Overview
overview
7Static
static
7vpnclient/28ip.html
windows7-x64
3vpnclient/28ip.html
windows10-2004-x64
3vpnclient/gonggao.htm
windows7-x64
3vpnclient/gonggao.htm
windows10-2004-x64
3vpnclient/ip.html
windows7-x64
3vpnclient/ip.html
windows10-2004-x64
3vpnclient/ssm.html
windows7-x64
3vpnclient/ssm.html
windows10-2004-x64
3vpnclient/top.htm
windows7-x64
3vpnclient/top.htm
windows10-2004-x64
3vpnclient/...p.html
windows7-x64
3vpnclient/...p.html
windows10-2004-x64
3vpnclient2/28vpn.exe
windows7-x64
7vpnclient2/28vpn.exe
windows10-2004-x64
7vpnclient2....0.exe
windows7-x64
7vpnclient2....0.exe
windows10-2004-x64
vpnclient2....0.exe
windows7-x64
7vpnclient2....0.exe
windows10-2004-x64
7vpnclient2...ao.htm
windows7-x64
3vpnclient2...ao.htm
windows10-2004-x64
3vpnclient2/top.htm
windows7-x64
3vpnclient2/top.htm
windows10-2004-x64
3top.htm
windows7-x64
3top.htm
windows10-2004-x64
3vpnclient2...t2.lnk
windows7-x64
3vpnclient2...t2.lnk
windows10-2004-x64
6vpnclient2...op.htm
windows7-x64
3vpnclient2...op.htm
windows10-2004-x64
3vpnclient2...op.htm
windows7-x64
3vpnclient2...op.htm
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
13/09/2024, 19:22
Behavioral task
behavioral1
Sample
vpnclient/28ip.html
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
vpnclient/28ip.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
vpnclient/gonggao.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
vpnclient/gonggao.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
vpnclient/ip.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
vpnclient/ip.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
vpnclient/ssm.html
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
vpnclient/ssm.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
vpnclient/top.htm
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
vpnclient/top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
vpnclient/yyvpnip.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
vpnclient/yyvpnip.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
vpnclient2/28vpn.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
vpnclient2/28vpn.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
vpnclient2/28vpn_en_5.0.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
vpnclient2/28vpn_en_5.0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
vpnclient2/28vpn_zh_5.0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
vpnclient2/28vpn_zh_5.0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
vpnclient2/gonggao.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
vpnclient2/gonggao.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
vpnclient2/top.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
vpnclient2/top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral23
Sample
top.htm
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral25
Sample
vpnclient2/vpnclient2.lnk
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
vpnclient2/vpnclient2.lnk
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
vpnclient2/复件 (2) top.htm
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
vpnclient2/复件 (2) top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral29
Sample
vpnclient2/复件 top.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
vpnclient2/复件 top.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target vpnclient/ip.html
- Size 17KB
- Sample240913-x3a4lsvbng
- SHA256 0a188c825871a0da916c20eb156ae6618149fc4d8ac1f12c6f8f850b31c7407c
- MD5 d33e6945bd3f485fb2820eea890311d1
- SHA1 464e0933363d78ebc04aea0b6fd4d3eb6b1899ba
- SHA512 840c57c5b2c43b3714d65a6f22f3db55e934a66c754e46ae162786038a52c550cfd5c9cd27544ddfe198dd35b1f1fbd980107651bee6fecb37c70992f6646f1a
- SSDEEP 192:6qjINZYdqgXdihXOBOSY3SaOyOpeBc9tuJTMM8M97rglXZPooFja1TxwAskOgOyg:6yldihXyo3SaRNc9tHwoidPNOd
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4388 msedge.exe 4388 msedge.exe 244 msedge.exe 244 msedge.exe 1504 identity_helper.exe 1504 identity_helper.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 244 wrote to memory of 4176 244 msedge.exe 83 PID 244 wrote to memory of 4176 244 msedge.exe 83 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 2448 244 msedge.exe 84 PID 244 wrote to memory of 4388 244 msedge.exe 85 PID 244 wrote to memory of 4388 244 msedge.exe 85 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86 PID 244 wrote to memory of 4964 244 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\vpnclient\ip.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5c8c46f8,0x7ffe5c8c4708,0x7ffe5c8c47182⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:82⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9963133854417079623,8721048086322451445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3928
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
- MD5 ecf7ca53c80b5245e35839009d12f866
- SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
- SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
- MD5 4dd2754d1bea40445984d65abee82b21
- SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
- SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 296f8002d463341c6335009954c6ff14fa04118abf8ae3976c23ee16663b5bc6
- MD5 d7ce632afb2ff8760964f0a0932708ba
- SHA1 f597792235f6d4e56b48e3919e785fafe5cb8785
- SHA512 533b5040dd76022cdc0046679da1e136a9a4379d658e24abfef862cc933b98d5f7acb54c2fedb37625869baecb91ef4f602f34213aee203e8a4389b55b5884c2
- SSDEEP 96:nXkz0P1iDTNwpvWMoiVmdeH44YApUWQyV+VDCziEwb:nXkzyAlGWMX44ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 93ae74b4eaa4f440eb88d4451c243154e4d24cfd6d40597ee20101fed3e9b450
- MD5 2ed1151c1d366c11c847b8d648909459
- SHA1 bf80e9484420e978cf0fb77533ee206d83f284f0
- SHA512 dbafeaa20027d2abed0f661aaec2b18bf9fa28fb79964b5818f8776199b73733b2206aebff39990b55ea293d527dcf062495bd651d590c888d5a5352021505c5
- SSDEEP 96:nXkzeP1iMTNwpvWMoiVmdeH44YApUWQyV+VD7AiEwb:nXkzQAMGWMX44rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 567840907167a1bea7969e12b91c693279d3de2b93023bbb2e9b05d2ab762dca
- MD5 6e380fd078ef41e31c1ef8bd283b6952
- SHA1 9c0149c11a4ea4bd861d44a48a2bad64d457f097
- SHA512 fda8cd471c1617dac4019d3666a252dffab3fd9dbac77794cacfbd798742179743c529e3a296229ea484f9dec6ae92d8895e4e6ebecab2231229ddd6b62b5f09
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWe2RUnOk6+TeuLJ5cmv:A9iIxuERzA83h09RZxY466+7JCa
- MD5 SHA1 SHA512 SSDEEP