Overview
overview
7Static
static
3ShaderifyB....0.exe
windows7-x64
7ShaderifyB....0.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1ShaderifyBeta.exe
windows7-x64
7ShaderifyBeta.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows7-x64
3resources/app.js
windows10-2004-x64
3resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
- max time kernel
148s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ShaderifyBeta 1.4.0.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ShaderifyBeta 1.4.0.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
ShaderifyBeta.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral10
Sample
ShaderifyBeta.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/app.js
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/app.js
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/elevate.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 4.5MB
- Sample240614-ces93avdpn
- SHA256 03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
- MD5 d4a79b5d46f0931b9eb7125fd40baff0
- SHA1 3a38fb263dde2251b9fe157b5fddec7acb07c53e
- SHA512 17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339
- SSDEEP 24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4900 msedge.exe 4900 msedge.exe 3924 msedge.exe 3924 msedge.exe 4060 identity_helper.exe 4060 identity_helper.exe 2220 msedge.exe 2220 msedge.exe 2220 msedge.exe 2220 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 2992 3924 msedge.exe 82 PID 3924 wrote to memory of 2992 3924 msedge.exe 82 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 3156 3924 msedge.exe 83 PID 3924 wrote to memory of 4900 3924 msedge.exe 84 PID 3924 wrote to memory of 4900 3924 msedge.exe 84 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85 PID 3924 wrote to memory of 1940 3924 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbc8346f8,0x7ffdbc834708,0x7ffdbc8347182⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5830847677551477342,9573911999979182938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2220
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4160
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
- MD5 81e892ca5c5683efdf9135fe0f2adb15
- SHA1 39159b30226d98a465ece1da28dc87088b20ecad
- SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
- MD5 56067634f68231081c4bd5bdbfcc202f
- SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
- SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 c268f4b7100baf58836cc98c0dfff0b8627297d51d954d1448da2c8e34701ad5
- MD5 c416b7ef31bd160a54d1aa533a4511ea
- SHA1 d81f85dd12507cdd162705020d606980e6454c67
- SHA512 f675ae1e5db90859eaea32eadb3a61fa895ddfcc022ce64eef2a800d2108ddad2fe20f87329288149b58622825bc94a0d8c3df5c2e6358eb050e0e3ff0c57151
- SSDEEP 96:n0k/oxm/Dnmq51skwpvWMoiVmdeHIqQc0UUWQyV+VD7AiEwb:n0kB6WGkGWMXdFVrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 da838d20a2c78c4520ad4ad29bebc655750db13f749ccacb22b902d11a292160
- MD5 4af82f7d7c738a9289df67849f1378be
- SHA1 4066a00cdaa4be40f02cc3589968f9ee5d7b13b6
- SHA512 da1d8f56afda3c7e6a4c347cc3682dce05dcf70a82218729f328ad5cbb25bbe0b60b415427e642b41e4fa4feeb74e8f40bbfe062e675a117f915f7c30af55ee5
- SSDEEP 96:n0k/oxm/DQYmq51sswpvWMoiVmdeHIqQc0UUWQyV+VDCziEwb:n0kBIWGsGWMXdFVro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 a6d9713872c21cdc41a66a79c742f6d5b3c5f1038817e3bda00da7a7f57f2b9e
- MD5 2dce70e2a7a613239b6b66a3382b2718
- SHA1 8b26aa7950c950e624891bc5de0ac101a30bf50a
- SHA512 d21cdfb8dcb2f0092bbe295f96a8d7fdeffe3b667cea802c55a40674d1aac95f12baa2ff041fb0303a3caed77a786af121d8040ec57115d5cae32d79a15eca2c
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNp0Le2RUGkdvV3z2OMDCRQ:A9iIxuERzA83h09RZxYobDUVaOMWRHqj
- MD5 SHA1 SHA512 SSDEEP