Overview
overview
7Static
static
3775dfface0...aa.exe
windows7-x64
7775dfface0...aa.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1lghub.exe
windows7-x64
1lghub.exe
windows10-2004-x64
7libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...pi.dll
windows7-x64
1resources/...pi.dll
windows10-2004-x64
1resources/...ing.js
windows7-x64
3resources/...ing.js
windows10-2004-x64
3resources/...tch.js
windows7-x64
3resources/...tch.js
windows10-2004-x64
3resources/...atform
ubuntu-18.04-amd64
1resources/...atform
debian-9-armhf
1resources/...atform
debian-9-mips
1resources/...atform
debian-9-mipsel
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...tor.js
windows7-x64
3Analysis
- max time kernel
145s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system - submitted
02/02/2025, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
775dfface00c9bac01640dd7b36b01102759389e122c19b3062cecdee45946aa.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
775dfface00c9bac01640dd7b36b01102759389e122c19b3062cecdee45946aa.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
ffmpeg.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
ffmpeg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
lghub.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral13
Sample
lghub.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/classic-level/binding.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/classic-level/binding.js
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/classic-level/chained-batch.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/classic-level/chained-batch.js
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/classic-level/deps/leveldb/leveldb-1.20/build_detect_platform
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/classic-level/deps/leveldb/leveldb-1.20/build_detect_platform
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/classic-level/deps/leveldb/leveldb-1.20/build_detect_platform
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/classic-level/deps/leveldb/leveldb-1.20/build_detect_platform
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/classic-level/index.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/classic-level/index.js
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/classic-level/iterator.js
Resource
win7-20240903-en
windows7-x64
General
- Target LICENSES.chromium.html
- Size 8.7MB
- Sample250202-13vd2askfn
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 112 msedge.exe 112 msedge.exe 4644 msedge.exe 4644 msedge.exe 2588 identity_helper.exe 2588 identity_helper.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4644 wrote to memory of 2624 4644 msedge.exe 84 PID 4644 wrote to memory of 2624 4644 msedge.exe 84 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 4768 4644 msedge.exe 85 PID 4644 wrote to memory of 112 4644 msedge.exe 86 PID 4644 wrote to memory of 112 4644 msedge.exe 86 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87 PID 4644 wrote to memory of 4828 4644 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91a6e46f8,0x7ff91a6e4708,0x7ff91a6e47182⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8876740334098963110,13463885693508866479,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4696
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1ab5a5199a050f7d642f1d2793d42657778c954a3fc31a799cdae6b5439cf725
- MD5 37d04af7fe040412c05f24f2c6cd8f2f
- SHA1 2443f06f4525f3d766514f122857ecc74fc2941a
- SHA512 b3449a38062566d668b5823876a48762e67959723fd1ee37168f58d150269e25300e43342611a72052b956a2602c44ca3ceb452eed1a4ab12b5f752461e32555
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1db95ee6e5eb9737bfb6df17177540cd05454c27f4fd73c916c39f690f749c76
- MD5 4c76084ef5a62345ea5fe42f496230ce
- SHA1 ab677a8684211939ded110b61dcecd68d3e0b606
- SHA512 d0c3578750ae89785645d31a931c598c8dba7035a17b6fb9bcd3ceb76a69c8dcb4b23ecc89ed85be30599382db72d167bf91313ec44b59778247537e14cba66b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 332b392ae8e0752a247c8b6f2600305b9bd4d0c399b71d4ce341171f48ecd137
- MD5 6478b515acce06c872d0577248c37915
- SHA1 973486b0dc57ba4d122e662ad5114cf40ebe538a
- SHA512 42150a3828fecc5836d5bcf72e21ab1bc0da54e16009d114cfcda015baee550fc3013deac682fce1d898e6b18c4be6f691719d529f5a751a9b5ae9097ce2574a
- SSDEEP 96:ncAkAxm/X6mq61sLHwpvWMoiVmdeHtBNUWQyV+VD7AiEwb:ncAkxpBWLHGWMX5rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 7cc0f006d0b8f5857bc4f1fff6198b2b68fe69040b637d2dd0c8d7214b5ed51f
- MD5 8ac088638deb01efd5bd484b92e6c165
- SHA1 83d19affb7713d7d516c65bce1b9087a64069544
- SHA512 d4fdd79df7b9795ac2fedfa11fd5754bde29892baa9756c32e57ec1c2df282ed296e0c15751e1c127d00fbbf70022118bf0fb55a64ca77d4b475004ba4a0f495
- SSDEEP 96:ncAkAxm/XQYmq61sTHwpvWMoiVmdeHtBNUWQyV+VDCziEwb:ncAkxMBWTHGWMX5ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 74d528de86da064adaa8499b20a2255c30a9efed1f5f5fdcfc33b079ec11e0d0
- MD5 afc5c151ea923d4e6cde57af168958ab
- SHA1 9a14fc33eb13a402f69919d601c1c1951d00661e
- SHA512 b03721a48864da0ca327942f89fecf4fd269f3da7375914e374312d361588f29e303e7be8ea81270b3775dd73dcb0749cde9417ab6bb7bd9fd5fc74122739e47
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/8+Ae2RUS2JCIUPfJmpKpd:A9iIxuERzA83h09RZxYY7HPwMp3t
- MD5 SHA1 SHA512 SSDEEP