Overview
overview
7Static
static
7CraxsRat_V...g.html
windows7-x64
1CraxsRat_V...g.html
windows10-2004-x64
1CraxsRat_V...at.exe
windows7-x64
1CraxsRat_V...at.exe
windows10-2004-x64
1CraxsRat_V...rk.dll
windows7-x64
1CraxsRat_V...rk.dll
windows10-2004-x64
1CraxsRat_V...ys.dll
windows7-x64
1CraxsRat_V...ys.dll
windows10-2004-x64
1CraxsRat_V...64.dll
windows7-x64
1CraxsRat_V...64.dll
windows10-2004-x64
1CraxsRat_V...tm.dll
windows7-x64
1CraxsRat_V...tm.dll
windows10-2004-x64
1CraxsRat_V...PS.dll
windows7-x64
1CraxsRat_V...PS.dll
windows10-2004-x64
1CraxsRat_V...ms.dll
windows7-x64
1CraxsRat_V...ms.dll
windows10-2004-x64
1CraxsRat_V...pf.dll
windows7-x64
1CraxsRat_V...pf.dll
windows10-2004-x64
1CraxsRat_V...ts.dll
windows7-x64
1CraxsRat_V...ts.dll
windows10-2004-x64
1CraxsRat_V...io.dll
windows7-x64
1CraxsRat_V...io.dll
windows10-2004-x64
1CraxsRat_V...on.dll
windows7-x64
1CraxsRat_V...on.dll
windows10-2004-x64
1CraxsRat_V...le.dll
windows7-x64
1CraxsRat_V...le.dll
windows10-2004-x64
1CraxsRat_V...et.dll
windows7-x64
1CraxsRat_V...et.dll
windows10-2004-x64
1CraxsRat_V...7z.dll
windows7-x64
3CraxsRat_V...7z.dll
windows10-2004-x64
3CraxsRat_V...7z.exe
windows7-x64
1CraxsRat_V...7z.exe
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
06/03/2024, 11:58
Behavioral task
behavioral1
Sample
CraxsRat_V6.7/ChangeLog.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
CraxsRat_V6.7/ChangeLog.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
CraxsRat_V6.7/CraxsRat.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
CraxsRat_V6.7/CraxsRat.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
CraxsRat_V6.7/DrakeUI.Framework.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
CraxsRat_V6.7/DrakeUI.Framework.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
CraxsRat_V6.7/GeoIPCitys.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
CraxsRat_V6.7/GeoIPCitys.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
CraxsRat_V6.7/HVMRun64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
CraxsRat_V6.7/HVMRun64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
CraxsRat_V6.7/HVMRuntm.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
CraxsRat_V6.7/HVMRuntm.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
CraxsRat_V6.7/LiveCharts.MAPS.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
CraxsRat_V6.7/LiveCharts.MAPS.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
CraxsRat_V6.7/LiveCharts.WinForms.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
CraxsRat_V6.7/LiveCharts.WinForms.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
CraxsRat_V6.7/LiveCharts.Wpf.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
CraxsRat_V6.7/LiveCharts.Wpf.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
CraxsRat_V6.7/LiveCharts.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
CraxsRat_V6.7/LiveCharts.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
CraxsRat_V6.7/NAudio.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
CraxsRat_V6.7/NAudio.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
CraxsRat_V6.7/Newtonsoft.Json.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
CraxsRat_V6.7/Newtonsoft.Json.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
CraxsRat_V6.7/System.IO.Compression.ZipFile.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
CraxsRat_V6.7/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
CraxsRat_V6.7/WinMM.Net.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
CraxsRat_V6.7/WinMM.Net.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
CraxsRat_V6.7/res/Lib/7z.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
CraxsRat_V6.7/res/Lib/7z.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
CraxsRat_V6.7/res/Lib/7z.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral32
Sample
CraxsRat_V6.7/res/Lib/7z.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target CraxsRat_V6.7/ChangeLog.html
- Size 38KB
- Sample240306-n5dsvabd59
- SHA256 6b7feccc3c61f99c5db7890187c9564be846253a09fee88b599b7d7ec14f9713
- MD5 68be5f2305d89845ae9c4e81e5b493ef
- SHA1 e6467906b143472331b6184ddf6471e3cb698502
- SHA512 e9e38898d379f45b333ee505a93234b772c642edcf2acb3363e920a9bccddb6017407d0f40ddde3671656c058cf2a29436f8bacb1c6e4198746f87f65ef393f0
- SSDEEP 768:aXBgQ5S40stgDDTos12kMhmAmCA2Q/CgjL8gYPCIOO8vP3zMryFF:aeQw40g0Tbe0Ama+Cg/2D7GMm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2480 msedge.exe 2480 msedge.exe 2648 msedge.exe 2648 msedge.exe 2784 identity_helper.exe 2784 identity_helper.exe 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1484 2648 msedge.exe 90 PID 2648 wrote to memory of 1484 2648 msedge.exe 90 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 1716 2648 msedge.exe 91 PID 2648 wrote to memory of 2480 2648 msedge.exe 92 PID 2648 wrote to memory of 2480 2648 msedge.exe 92 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93 PID 2648 wrote to memory of 1428 2648 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\CraxsRat_V6.7\ChangeLog.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e4d546f8,0x7ff8e4d54708,0x7ff8e4d547182⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:82⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:64
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:12⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:12⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11060237203315041018,7522856631004814263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
- MD5 9ffb5f81e8eccd0963c46cbfea1abc20
- SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
- SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
- MD5 e1b45169ebca0dceadb0f45697799d62
- SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
- SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5f14fee4fd30658cb4c838477f37c12c650600823b053d7c1e15787ea669a5ed
- MD5 7cd7ccc5d1abaf4b97746877134b2075
- SHA1 11b031ff44f52175246e17393148e6351336e13a
- SHA512 03109454f7770f689017cec8d69e60d66c79bd8745996bd31f7679a1758326dd0887bcb76c5b6995ee82293dedfe0345d65980964c71a148cb3553a37de7a343
- SSDEEP 96:nikExm/KQYmqFdY1gV2wpvWMoiVmdeHOHTsTFUWQyV+VD7ziEwb:nikdT0i+2GWMXETEFrt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e5686a94a95e353d0de274e36972cbf258b116d9fad17c143cf4d20a5c61d10d
- MD5 76ba25bdbb020d50186d5d309a339567
- SHA1 336f0879d2f9387f0cbe5678d2e0d8a1c23f9d94
- SHA512 ff36089696417872b55ea727f0d687aee95ddd9114d0092be8fe1a37be466ff62ce091efd04df46e6178b88e4ab80ed879c609a6f5c3b6080f79804395ceff2d
- SSDEEP 96:nikExm/KnmqFdY1gV2wpvWMoiVmdeHOHTsTFUWQyV+VD7AiEwb:nikd10i+2GWMXETEFrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 f23282c298764a86551718cdc93bfed14a47b4aed2818012a8ffc0650d24bc60
- MD5 2e9f3fafba521c24e8dae2c464a0f211
- SHA1 0ad241cec5b4144a1b098114337ccbc421395564
- SHA512 09de457e77cf5dc69f6c0d496964102b83f44b20975045129fd3ac62c096441ed297f3715755442b00aba9825977dab615a6d5308f1cfbad416ff5f523c95f54
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBde2RUsybRW9xUX1MPeuu2:A9iIxuERzA83h09RZxYB5OW9E1MeuBOo
- MD5 SHA1 SHA512 SSDEEP