Overview
overview
10Static
static
10SaladBoots...ad.dll
windows7-x64
1SaladBoots...ad.dll
windows10-2004-x64
1SaladBoots...o.html
windows7-x64
3SaladBoots...o.html
windows10-2004-x64
6SaladBoots...ad.dll
windows7-x64
1SaladBoots...ad.dll
windows10-2004-x64
1SaladBoots...ain.js
windows7-x64
3SaladBoots...ain.js
windows10-2004-x64
3SaladBoots...bat.js
windows7-x64
3SaladBoots...bat.js
windows10-2004-x64
3SaladBoots...fee.js
windows7-x64
3SaladBoots...fee.js
windows10-2004-x64
3SaladBoots...cpp.js
windows7-x64
3SaladBoots...cpp.js
windows10-2004-x64
3SaladBoots...arp.js
windows7-x64
3SaladBoots...arp.js
windows10-2004-x64
3SaladBoots...csp.js
windows7-x64
3SaladBoots...csp.js
windows10-2004-x64
3SaladBoots...css.js
windows7-x64
3SaladBoots...css.js
windows10-2004-x64
3SaladBoots...ile.js
windows7-x64
3SaladBoots...ile.js
windows10-2004-x64
3SaladBoots...arp.js
windows7-x64
3SaladBoots...arp.js
windows10-2004-x64
3SaladBoots.../go.js
windows7-x64
3SaladBoots.../go.js
windows10-2004-x64
3SaladBoots...ars.js
windows7-x64
3SaladBoots...ars.js
windows10-2004-x64
3SaladBoots...tml.js
windows7-x64
3SaladBoots...tml.js
windows10-2004-x64
3SaladBoots...ini.js
windows7-x64
3SaladBoots...ini.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2025, 02:03
Behavioral task
behavioral1
Sample
SaladBootstrapper/Salad.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
SaladBootstrapper/Salad.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
SaladBootstrapper/bin/Monaco.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
SaladBootstrapper/bin/Monaco.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SaladBootstrapper/bin/Salad.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
SaladBootstrapper/bin/Salad.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SaladBootstrapper/bin/vs/base/worker/workerMain.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
SaladBootstrapper/bin/vs/base/worker/workerMain.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SaladBootstrapper/bin/vs/basic-languages/bat/bat.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
SaladBootstrapper/bin/vs/basic-languages/bat/bat.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SaladBootstrapper/bin/vs/basic-languages/coffee/coffee.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
SaladBootstrapper/bin/vs/basic-languages/coffee/coffee.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SaladBootstrapper/bin/vs/basic-languages/cpp/cpp.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
SaladBootstrapper/bin/vs/basic-languages/cpp/cpp.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
SaladBootstrapper/bin/vs/basic-languages/csharp/csharp.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
SaladBootstrapper/bin/vs/basic-languages/csharp/csharp.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
SaladBootstrapper/bin/vs/basic-languages/csp/csp.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
SaladBootstrapper/bin/vs/basic-languages/csp/csp.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
SaladBootstrapper/bin/vs/basic-languages/css/css.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
SaladBootstrapper/bin/vs/basic-languages/css/css.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
SaladBootstrapper/bin/vs/basic-languages/dockerfile/dockerfile.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
SaladBootstrapper/bin/vs/basic-languages/dockerfile/dockerfile.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
SaladBootstrapper/bin/vs/basic-languages/fsharp/fsharp.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
SaladBootstrapper/bin/vs/basic-languages/fsharp/fsharp.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
SaladBootstrapper/bin/vs/basic-languages/go/go.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
SaladBootstrapper/bin/vs/basic-languages/go/go.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
SaladBootstrapper/bin/vs/basic-languages/handlebars/handlebars.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
SaladBootstrapper/bin/vs/basic-languages/handlebars/handlebars.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
