Overview
overview
7Static
static
7Mantle - I...er.exe
windows11-21h2-x64
4$PLUGINSDI...p.html
windows11-21h2-x64
3$PLUGINSDI...x.html
windows11-21h2-x64
3$PLUGINSDI...app.js
windows11-21h2-x64
$PLUGINSDI...uts.js
windows11-21h2-x64
3$PLUGINSDI...dle.js
windows11-21h2-x64
3$PLUGINSDI...min.js
windows11-21h2-x64
3$PLUGINSDI...ons.js
windows11-21h2-x64
3$PLUGINSDI...ics.js
windows11-21h2-x64
3$PLUGINSDI...nds.js
windows11-21h2-x64
3$PLUGINSDI...ies.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...der.js
windows11-21h2-x64
3$PLUGINSDI...ils.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
3$PLUGINSDI...ate.js
windows11-21h2-x64
$PLUGINSDI...ler.js
windows11-21h2-x64
3$PLUGINSDI...s.html
windows11-21h2-x64
3Analysis
- max time kernel
112s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system - submitted
26/07/2024, 08:19
Behavioral task
behavioral1
Sample
Mantle - Installer.exe
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/app/cmp.html
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app/index.html
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app/js/app.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/app/js/windows/cri/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/finish-with-recommended-app-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/app/js/windows/finish/finish-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/app/js/windows/finish/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/app/js/windows/main/main-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/app/js/windows/main/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/app/js/windows/modal/modal-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/app/js/windows/privacy/privacy-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/app/js/windows/privacy/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/app/js/windows/progress/progress-1-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/app/js/windows/progress/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/app/js/windows/settings/settings-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/app/js/windows/settings/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/app/js/windows/welcome/template.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/app/js/windows/welcome/welcome-controller.js
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/app/progress.html
Resource
win11-20240709-en
windows11-21h2-x64
General
- Target $PLUGINSDIR/app/index.html
- Size 20KB
- Sample240726-j7xarazeqa
- SHA256 2e021cb3a05785a9ff37b7e242aa906885cb478fc1f432a60445818ce62ffa75
- MD5 2527cffc045f9d6ee9963995bbb347f8
- SHA1 2e9de521188aeef5b872db3817b7d7f5a56229fc
- SHA512 976a378cf0161efcaba4d26aa436e0d0338a0c9661e2111dfe82a336daa7638f0701277bb17b7bc0e97011a3a3f1d7a6fd31f0b390a769c7e1de8b627bf33509
- SSDEEP 192:DgNbWj9DeNPkvHmY740TqmtRCtmK8WbIEgHZMlxh8Br9LJNHab4SrgJnc50/930i:ENHwTaMSGnBJuy05SN1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2332 msedge.exe 2332 msedge.exe 4832 msedge.exe 4832 msedge.exe 3040 msedge.exe 3040 msedge.exe 2384 identity_helper.exe 2384 identity_helper.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 2216 4832 msedge.exe 81 PID 4832 wrote to memory of 2216 4832 msedge.exe 81 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 3184 4832 msedge.exe 83 PID 4832 wrote to memory of 2332 4832 msedge.exe 84 PID 4832 wrote to memory of 2332 4832 msedge.exe 84 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85 PID 4832 wrote to memory of 2668 4832 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca73d3cb8,0x7ffca73d3cc8,0x7ffca73d3cd82⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:82⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:12⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,13983001347157585779,13596167689484043754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:12⤵PID:1588
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1088
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 22d8c228cdcfd3e05431d7377748014035a3488ad3a0d4aecc334e724245a1f9
- MD5 f1d33f465a73554cd1c183cbcd0a28a2
- SHA1 f5c16fc4edff600cb307f762d950500aa29a1e8b
- SHA512 7cc94f77f3943143ee86eabbfddcb110ce52c6ff0975842e3a3d06072f51f2c48914ee61f24484a539888ad19a7e6a1becfb029485cd5984bc736434a63cee95
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9da0e657652daa1ef86af7c3db62b0af9cce372a5f765c98c68479922ccf1923
- MD5 575466f58c7d9d3224035d23f102d140
- SHA1 2fce4082fa83534b3ddc91e42fb242baee4afa1c
- SHA512 06503e718fe967076dd8a061b57debdc663b9616b005f8567099a84fc7184880633079335d622c243918efc3356b40e683708fb0583084abeed7db6168a212ab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 309B
- SHA256 0a47a0764685dc7e68ab0dac70dc242dd4de1b3239474efdc4c7c761a1ed3120
- MD5 318b6487eee285a9d5d800abec19d5aa
- SHA1 96873003767c3ade79fb5ad0d5ee45d43370d4a2
- SHA512 8a1b97c75449ccc9d124d819b90b447de07905d7c5f858ac55ee5560dd2f6f803968503be6f0fb418840e32b7107aa01f1df411d7b6c861f20b3ffd7616927a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b5f222c2cdf41fd92d20e6c059a1440975ee410dd8028685aca437b67553c680
- MD5 4ab8035f07f4984d2522d601379df960
- SHA1 0a7bd5b465406642f2b4010d64e4ee14d39c246e
- SHA512 318e0dd5d2c52705750b959191e42b1e38e4cff8125375ee39e78d70d2accaa60addbc597babee42ec843a8bc21bebad639f9461550bb49e319f133828894053
- SSDEEP 96:n5k3VAwjtk/6eTwSv0MoiVmdHIUJB8d0WQyV+VpziX3wI3:n5k3Bjtk5Tv0MAIyB8dLx93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 6d1f2e4e5b2db1764a9d5962e05c769ef51c2adaab05d0b9509e728f2b25a0a2
- MD5 26c1a935541062feea88c0b345ee9f49
- SHA1 337918c67d613fa0565686d58344b09a1513c68f
- SHA512 55d0d146fe64a4268de6b915b1fe6cf8c2ff92a9448e06288ed9ef431988a726e7cb9093a5f326db860ba33d17023bf22123f93c000092eaf24408d9167110fe
- SSDEEP 96:n5k3SAwjtk/6eTwSv0MoiVmdHIUJB8d0WQyV+VpAiX3wI3:n5k3Ojtk5Tv0MAIyB8dLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ffc01af1c8d20e47cc315323d908b90384bbd3567dc9dedd42508004358cb3dd
- MD5 f23bf46c919c48102bb0ae235ec4c71f
- SHA1 d942869162fad296e71b719402eca02c66940348
- SHA512 8e341de4202ec9f80a526a2f614fb9a452ae414dd298d71bbe4bca7e68783e47fe15e4f62a6243c7142a901f943e529306c00752286bcbfbed6d8a8a5ce2358a
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGeC+9e2RUopRPRDI09f3d5fx+:M9iIxuERzA83h09RZxASGgZlLRDIyThm
- MD5 SHA1 SHA512 SSDEEP