Overview
overview
10Static
static
10Ultimate Tweaks.exe
windows7-x64
7Ultimate Tweaks.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3Ultimate Tweaks.exe
windows7-x64
1Ultimate Tweaks.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3Analysis
- max time kernel
145s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
22/09/2024, 19:09
Behavioral task
behavioral1
Sample
Ultimate Tweaks.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ultimate Tweaks.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
Ultimate Tweaks.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Ultimate Tweaks.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
vulkan-1.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 8.7MB
- Sample240922-xt4dsstgml
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2428 msedge.exe 2428 msedge.exe 4020 msedge.exe 4020 msedge.exe 4784 identity_helper.exe 4784 identity_helper.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 2080 4020 msedge.exe 81 PID 4020 wrote to memory of 2080 4020 msedge.exe 81 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 800 4020 msedge.exe 82 PID 4020 wrote to memory of 2428 4020 msedge.exe 83 PID 4020 wrote to memory of 2428 4020 msedge.exe 83 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84 PID 4020 wrote to memory of 384 4020 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc435146f8,0x7ffc43514708,0x7ffc435147182⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:82⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:12⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:12⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1951281630346979279,12383867089974021548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4248
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2300
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
- MD5 eeaa8087eba2f63f31e599f6a7b46ef4
- SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
- SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
- MD5 b9569e123772ae290f9bac07e0d31748
- SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
- SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 58f506413b7e306e32adcfb1026515aecb62be5460888269cf51db8af6b1e3a2
- MD5 2ea34a9d3de7c53af9f8ec467c3d4c55
- SHA1 a9ce3231749b4a786300d6474d8807aed43b8fe1
- SHA512 50dbd5dd73f184061ae350b3ae1edd305aa3e50e1a999eb6e6020bfcbeb128a0c2fc9649b4e57e1fabce047317a1b2629052efb8891d8b81e4df7b8ab43f4c11
- SSDEEP 96:nkk/MoE51CuwpvWMoiVmdeHk8FUWQyV+VD7AiEwb:nkk/gIuGWMXDrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 90d8a17559b88ecb2cdd36833c49b6080020db5ffd22cef662283d55281d9aac
- MD5 c899b3dbc5f49fb4073eb8ee298f127d
- SHA1 8de4238a6414c6b6b3050c6b1bc46267990b9734
- SHA512 0638a149f30b38a5c40e2e9597a3ab4b7e992d0fee224e32af197dc9149dcc7aa146a463c7b235ff2a5c7264a3269e4ef71372da5f49f12b41fcfa923799ea33
- SSDEEP 96:nkk/hE51CWwpvWMoiVmdeHk8FUWQyV+VDCziEwb:nkk/IIWGWMXDro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 c96c286cbead39643a5042525c911d9f5cdee3b33dfe92b57534cbf3238c064e
- MD5 fbec212e95476ed1396e46e029ce9bd7
- SHA1 e003e3985c39d0daf2822f17afa2be741d59ef42
- SHA512 6e708260adee91ad55fa630b697a35d64716a89ba99c0a8af62e4c6840c0d67fe4e43415ad77f07a6e4970f08174c34128448b9d876344d3056bccd923e9e2f8
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupae2RUND/xnAIcM/bo5ZxM:A9iIxuERzA83h09RZxY0cxJqZxM
- MD5 SHA1 SHA512 SSDEEP