Overview
overview
5Static
static
3Outplayed ...er.exe
windows11-21h2-x64
5$PLUGINSDI...p.html
windows11-21h2-x64
1$PLUGINSDI...x.html
windows11-21h2-x64
1$PLUGINSDI...app.js
windows11-21h2-x64
3$PLUGINSDI...uts.js
windows11-21h2-x64
3$PLUGINSDI...dle.js
windows11-21h2-x64
3$PLUGINSDI...min.js
windows11-21h2-x64
3$PLUGINSDI...ons.js
windows11-21h2-x64
3$PLUGINSDI...ics.js
windows11-21h2-x64
3$PLUGINSDI...nds.js
windows11-21h2-x64
3$PLUGINSDI...ies.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...der.js
windows11-21h2-x64
3$PLUGINSDI...ils.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...s.html
windows11-21h2-x64
1Analysis
- max time kernel
522s - max time network
502s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
11/06/2024, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
Outplayed - Installer.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/app/cmp.html
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app/index.html
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app/js/app.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/app/js/windows/cri/template.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/finish-with-recommended-app-controller.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/template.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/app/js/windows/finish/finish-controller.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/app/js/windows/finish/template.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/app/js/windows/main/main-controller.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/app/js/windows/main/template.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/app/js/windows/modal/modal-controller.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/app/js/windows/privacy/privacy-controller.js
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/app/js/windows/privacy/template.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/app/js/windows/progress/progress-1-controller.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/app/js/windows/progress/template.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/app/js/windows/settings/settings-controller.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/app/js/windows/settings/template.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/app/js/windows/welcome/template.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/app/js/windows/welcome/welcome-controller.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/app/progress.html
Resource
win11-20240426-en
windows11-21h2-x64
General
- Target $PLUGINSDIR/app/cmp.html
- Size 5KB
- Sample240611-reqaqszenn
- SHA256 6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
- MD5 d7b8b31b190e552677589cfd4cbb5d8e
- SHA1 09ffb3c63991d5c932c819393de489268bd3ab88
- SHA512 32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
- SSDEEP 48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 4076 msedge.exe 4076 msedge.exe 3504 msedge.exe 3504 msedge.exe 4164 identity_helper.exe 4164 identity_helper.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 3608 4076 msedge.exe 80 PID 4076 wrote to memory of 3608 4076 msedge.exe 80 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 904 4076 msedge.exe 81 PID 4076 wrote to memory of 3316 4076 msedge.exe 82 PID 4076 wrote to memory of 3316 4076 msedge.exe 82 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83 PID 4076 wrote to memory of 3396 4076 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd9ea73cb8,0x7ffd9ea73cc8,0x7ffd9ea73cd82⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:12⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:12⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4264 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,16210091682351996541,4510165313560749286,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4568 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4176
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947
- MD5 390187670cb1e0eb022f4f7735263e82
- SHA1 ea1401ccf6bf54e688a0dc9e6946eae7353b26f1
- SHA512 602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a
- MD5 8294f1821fd3419c0a42b389d19ecfc6
- SHA1 cd4982751377c2904a1d3c58e801fa013ea27533
- SHA512 372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 1aa655e53d4f553e598e0226bf56c868243ac9b8a8cbb0d182c9e5a792bed66c
- MD5 387d7fd614e0de18d7a2e57111c93aa2
- SHA1 3917e1805f02c7517388864baebd45587a7ed0f0
- SHA512 d1661208f34e7e9c861bb3f47cb5bfc55c321f8ba63432bfc76a041ff826f0213d54af56e3ebb5d8ea2f531e1ef00e5f3d40e5d4131463e67bea4e378d0b2081
- SSDEEP 96:nFRk3oVxwk+WwSv0MoiVmdHITJeA0WQyV+VuziX3wI3:nFRk3Oxwk+Wv0MAI9eALM93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 6f22b40c586c13e85cf91ff512852f5385ca39d2243a8d84ff3a1aa8c8f52750
- MD5 289642fc752af43aad2a237f9f544887
- SHA1 229cf57962af7316d26010c9e284ccf92502cd8c
- SHA512 3964f240d8e81f72eb6693bd22498739eaabf31d7a3dfcac1187dd3c40db7825e847e206fa002880ea8c04338656d727fe42671242e63e4a39c4ebc38be3fc0c
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGdOdYe2RUmAH/R2syRYYq:M9iIxuERzA83h09RZxASGJbAHty2Yq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 e41a25e6d98cf2bdce97461727659cc61e86f63907ea19f4d5e21144b0d657ac
- MD5 deda3743678102b055b2bd7ba1b6c150
- SHA1 862078b621ba7e5963d0c39a2b1c0b9ff31ac143
- SHA512 cfe13b6175eaa84b4a73fee4fbf2435cb03394a12eea55dfe188128166272ac1a651c49bdde7c65095a5dbe7df1d7cc85b8d0116c6e8a2bcaa3e8e49ea61f83d
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oOdYe2RUmAH/R2JFRYYq:M9iIxuERzA83h09RZxA3KbAHIF2Yq
- MD5 SHA1 SHA512 SSDEEP