Overview
overview
6Static
static
3Microsoft....re.dll
windows7-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....ms.dll
windows7-x64
1Microsoft....ms.dll
windows10-2004-x64
1Microsoft....pf.dll
windows7-x64
1Microsoft....pf.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Zorara.dll
windows7-x64
5Zorara.dll
windows10-2004-x64
5ZoraraUI.exe
windows7-x64
1ZoraraUI.exe
windows10-2004-x64
1ZoraraUI.exe
windows7-x64
1ZoraraUI.exe
windows10-2004-x64
1bin/Monaco/index.html
windows7-x64
6bin/Monaco/index.html
windows10-2004-x64
6bin/Monaco...ain.js
windows7-x64
3bin/Monaco...ain.js
windows10-2004-x64
3bin/Monaco...lua.js
windows7-x64
3bin/Monaco...lua.js
windows10-2004-x64
3bin/Monaco...ain.js
windows7-x64
3bin/Monaco...ain.js
windows10-2004-x64
3bin/Monaco....de.js
windows7-x64
3bin/Monaco....de.js
windows10-2004-x64
3bin/Monaco....es.js
windows7-x64
3bin/Monaco....es.js
windows10-2004-x64
3bin/Monaco....fr.js
windows7-x64
3bin/Monaco....fr.js
windows10-2004-x64
3bin/Monaco....it.js
windows7-x64
3bin/Monaco....it.js
windows10-2004-x64
3bin/Monaco....ja.js
windows7-x64
3bin/Monaco....ja.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
29/09/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Zorara.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Zorara.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ZoraraUI.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
ZoraraUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ZoraraUI.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
ZoraraUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
bin/Monaco/index.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
bin/Monaco/index.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
bin/Monaco/vs/editor/editor.main.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
bin/Monaco/vs/editor/editor.main.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target bin/Monaco/index.html
- Size 164KB
- Sample240929-srfshazapq
- SHA256 c15e5a7383a6129debd84cc8929e16586421283554c0c7c908f831b56f028540
- MD5 107a853040c82ea8c2ccc088d5412f34
- SHA1 575e2b1ef9a62420c75ff28efd4a72b81d54fad1
- SHA512 1b002abe0316150e214b0303670588fc5a4fa49a3e7b79d64f3ff39466a861136289e8e90bc2eaf794ef9bc225657a2360d48dafeb1677087c440f1c1c162c26
- SSDEEP 3072:gKl34J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7p/:d4J09BA3pZaFD48VOAGUWYPjdlLJbRBT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 12 raw.githubusercontent.com 13 raw.githubusercontent.com - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3616 msedge.exe 3616 msedge.exe 2916 msedge.exe 2916 msedge.exe 892 identity_helper.exe 892 identity_helper.exe 4128 msedge.exe 4128 msedge.exe 4128 msedge.exe 4128 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 4584 2916 msedge.exe 81 PID 2916 wrote to memory of 4584 2916 msedge.exe 81 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3472 2916 msedge.exe 82 PID 2916 wrote to memory of 3616 2916 msedge.exe 83 PID 2916 wrote to memory of 3616 2916 msedge.exe 83 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84 PID 2916 wrote to memory of 1276 2916 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bin\Monaco\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd45c46f8,0x7ffbd45c4708,0x7ffbd45c47182⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:82⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3363281912736858940,10972843411549458966,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4128
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
- MD5 ecf7ca53c80b5245e35839009d12f866
- SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
- SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
- MD5 4dd2754d1bea40445984d65abee82b21
- SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
- SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 193B
- SHA256 ee0d15dce841e092ad1a2d4346a612410f8f950fdb019bc7b768f6346f2b5248
- MD5 62fc8758c85fb0d08cd24eeddafeda2c
- SHA1 320fc202790b0ca6f65ff67e9397440c7d97eb20
- SHA512 ca97e615bdcac137a936c10104a702e1529ed3470828f2c3a2f783345ebbef04cac8c051df636c714151671efea53a9b8912b6b0d0b5eafdac5fae1dfdc8f85d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 4a4c1f4e3fb07d0653f6f9de445332a892a796188dfbb0526301189b5b4f2d1a
- MD5 63855567fd589b51a7094e16061a77b6
- SHA1 4c2eb5118e4c5c78155bbf713d7f67119aa0934a
- SHA512 2171101fa3c7e1cffb8168d999e2643efbf72d3db3aca33c9611c90560e3274b9aab9b00804875bc0a48c82209382fc0e8f80f7421c7f7c04d705b288f42dc5a
- SSDEEP 96:nsHk/28o1dpfTNwpvWMoiVmdeH44YADMu+UWQyV+VDCziEwb:ngk/ENRGWMX46+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ddeb11dd73ee977864ed4d3cc0aa13da0db43614cc653b40c214d2f7cfdf407e
- MD5 1f19529af862fbc46096a769ec55842a
- SHA1 439d2dc470ecf915237e73aa413e3457030af8eb
- SHA512 fff89dbf1daf29689e09131b1a70b7e217a25976de8c05030cf4ec5bbefa1abf148bb1bf822dbc0c4edb9a407cd624f5f78205cc12c12cc03e3a5b8d02b26fd4
- SSDEEP 96:nsHk/o8o1dpfTNwpvWMoiVmdeH44YADMu+UWQyV+VD7AiEwb:ngk/mNRGWMX46+rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 0cf8dee93f31c3addad5d209fe4122d1e5dea499383ad9dc6e9df86662775a2d
- MD5 ee92724bbb36839144aefdb0bb8feaf6
- SHA1 dbd12af16310106156fae10b3dd8872fbf7fc9a4
- SHA512 eeca116fb5dce3486cff8fe5037986182b2e32b4456038e968ef0c200299a780dfefca5d007cc213568d6e3001dc2119d10583230d8a034447d25b014e0f587f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbe2RUBiOkNIcM/bo5Zxc:A9iIxuERzA83h09RZxYLNuqZxc
- MD5 SHA1 SHA512 SSDEEP