Overview
overview
9Static
static
7a2e2954e48...18.exe
windows7-x64
7a2e2954e48...18.exe
windows10-2004-x64
7$PLUGINSDIR/Aero.dll
windows7-x64
7$PLUGINSDIR/Aero.dll
windows10-2004-x64
7$PLUGINSDI...RL.dll
windows7-x64
3$PLUGINSDI...RL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$SYSDIR/frapsvid.dll
windows7-x64
1$SYSDIR/frapsvid.dll
windows10-2004-x64
1HELP/help_fps.htm
windows7-x64
1HELP/help_fps.htm
windows10-2004-x64
1HELP/help_general.htm
windows7-x64
1HELP/help_general.htm
windows10-2004-x64
1HELP/help_movies.htm
windows7-x64
1HELP/help_movies.htm
windows10-2004-x64
1HELP/help_...ts.htm
windows7-x64
1HELP/help_...ts.htm
windows10-2004-x64
1fraps.exe
windows7-x64
9fraps.exe
windows10-2004-x64
9fraps32.dll
windows7-x64
1fraps32.dll
windows10-2004-x64
1fraps64.exe
windows7-x64
1fraps64.exe
windows10-2004-x64
1fraps64.dll
windows7-x64
1fraps64.dll
windows10-2004-x64
1fraps_ru.exe
windows7-x64
9fraps_ru.exe
windows10-2004-x64
9Analysis
- max time kernel
145s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 23:16
Behavioral task
behavioral1
Sample
a2e2954e48a33e5b1a33bb0cdcf828e1_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral2
Sample
a2e2954e48a33e5b1a33bb0cdcf828e1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Aero.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Aero.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$SYSDIR/frapsvid.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral14
Sample
$SYSDIR/frapsvid.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
HELP/help_fps.htm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
HELP/help_fps.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
HELP/help_general.htm
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral18
Sample
HELP/help_general.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
HELP/help_movies.htm
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
HELP/help_movies.htm
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
HELP/help_screenshots.htm
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral22
Sample
HELP/help_screenshots.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
fraps.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
fraps.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
fraps32.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral26
Sample
fraps32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
fraps64.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral28
Sample
fraps64.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
fraps64.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral30
Sample
fraps64.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
fraps_ru.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral32
Sample
fraps_ru.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target HELP/help_fps.htm
- Size 546B
- Sample240612-29b2psvcjg
- SHA256 b1419a421ea79de26a910c941c72d8eef7f97f42e55c28e8f7df9d31be3a0889
- MD5 f335e9e4e8a45c7dcfc30b5b8b61d838
- SHA1 cbaa325097d7c203d7c875325a79de76f60e4d3e
- SHA512 4f7d27ede6eb61ba7d656d44d1c442e1ac9db016f1278c67afcf6f4674ea3786d1f77f0cef1930f0f07e0db587c11ba79f652916b96b2e1995ed89f27762290b
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4480 msedge.exe 4480 msedge.exe 2984 msedge.exe 2984 msedge.exe 3636 identity_helper.exe 3636 identity_helper.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 4604 2984 msedge.exe 81 PID 2984 wrote to memory of 4604 2984 msedge.exe 81 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4040 2984 msedge.exe 82 PID 2984 wrote to memory of 4480 2984 msedge.exe 83 PID 2984 wrote to memory of 4480 2984 msedge.exe 83 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84 PID 2984 wrote to memory of 3308 2984 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\HELP\help_fps.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8c646f8,0x7ffbf8c64708,0x7ffbf8c647182⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 /prefetch:82⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9050625065701856962,3937245042581797523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c855a4a83d941427499e48d799b9f3ca425c42851879b85feb15811d0f1b95c1
- MD5 a5a68adb852dd80c757467a4e1c0130e
- SHA1 ceb29ba3a52c250392ea3e64faaef1131971ca9c
- SHA512 011ae2ba03763c3ee7179af6c788464b5087b5151e0d0d89abb1b3d1c2c04c45b194edfdd6488d2934ed6028d53f61e776630585dd28cda5d00fc2e2f47cad72
- SSDEEP 96:nMkhN91oBwpvWMoiVmdeHBrzWbUWQyV+VDCziEwb:nMkp6BGWMXEro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 297b62480f179f2d18f50e8e25a6aa7572e448d9fe1238a8eab48e1ae4c8cbc8
- MD5 27617c89a56e2175a0ad1df0c67e66c3
- SHA1 3ea21c0e1ffca202aa7e70f98919c5bd6e214471
- SHA512 43f8e4d42eefa70c05195e476f6c8545b669eeccccc939379a1d7496f451109d05bb72939a1f378f23e23d71a8a3e3f2610aeaf96d81aec56afddaa0816d031f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaH2e2RU21Mj25B:A9iIxuERzA83h09RZxYaHYTuyv
- MD5 SHA1 SHA512 SSDEEP