Overview
overview
7Static
static
3485fd9e0fa...18.exe
windows7-x64
7485fd9e0fa...18.exe
windows10-2004-x64
7$PLUGINSDI...IE.exe
windows7-x64
7$PLUGINSDI...IE.exe
windows10-2004-x64
7menu_en.htm
windows7-x64
1menu_en.htm
windows10-2004-x64
1menu_ru.htm
windows7-x64
1menu_ru.htm
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7wit4ie.dll
windows7-x64
6wit4ie.dll
windows10-2004-x64
6witapi.js
windows7-x64
3witapi.js
windows10-2004-x64
3witmain.js
windows7-x64
3witmain.js
windows10-2004-x64
3$PLUGINSDI...s.html
windows7-x64
1$PLUGINSDI...s.html
windows10-2004-x64
1$PLUGINSDI...n.html
windows7-x64
1$PLUGINSDI...n.html
windows10-2004-x64
1$PLUGINSDI...l.html
windows7-x64
1$PLUGINSDI...l.html
windows10-2004-x64
1$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...l.html
windows7-x64
1$PLUGINSDI...l.html
windows10-2004-x64
1$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
1$PLUGINSDI...ss.dll
windows10-2004-x64
1$PLUGINSDI...r.html
windows7-x64
1$PLUGINSDI...r.html
windows10-2004-x64
1Analysis
- max time kernel
146s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
15/07/2024, 05:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
485fd9e0fa159847c99fae2d1463a838_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
485fd9e0fa159847c99fae2d1463a838_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ChameleonTomIE.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ChameleonTomIE.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
menu_en.htm
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
menu_en.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
menu_ru.htm
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
menu_ru.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
uninstall.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
wit4ie.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
wit4ie.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
witapi.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
witapi.js
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
witmain.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
witmain.js
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Components.html
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Components.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/Confirmation.html
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/Confirmation.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/Final.html
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/Final.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/Install.html
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/Install.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/Progress.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/Progress.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/Register.html
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/Register.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target $PLUGINSDIR/Components.html
- Size 1KB
- Sample240715-fxzrcaserc
- SHA256 02c9a76d1b012a133e4ac5e95a2a29fc1c608c4a7245b4886ce89aa07f2c1797
- MD5 dbe2a173b32bc4132c30a386c8b41237
- SHA1 303bf844136af8866f3c2c0901665b1024d71d53
- SHA512 3398710971eaaa44fbdfdbbcfa1fa96f60e6fb7676d6521f853013be17bdb691f1cae6e933b2aa85378b7d30c5a3a0a34e55bdde9e63ac69c6afbb948f127572
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3888 msedge.exe 3888 msedge.exe 3152 msedge.exe 3152 msedge.exe 5028 identity_helper.exe 5028 identity_helper.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 4312 3152 msedge.exe 83 PID 3152 wrote to memory of 4312 3152 msedge.exe 83 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3548 3152 msedge.exe 84 PID 3152 wrote to memory of 3888 3152 msedge.exe 85 PID 3152 wrote to memory of 3888 3152 msedge.exe 85 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86 PID 3152 wrote to memory of 3356 3152 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Components.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff977db46f8,0x7ff977db4708,0x7ff977db47182⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:3356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:82⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
- MD5 75c9f57baeefeecd6c184627de951c1e
- SHA1 52e0468e13cbfc9f15fc62cc27ce14367a996cff
- SHA512 c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
- MD5 10fa19df148444a77ceec60cabd2ce21
- SHA1 685b599c497668166ede4945d8885d204fd8d70f
- SHA512 3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 227c50cd3da2268f3dc04ec4efcab8e37042f83ff89b4aa1a97082073da34d95
- MD5 8ff7c100e6da1e7f87ea7c877a2a7946
- SHA1 42ae112e032dec96fe0ef773a011443ff4a0e4f3
- SHA512 fb73661744ed14ea1267def26b003556e6c9cd88f260389c00c1ef6dce7f40b46f302920f8fa51aec7496a66f55ee7602a6ade3cd940521919619b31375cb951
- SSDEEP 96:nmk3xm/vQYmqY1njwpvWMoiVmdeHjsFKZychAUWQyV+VDCziEwb:nmkck/djGWMXQxcWro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d0082fc3df50431ad4f295566fec8f1ce7e9e20192efc061fd68cfc6b2f5b858
- MD5 f828d7c11227e48ef11c13252647c652
- SHA1 53922288300505fde31d9e6cde94aa81ba31d417
- SHA512 452dfeee5b224f3165794cc5486eaeb524071c2e9bd2555f00877cea5fbcc137e7ffbe9eacd5117ac44e1616a68ae2c802ae6a7ae3487890f75cb18009c690b4
- SSDEEP 96:nmk3xm/vnmqY1nzwpvWMoiVmdeHjsFKZychAUWQyV+VD7AiEwb:nmkcW/dzGWMXQxcWrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 e4a5665db13911de6195e550a800e4de6035a448d0e6735fc3ecfc92619920e6
- MD5 b4d1deeaac397cee6a0ca71535dc9d58
- SHA1 a7698f0a84f24c71d4a0435daf6a7663c5e30c99
- SHA512 f7c76c73de1d277f80e0a2980cdc4638456072ecb00f09823a35394fd6eba204f0fe109d76f52d6870fd0d36a2548fad880c9b27971dca3bf637341ba6b5b241
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupieET5lXie2RUYH+HLgcTzM:A9iIxuERzA83h09RZxY8laSHEhgH6
- MD5 SHA1 SHA512 SSDEEP