Overview
overview
8Static
static
3BetterFold...er.dll
windows10-2004-x64
1CeleryApp.exe
windows10-2004-x64
1CeleryIn.dll
windows10-2004-x64
1CeleryInject.exe
windows10-2004-x64
8Costura.dll
windows10-2004-x64
1Dragablz.dll
windows10-2004-x64
1MaterialDe...rs.dll
windows10-2004-x64
1MaterialDe...ns.dll
windows10-2004-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....ms.dll
windows10-2004-x64
1Microsoft....pf.dll
windows10-2004-x64
1Microsoft....rs.dll
windows10-2004-x64
1System.Dia...ce.dll
windows10-2004-x64
1bin/Monaco/index.html
windows10-2004-x64
3bin/Monaco...ain.js
windows10-2004-x64
3bin/Monaco...tes.js
windows10-2004-x64
3bin/Monaco...ase.js
windows10-2004-x64
3bin/Monaco...ses.js
windows10-2004-x64
3bin/Monaco...del.js
windows10-2004-x64
3bin/Monaco...num.js
windows10-2004-x64
3bin/Monaco...tem.js
windows10-2004-x64
3bin/Monaco...ums.js
windows10-2004-x64
3bin/Monaco...nce.js
windows10-2004-x64
3bin/Monaco...del.js
windows10-2004-x64
3bin/Monaco...nal.js
windows10-2004-x64
3bin/Monaco...der.js
windows10-2004-x64
3bin/Monaco...ace.js
windows10-2004-x64
3bin/Monaco...rnl.js
windows10-2004-x64
3bin/Monaco...ons.js
windows10-2004-x64
3bin/Monaco...als.js
windows10-2004-x64
3bin/Monaco...rds.js
windows10-2004-x64
3bin/Monaco...ing.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
BetterFolderBrowser.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
CeleryApp.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
CeleryIn.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
CeleryInject.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Costura.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Dragablz.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
MaterialDesignColors.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
MaterialDesignExtensions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Microsoft.Xaml.Behaviors.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
bin/Monaco/index.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/base.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Model.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/ServiceProvider.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/functions-krnl.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/functions.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/globals.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/keywords.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/libraries/Drawing.js
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target bin/Monaco/index.html
- Size 13KB
- Sample240809-abhm2swglc
- SHA256 3818906ed429acd27aabad7ec8771893d60658ea31b8d0c92418b96de8ee94e6
- MD5 8132342ce4b039603cbb3b1a32ab859b
- SHA1 66c46050a6e5b08758c00455ae26a6c66e94ce4c
- SHA512 44d93118187e703af1fc1627de7e97c39072e666c9086b1b4c00a7eadce1913c84dc97e8f80e2b514154ef66b23baddbfd71a2faa250735ddf4d2bc12709cef4
- SSDEEP 192:oL3bXRggAbYm/9mv2Oxr09VpDwFgBsK7u24FzTkcmc/VT+9taAc4dReigXN:2RggAbYmbD9V9wFgBs+SFN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3100 msedge.exe 3100 msedge.exe 4248 msedge.exe 4248 msedge.exe 4368 identity_helper.exe 4368 identity_helper.exe 4528 msedge.exe 4528 msedge.exe 4528 msedge.exe 4528 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe 4248 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4248 wrote to memory of 1776 4248 msedge.exe 83 PID 4248 wrote to memory of 1776 4248 msedge.exe 83 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 4900 4248 msedge.exe 85 PID 4248 wrote to memory of 3100 4248 msedge.exe 86 PID 4248 wrote to memory of 3100 4248 msedge.exe 86 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87 PID 4248 wrote to memory of 1952 4248 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bin\Monaco\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e0d346f8,0x7ff8e0d34708,0x7ff8e0d347182⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:82⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:12⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15990212192605302910,11453707338734146477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
- MD5 eeaa8087eba2f63f31e599f6a7b46ef4
- SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
- SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
- MD5 b9569e123772ae290f9bac07e0d31748
- SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
- SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6af6df83cc5cfcd0b6d24b0814e7ddec41bfb2e257128a4c817ec5657b7079c9
- MD5 bcb2bbc2665af0afbc4d02cab4653972
- SHA1 d06222ae0becd83e478627fe69fe62e295fe26a4
- SHA512 d8c759ec68020222b768ed2b35c4870775f3b69da9a3541705a5da2f976c2b4932c15a2f1d73a5dcf94ba81c19f7dc39cb4cc50e8dbe559746f557cc4f4ba644
- SSDEEP 96:n5k/Dxm/L6mqL1Rs1WwpvWMoiVmdeHk8ucUWQyV+VD7AiEwb:n5k/wFwfs1WGWMXAcrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e0c031877c16f988d7924d1eb85a6144504edd71ac06459247c454f60e10cd4f
- MD5 8b45afd13b987c18f01d6ef80b735c4d
- SHA1 8fe4bf9dc02780e3645bb4b6c3a1a3a5e5067239
- SHA512 0a1a7a07cabf219e4fa015e15944447f6b66c8e73e9926dbfe5324fb2ca76834deb8d3ca19f98b92dd0d71e4db67efef9d058e737aed8bf8df1872d6617a5128
- SSDEEP 96:n5k/Dxm/LQYmqL1Rs1WwpvWMoiVmdeHk8ucUWQyV+VDCziEwb:n5k/wAwfs1WGWMXAcro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d3c21dd96071c1c8736fc25f8bff2c5f32fd87a14472e42ebab478f27de0332d
- MD5 90bf9c5e5b83111e1a14104ba92a6bbc
- SHA1 f331e829d6ef963bbff5bfd134f0397fb69a6b71
- SHA512 c3518864956a756f9d3a595a88d5e74e68302fa6bfa762ade6f4afcaaf90d992bdb8156d59b2325c0c67dcfb4ce5e59cbd7a590bacd3f5f638b29adee4bfb169
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJ/e2RU7mDxnTru8z8ZJoat:A9iIxuERzA83h09RZxYlh1TPz8A8D
- MD5 SHA1 SHA512 SSDEEP