Overview
overview
7Static
static
7CurseForge...er.exe
windows7-x64
4CurseForge...er.exe
windows10-2004-x64
4$PLUGINSDI...p.html
windows7-x64
3$PLUGINSDI...p.html
windows10-2004-x64
3$PLUGINSDI...x.html
windows7-x64
3$PLUGINSDI...x.html
windows10-2004-x64
3$PLUGINSDI...app.js
windows7-x64
3$PLUGINSDI...app.js
windows10-2004-x64
3$PLUGINSDI...uts.js
windows7-x64
3$PLUGINSDI...uts.js
windows10-2004-x64
3$PLUGINSDI...dle.js
windows7-x64
3$PLUGINSDI...dle.js
windows10-2004-x64
3$PLUGINSDI...min.js
windows7-x64
3$PLUGINSDI...min.js
windows10-2004-x64
3$PLUGINSDI...ons.js
windows7-x64
3$PLUGINSDI...ons.js
windows10-2004-x64
3$PLUGINSDI...ics.js
windows7-x64
3$PLUGINSDI...ics.js
windows10-2004-x64
3$PLUGINSDI...nds.js
windows7-x64
3$PLUGINSDI...nds.js
windows10-2004-x64
3$PLUGINSDI...ies.js
windows7-x64
3$PLUGINSDI...ies.js
windows10-2004-x64
3$PLUGINSDI...ate.js
windows7-x64
3$PLUGINSDI...ate.js
windows10-2004-x64
3$PLUGINSDI...der.js
windows7-x64
3$PLUGINSDI...der.js
windows10-2004-x64
3$PLUGINSDI...ils.js
windows7-x64
3$PLUGINSDI...ils.js
windows10-2004-x64
3$PLUGINSDI...ler.js
windows7-x64
3$PLUGINSDI...ler.js
windows10-2004-x64
3$PLUGINSDI...ate.js
windows7-x64
3$PLUGINSDI...ate.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 18:06
Behavioral task
behavioral1
Sample
CurseForge Windows - Installer.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
CurseForge Windows - Installer.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app/cmp.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app/cmp.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/app/index.html
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app/index.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app/js/app.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app/js/app.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/app/js/windows/cri/template.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/app/js/windows/cri/template.js
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target $PLUGINSDIR/app/cmp.html
- Size 5KB
- Sample241109-wp3e9sskfr
- SHA256 6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
- MD5 d7b8b31b190e552677589cfd4cbb5d8e
- SHA1 09ffb3c63991d5c932c819393de489268bd3ab88
- SHA512 32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
- SSDEEP 48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1680 msedge.exe 1680 msedge.exe 5020 msedge.exe 5020 msedge.exe 3084 identity_helper.exe 3084 identity_helper.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 844 5020 msedge.exe 84 PID 5020 wrote to memory of 844 5020 msedge.exe 84 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1688 5020 msedge.exe 85 PID 5020 wrote to memory of 1680 5020 msedge.exe 86 PID 5020 wrote to memory of 1680 5020 msedge.exe 86 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88 PID 5020 wrote to memory of 208 5020 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87ae946f8,0x7ff87ae94708,0x7ff87ae947182⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:82⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:3280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12139931740965018717,14985489165808024384,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2836
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
- MD5 6960857d16aadfa79d36df8ebbf0e423
- SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
- SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
- MD5 f426165d1e5f7df1b7a3758c306cd4ae
- SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
- SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 309B
- SHA256 44d553d212b23666857a461868e0fe46bb89043f22e974f4b28be78fdbba8d2f
- MD5 39694d44a4bf11909ca0021ccfe77f87
- SHA1 350c6f4c049725bf76586a3883adc4d82a546a68
- SHA512 debd4823910f2f5395e464a4a3344cd921318e4f4007ab361fabf346c7111f878af13f1c2332b85ada5b3c6b1d29ab7c5caaf1fa978c4ea95b5b2e074216420b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 98786b683490c3ba7b4c0b040701b278c4b032fe13a4bb07c518c3f9ff2eeeef
- MD5 21fcb66bb726c34e4c81474dd4eb499c
- SHA1 29de2f77b66365fa9c2594b2a448b20aa97d578b
- SHA512 0b379d44894a15d80a967690d6735b42ca4ef66574169156149b77735b0d6acc012fd9672910906c6d77d6b1645fdd76977d39dd5451f140015059ba537ee059
- SSDEEP 96:nbFkiry1Cwp1SnwpvWMoiVmdeHdwENTx+UWQyV+VDCziEwb:n5kNgw7aGWMXV+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 edb38efe90e425b0de38327db81da8a9b048f5a7397de6f67a2865bccc6938ab
- MD5 6ccee231dc71a039d8b91a97e4853403
- SHA1 ca3df8cf14118a26fde1479f908e017055b250f2
- SHA512 78f79228269863d6d5f494e2da1b0fc2c8a7587a1be2709266c4f50068eb4af775bf6254b4557df5fc457282497f0bc2dd7559fea0023a8b1a29566078757fbc
- SSDEEP 96:nbFkMry1Cwp1SnwpvWMoiVmdeHdwENTx+UWQyV+VD7AiEwb:n5kDgw7aGWMXV+rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 bf3f31447a0a2e5730c75dfc63a8583d6c719fc10b6b784f0de83819bafdb2a2
- MD5 c1450dfeaf9d7aa76064c85934edecc7
- SHA1 f681fff1f1d3cc7ce71012609ebaccc18ff6bbe3
- SHA512 0815023e26ecddc375d73076aeb6f8250f80e4578ba597e45e026f4275d9ffd9dc40d87d3b8426962b15f23511af052c96459e0edf1c50b912a5f52c89b2679e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupr2rXqe2RU/RHEHqRUx3GP9:A9iIxuERzA83h09RZxY0UU3SFGmx8otu
- MD5 SHA1 SHA512 SSDEEP