Overview
overview
7Static
static
34103f3ac4d...18.exe
windows7-x64
74103f3ac4d...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$WINDIR/Sy...er.dll
windows7-x64
1$WINDIR/Sy...er.dll
windows10-2004-x64
1Cleaner.exe
windows7-x64
1Cleaner.exe
windows10-2004-x64
1Firewall.exe
windows7-x64
1Firewall.exe
windows10-2004-x64
1Resources/...op.htm
windows7-x64
1Resources/...op.htm
windows10-2004-x64
1Resources/...ty.htm
windows7-x64
1Resources/...ty.htm
windows10-2004-x64
1Sweeper.exe
windows7-x64
3Sweeper.exe
windows10-2004-x64
3Uninstaller.exe
windows7-x64
1Uninstaller.exe
windows10-2004-x64
1firewall.sys
windows7-x64
1firewall.sys
windows10-2004-x64
1foxiecoreu.dll
windows7-x64
6foxiecoreu.dll
windows10-2004-x64
6foxietoolbaru.dll
windows7-x64
6foxietoolbaru.dll
windows10-2004-x64
6uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
- max time kernel
145s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
13/07/2024, 08:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4103f3ac4d5bc3546475e3d681665a48_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4103f3ac4d5bc3546475e3d681665a48_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Dialer.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Dialer.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$WINDIR/System32/MP3IFilter.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
$WINDIR/System32/MP3IFilter.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Cleaner.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Cleaner.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Firewall.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
Firewall.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
Resources/HTML/Desktop.htm
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Resources/HTML/Desktop.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
Resources/HTML/Infinity.htm
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Resources/HTML/Infinity.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
Sweeper.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
Sweeper.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
Uninstaller.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
Uninstaller.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
firewall.sys
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
firewall.sys
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
foxiecoreu.dll
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
foxiecoreu.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
foxietoolbaru.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
foxietoolbaru.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
uninst.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral32
Sample
uninst.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Resources/HTML/Desktop.htm
- Size 138B
- Sample240713-kvncravarm
- SHA256 42f8b8de52e44c4f1fa86a833c71c88bb6310f8f82a45c3055cb1016e50b243c
- MD5 a7a47c0a0dce2bec43dae167a5a3798e
- SHA1 31e749363319f8a09267a45e109e7b11f7788b46
- SHA512 b312f1453e36294c42ac59076d83601cb26750d58fdc528cdf0299cc0d80bf7d82b1392deffee3b6f56a1112581c76860deab5d1044cceba91cfb16f534ca657
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2096 msedge.exe 2096 msedge.exe 4488 msedge.exe 4488 msedge.exe 1388 identity_helper.exe 1388 identity_helper.exe 1844 msedge.exe 1844 msedge.exe 1844 msedge.exe 1844 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 1996 4488 msedge.exe 83 PID 4488 wrote to memory of 1996 4488 msedge.exe 83 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 3824 4488 msedge.exe 85 PID 4488 wrote to memory of 2096 4488 msedge.exe 86 PID 4488 wrote to memory of 2096 4488 msedge.exe 86 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87 PID 4488 wrote to memory of 1608 4488 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Resources\HTML\Desktop.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafcdc46f8,0x7ffafcdc4708,0x7ffafcdc47182⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,14489667139613113800,5564192379725878599,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2544 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5100
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
- MD5 bafce9e4c53a0cb85310891b6b21791b
- SHA1 5d70027cc137a7cbb38f5801b15fd97b05e89ee2
- SHA512 c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
- MD5 a499254d6b5d91f97eb7a86e5f8ca573
- SHA1 03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1
- SHA512 d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 80747a5ea5ed792e0336d7cf8e4dace3fe24622f457e6fa6077f7e3d82c98b3e
- MD5 46d6609955f1b118f0d2cc525c852abe
- SHA1 00c473be15008b4fe6f6287c5ea923912f5bc951
- SHA512 9ec244470190847ccc4e674de4a8721dc99bc74a0f3b4b3a63420dcc958d2ca83708191987193a2a99eaa7e184cb270d9b96248ed757fc71a8f69e0300d5c79f
- SSDEEP 96:n5k3xm/vQYmqW1FnALwpvWMoiVmdeHG/o3BUWQyV+VDCziEwb:n5kcktHALGWMXfBro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b7a4379e2094876b67c4379ac4d42d5fb2b3216ff2b4382bd7dab7831448588d
- MD5 a973f9b0585937f97cfea1acfca24b9f
- SHA1 e817bd0c3684a6bbf9488cf03e33483190f30100
- SHA512 a93043c3393dc9ad8aebb94204f2aeb9f69c79b5741e3c7969a880add561ceddc4ec11f45205c0ccc35d11c0f9cc8198487edc605d901fd468d1e3a776e03ed5
- SSDEEP 96:n5k3xm/vnmqW1FnALwpvWMoiVmdeHG/o3BUWQyV+VD7AiEwb:n5kcWtHALGWMXfBrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 f8f82567f2434e578315191d4ef9864d14290af353b05ff3ec0e4cf3137257f4
- MD5 010c338f3395b2259179d77212958c95
- SHA1 fa5a69b8f31ae7a18a959bcc2794cbb514d07a35
- SHA512 a316ac22b5de5daa6a4fbc64683f26868040b69b9620a5c4f2bd48ff7fdcfe564410ee7ef6d98971bd865fa398c84982a32cb2ef919cba2d61b50c5847d246cf
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuppgYQEJe2RUp/XBXLgcTzwO:A9iIxuERzA83h09RZxYb5AxXEhzY9
- MD5 SHA1 SHA512 SSDEEP