SaladBootstrapper/bin/vs/basic-languages/html/html.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
SaladBootstrapper/bin/vs/basic-languages/html/html.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
SaladBootstrapper/bin/vs/basic-languages/ini/ini.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
SaladBootstrapper/bin/vs/basic-languages/ini/ini.js
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target SaladBootstrapper/bin/Monaco.html
- Size 70KB
- Sample250116-cgymkawkhs
- SHA256 99c6272931dab083bf7bed7766c8b2f482b90ce91640881fc3c25e628b99de48
- MD5 0c89c5f7d91bab9c7061c348010e5060
- SHA1 1c62133f565001f9bbb1278aaf7476450585a47d
- SHA512 07bbe66911cd03feaf7942e0815d6bd340b6413985c5de3a9d9883932cf1031d116671e86676495fd1a8d718013f0f4196e6ed3e86db2ed5d857d2ae7a8b347d
- SSDEEP 1536:AwmVPlSG/xJ4RyTbNfBf8XT/p/gmFwZhQVsWTVW2P2zVDKxgoa7:3mVPlSaJ4RyTbNfBf8XT/p/gmFwHSsWi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 18 raw.githubusercontent.com 16 raw.githubusercontent.com - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3060 msedge.exe 3060 msedge.exe 4840 msedge.exe 4840 msedge.exe 4900 identity_helper.exe 4900 identity_helper.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe 4840 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 3516 4840 msedge.exe 82 PID 4840 wrote to memory of 3516 4840 msedge.exe 82 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 32 4840 msedge.exe 83 PID 4840 wrote to memory of 3060 4840 msedge.exe 84 PID 4840 wrote to memory of 3060 4840 msedge.exe 84 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85 PID 4840 wrote to memory of 4516 4840 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\SaladBootstrapper\bin\Monaco.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae5c746f8,0x7ffae5c74708,0x7ffae5c747182⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:32
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:3768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,13526384938970616224,2469979902208723788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4288
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
- MD5 8749e21d9d0a17dac32d5aa2027f7a75
- SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
- SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
- MD5 34d2c4f40f47672ecdf6f66fea242f4a
- SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
- SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c661d4f-a900-43f6-84fa-ab9242edca26.tmp
- Size 5KB
- SHA256 54cfd862365e9848591c6b2410db2568f11e02ab904186dfab7e70527aae23da
- MD5 a528b69cf5764ebfae0d4f85bad26f7c
- SHA1 1049b7167e9117d638a30f7d115691c1870f18f3
- SHA512 b77f0be35af59f4a26bafa684cd7488804fca372a29b00ffcf2454d57b428596a7110f2c2a037b80c7b4eaa3091f5684bfcdba02598e0c9951a40eb56c37232b
- SSDEEP 96:nxkTn1lTwpvWMoiVmdeHhOMNoUWQyV+VDCziEwb:nxkTvTGWMXc6oro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 193B
- SHA256 ee0d15dce841e092ad1a2d4346a612410f8f950fdb019bc7b768f6346f2b5248
- MD5 62fc8758c85fb0d08cd24eeddafeda2c
- SHA1 320fc202790b0ca6f65ff67e9397440c7d97eb20
- SHA512 ca97e615bdcac137a936c10104a702e1529ed3470828f2c3a2f783345ebbef04cac8c051df636c714151671efea53a9b8912b6b0d0b5eafdac5fae1dfdc8f85d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fab09fea3af99e2348676748fd94f8ca721d11ac6b7a48480d1c64bca1aa8add
- MD5 5c754586572af64a6eb369e85f680973
- SHA1 914ed102ab55863e2a3045dc3143de39e1994804
- SHA512 3e9ae97054e3c0475234fc34d99a77915644c9d1aacaa6c62a067f238310825de65153f7a1b36e20bf15f667ec48a37d435f2a6561fae3f7e9271021166d68df
- SSDEEP 96:nxkzn1lTwpvWMoiVmdeHhOMNoUWQyV+VD7AiEwb:nxkzvTGWMXc6org
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 20c5fbac7ca257fe3cd0ba67352d7b29d89ec0cde6d3144207e2abf311763cbc
- MD5 79cdb4b2c9488cb137e0f225f2c81eab
- SHA1 881707ecb9dfe3bfef23c0001286965a7bb08fdb
- SHA512 d8c3cdf4430e88a559d37419c94869993a460f6ec8a91e25cdc1cae6f263d7d8b7b16e342c8e24df8b796a8ccbb238aebe03586adb5c491aa3c29eeebe5aeaf3
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupIjl18De2RUmIszCAi8wU85:A9iIxuERzA83h09RZxYQodzfiPU8Mu
- MD5 SHA1 SHA512 SSDEEP