclient2....0.exe
windows10-2004-x64
7vpnclient2...ao.htm
windows7-x64
3vpnclient2...ao.htm
windows10-2004-x64
3vpnclient2/top.htm
windows7-x64
3vpnclient2/top.htm
windows10-2004-x64
3top.htm
windows7-x64
3top.htm
windows10-2004-x64
3vpnclient2...t2.lnk
windows7-x64
3vpnclient2...t2.lnk
windows10-2004-x64
6vpnclient2...op.htm
windows7-x64
3vpnclient2...op.htm
windows10-2004-x64
3vpnclient2...op.htm
windows7-x64
3vpnclient2...op.htm
windows10-2004-x64
3Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
13/09/2024, 19:22
Behavioral task
behavioral1
Sample
vpnclient/28ip.html
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
vpnclient/28ip.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
vpnclient/gonggao.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
vpnclient/gonggao.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
vpnclient/ip.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
vpnclient/ip.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
vpnclient/ssm.html
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
vpnclient/ssm.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
vpnclient/top.htm
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
vpnclient/top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
vpnclient/yyvpnip.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
vpnclient/yyvpnip.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
vpnclient2/28vpn.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
vpnclient2/28vpn.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
vpnclient2/28vpn_en_5.0.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
vpnclient2/28vpn_en_5.0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
vpnclient2/28vpn_zh_5.0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
vpnclient2/28vpn_zh_5.0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
vpnclient2/gonggao.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
vpnclient2/gonggao.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
vpnclient2/top.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
vpnclient2/top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral23
Sample
top.htm
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral25
Sample
vpnclient2/vpnclient2.lnk
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
vpnclient2/vpnclient2.lnk
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
vpnclient2/复件 (2) top.htm
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
vpnclient2/复件 (2) top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral29
Sample
vpnclient2/复件 top.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
vpnclient2/复件 top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target vpnclient/yyvpnip.html
- Size 17KB
- Sample240913-x3a4lsvbng
- SHA256 0a188c825871a0da916c20eb156ae6618149fc4d8ac1f12c6f8f850b31c7407c
- MD5 d33e6945bd3f485fb2820eea890311d1
- SHA1 464e0933363d78ebc04aea0b6fd4d3eb6b1899ba
- SHA512 840c57c5b2c43b3714d65a6f22f3db55e934a66c754e46ae162786038a52c550cfd5c9cd27544ddfe198dd35b1f1fbd980107651bee6fecb37c70992f6646f1a
- SSDEEP 192:6qjINZYdqgXdihXOBOSY3SaOyOpeBc9tuJTMM8M97rglXZPooFja1TxwAskOgOyg:6yldihXyo3SaRNc9tHwoidPNOd
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 960 msedge.exe 960 msedge.exe 3108 msedge.exe 3108 msedge.exe 1456 identity_helper.exe 1456 identity_helper.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe 3108 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3108 wrote to memory of 4732 3108 msedge.exe 83 PID 3108 wrote to memory of 4732 3108 msedge.exe 83 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 1012 3108 msedge.exe 84 PID 3108 wrote to memory of 960 3108 msedge.exe 85 PID 3108 wrote to memory of 960 3108 msedge.exe 85 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86 PID 3108 wrote to memory of 2524 3108 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\vpnclient\yyvpnip.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5b8946f8,0x7fff5b894708,0x7fff5b8947182⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:1012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:2524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14613025422976068643,17546356910021261710,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4408
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
- MD5 9e3fc58a8fb86c93d19e1500b873ef6f
- SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
- SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
- MD5 27304926d60324abe74d7a4b571c35ea
- SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
- SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 292c0911cf5071f4123d1f4cabb17327af96682f8fe420374e39c0a860811c0c
- MD5 be422019a1e017070261a0f5619dea48
- SHA1 ec223af3ea4184d2f2e5fd0e9a600f40f5c8a134
- SHA512 426cbfbf68be57cc16bfa30c5bd6b78f46f9d5ee19b7e3f50dddce708f09ebde6dadd007744e7d10d717f7fcfb88ca8b8420562b84bc57c80072a660ad09b88a
- SSDEEP 96:nPk/0H1L05wpvWMoiVmdeH4piNWUWQyV+VDCziEwb:nPk/md05GWMX4kcro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 732e378b088a99c6ddb2c117e79a7f53535b45255160295624fec748850f1b3e
- MD5 03290ffb7092bfe3db04fbb0bfabc93e
- SHA1 7d9fab4ff0d84cb6bdb048b2b1376b3e90ecaaea
- SHA512 65eb5614a09152b675b9b59e2e858e250a224dc85fa98c66146dc75e5fc477581952c26844acabd163e39b00f75e3919b13f55403b61b640b52e1c3b7f381fed
- SSDEEP 96:nPk/eH1L0YwpvWMoiVmdeH4piNWUWQyV+VD7AiEwb:nPk/cd0YGWMX4kcrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 0c51ba05675aa07246d257b307cb822ef4caba5a1cc0201dcbd0d446f9c278fc
- MD5 92d2e88264457b03394ca2fc39b3781e
- SHA1 96161e8c8ceee8304ae6d69bec13c8d97c6959c0
- SHA512 1893eeaf65a0e1813303d0900d9ffde520c2e0ae60236519afcc1f5fc82a99ff82245b28a138f349d0d4896fc51a1f0ddbd9758bfb6f69680d1bfb5ce55e89aa
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKEme2RUGc81TeuLJ5cmW:A9iIxuERzA83h09RZxYKEoh17JCX
- MD5 SHA1 SHA512 SSDEEP