Overview
overview
7Static
static
3GDLauncher...64.exe
windows7-x64
4GDLauncher...64.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3GDLauncher.exe
windows7-x64
1GDLauncher.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1owutility.dll
windows7-x64
1owutility.dll
windows10-2004-x64
1resources/...li.exe
windows7-x64
1resources/...li.exe
windows10-2004-x64
1resources/...le.exe
windows7-x64
1resources/...le.exe
windows10-2004-x64
5resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1Analysis
- max time kernel
145s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 23:42
Static task
static1
Behavioral task
behavioral1
Sample
GDLauncher__2.0.9__win__x64.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
GDLauncher__2.0.9__win__x64.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
GDLauncher.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
GDLauncher.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
owutility.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral23
Sample
owutility.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/binaries/core_module.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/binaries/core_module.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/elevate.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral29
Sample
resources/elevate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral31
Sample
vk_swiftshader.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
vulkan-1.dll
Resource
win7-20240508-en
windows7-x64
General
- Target LICENSES.chromium.html
- Size 8.7MB
- Sample240603-3p5c7aec79
- SHA256 6daa3cd398e5380222c6b6bdb4d66a4b4273d4bb74d6bf53495a5722f03ac0dc
- MD5 fcb299831276a7c8bdeb036142da1c25
- SHA1 bf6990abb92ab627b7f2e7aecbd5a58b86d2e09a
- SHA512 1e31ac0b6836d24488e32d04b5028ac2a9e00ebd8e29aaf742d9e0cdb50d5a9d4f7bcc3919b22a793552d31aaed2104415268f14e903754bf25a86510fbc98c9
- SSDEEP 24576:RQQa6NA6P5dWWSmwRFXe1vmfpV6k626D6b62vCuApj:RWfTF0
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 404 msedge.exe 404 msedge.exe 1068 msedge.exe 1068 msedge.exe 2496 identity_helper.exe 2496 identity_helper.exe 2500 msedge.exe 2500 msedge.exe 2500 msedge.exe 2500 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1068 wrote to memory of 3776 1068 msedge.exe 79 PID 1068 wrote to memory of 3776 1068 msedge.exe 79 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 4424 1068 msedge.exe 80 PID 1068 wrote to memory of 404 1068 msedge.exe 81 PID 1068 wrote to memory of 404 1068 msedge.exe 81 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82 PID 1068 wrote to memory of 2396 1068 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8daf946f8,0x7ff8daf94708,0x7ff8daf947182⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:82⤵PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:3968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:1088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16978555845969980920,14426470626105628825,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5dd79e00-a40a-4a6a-8060-5e386c27bae8.tmp
- Size 6KB
- SHA256 f49709c16c7e268d6420cb083ee45538ac2ca640e926b46ead6795115adb8ca1
- MD5 3e17bee7b9d74891822b136085c2abf6
- SHA1 dcb769a611d7ec0cf1eab675575290250b8e0e94
- SHA512 75ba4126af1abda2ad8bfca9514dde1f53a717676a12e0f8db92ab971726a243d2d791d7b080750799a89c8a9fa002d0527959bd62502424b0327cefa4d8433d
- SSDEEP 96:n2k3t1U/e8wpvWMoiVmdeHpw8EDABUWQyV+VD7AiEwb:n2kdm/e8GWMXpwGBrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 fadda73eabc9508762b19b5e0d4c87fcef9ad5c7a4f0f37fc2530a692eba383f
- MD5 4e8e14f82b54e869611dc696c87e4281
- SHA1 137c312bf09349ce6dd5ec2dd46c9a903333a220
- SHA512 aa6d8eb0ab80ebbf2172be268f5c72300caa0bd9959d3673c12c6224e8c2656f3e7fec48341e9fa3929db001b1f6346c69dcc76674b3213b2db515c683906f08
- SSDEEP 96:n2kMt1UPe8wpvWMoiVmdeHpw8EDABUWQyV+VDCziEwb:n2kcmPe8GWMXpwGBro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 1610c6289d7a0bca5d76f64168f5f5e607b776defb32e4943f8df8fe0678fa4d
- MD5 0fe794a8c8beaedbbf732d41861cd477
- SHA1 ad023820c92e521ae69564ccd58d8ed7c59983f0
- SHA512 a2550562acdabd0e3e96a198b549b53bf8aebbf106fb44586a0649fe7031d98456626489fa82712cdf357863676d3d676bf958b5e9d98ee7954aeb734f3dae2c
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2M2e2RUiJ+kE3z2OMDCRHR:A9iIxuERzA83h09RZxYq/EaOMWRHqlWj
- MD5 SHA1 SHA512 SSDEEP