Overview
overview
7Static
static
3ArenaWarsSetup.exe
windows7-x64
7ArenaWarsSetup.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3ArenaWars.exe
windows10-2004-x64
1LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...pi.dll
windows7-x64
1resources/...pi.dll
windows10-2004-x64
1resources/...act.js
windows7-x64
3resources/...act.js
windows10-2004-x64
3resources/...e3.dll
windows7-x64
1resources/...e3.dll
windows10-2004-x64
1resources/...ing.js
windows7-x64
3resources/...ing.js
windows10-2004-x64
3resources/...te3.js
windows7-x64
3resources/...te3.js
windows10-2004-x64
3resources/...ace.js
windows7-x64
3resources/...ace.js
windows10-2004-x64
3resources/...kup.js
windows7-x64
3Resubmissions
04/10/2024, 13:28
241004-qqpb5s1akh703/10/2024, 22:49
241003-2rvfbsvbpb701/10/2024, 17:12
241001-vqtdbavcpg710/09/2024, 12:08
240910-pa23maveje710/09/2024, 12:07
240910-pajlaatbrl705/09/2024, 12:10
240905-pcfx6s1eja704/09/2024, 23:57
240904-3zwtssyepr7Analysis
- max time kernel
1681s - max time network
1690s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/10/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
ArenaWarsSetup.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
ArenaWarsSetup.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ArenaWars.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/binding/napi-v6-win32-unknown-x64/node_sqlite3.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/binding/napi-v6-win32-unknown-x64/node_sqlite3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/sqlite3/src/backup.js
Resource
win7-20240903-en
windows7-x64
General
- Target LICENSES.chromium.html
- Size 9.0MB
- Sample241003-2rvfbsvbpb
- SHA256 96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
- MD5 aaea51a605688fcb2f178fd60e4ca64c
- SHA1 69d4791bf3cfedb68bc4d8f766878103578171cb
- SHA512 d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4848 msedge.exe 4848 msedge.exe 1372 msedge.exe 1372 msedge.exe 4992 identity_helper.exe 4992 identity_helper.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1372 wrote to memory of 884 1372 msedge.exe 81 PID 1372 wrote to memory of 884 1372 msedge.exe 81 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4412 1372 msedge.exe 82 PID 1372 wrote to memory of 4848 1372 msedge.exe 83 PID 1372 wrote to memory of 4848 1372 msedge.exe 83 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84 PID 1372 wrote to memory of 3664 1372 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfd1046f8,0x7ffbfd104708,0x7ffbfd1047182⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:82⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:82⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16787049219443913295,15460617635972108683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1448
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
- MD5 eeaa8087eba2f63f31e599f6a7b46ef4
- SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
- SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
- MD5 b9569e123772ae290f9bac07e0d31748
- SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
- SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c9dd60efd4ece906fe498d347639b02972b9386f0a3988c461c385c7f621f1e0
- MD5 170b7fcd161bc79e9d4c6b35f9704c5c
- SHA1 7d9f162905c8ae51f3541d762a98552e720cb1da
- SHA512 abb577aa14b244e78b9f253e7b63bf622638bf8fabd3eeab65b0b13df361aefb5da20f4b1310533c08894dc3de579c69ea9384ebd00c69c08aed6c364a960181
- SSDEEP 96:nMkdzt17OwpvWMoiVmdeHk8NSUWQyV+VDCziEwb:nMkdRVOGWMXGro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 edbf9597ea351d567636613fa8ffe3fe69921635c7ef07f98cff27c600807fdc
- MD5 975c19ccc0e26c14da36de7705b3b5b1
- SHA1 228bfb6f575e0c537d13b5710caaa19065313b4d
- SHA512 e62cf5596864b5a09ef5250fb2217ee9515b10aa4e7d4e64fe107b2f1ebb9e2bc8e8c04cd57e6174a248d1df31349e0cdabed7c3628de19b4599eee7173fa847
- SSDEEP 96:nMkdTt17GwpvWMoiVmdeHk8NSUWQyV+VD7AiEwb:nMkdxVGGWMXGrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 dcb3b52229ce9c24e5c7e374b82ed23836cfb35652499a0083612d8871096afc
- MD5 28d0373395639600c013f823c36fcc91
- SHA1 c039b8acf57c39fd11ff95b9741bb00ae521ae5c
- SHA512 5be943b13c8d9657fc4535d0e51172246b5876b452ea972e656857370de8210270a523cf713613694d98bea1728a5c4aabe60ac7962debc611923a798bfcce8f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupie2RUIxnSUIcM/bo5ZxA:A9iIxuERzA83h09RZxYcDSdqZxA
- MD5 SHA1 SHA512 SSDEEP