Overview
overview
7Static
static
3485fd9e0fa...18.exe
windows7-x64
7485fd9e0fa...18.exe
windows10-2004-x64
7$PLUGINSDI...IE.exe
windows7-x64
7$PLUGINSDI...IE.exe
windows10-2004-x64
7menu_en.htm
windows7-x64
1menu_en.htm
windows10-2004-x64
1menu_ru.htm
windows7-x64
1menu_ru.htm
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7wit4ie.dll
windows7-x64
6wit4ie.dll
windows10-2004-x64
6witapi.js
windows7-x64
3witapi.js
windows10-2004-x64
3witmain.js
windows7-x64
3witmain.js
windows10-2004-x64
3$PLUGINSDI...s.html
windows7-x64
1$PLUGINSDI...s.html
windows10-2004-x64
1$PLUGINSDI...n.html
windows7-x64
1$PLUGINSDI...n.html
windows10-2004-x64
1$PLUGINSDI...l.html
windows7-x64
1$PLUGINSDI...l.html
windows10-2004-x64
1$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...l.html
windows7-x64
1$PLUGINSDI...l.html
windows10-2004-x64
1$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
1$PLUGINSDI...ss.dll
windows10-2004-x64
1$PLUGINSDI...r.html
windows7-x64
1$PLUGINSDI...r.html
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
15/07/2024, 05:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
485fd9e0fa159847c99fae2d1463a838_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
485fd9e0fa159847c99fae2d1463a838_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ChameleonTomIE.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ChameleonTomIE.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
menu_en.htm
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
menu_en.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
menu_ru.htm
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
menu_ru.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
uninstall.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
wit4ie.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
wit4ie.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
witapi.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
witapi.js
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
witmain.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
witmain.js
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Components.html
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Components.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/Confirmation.html
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/Confirmation.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/Final.html
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/Final.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/Install.html
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/Install.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/Progress.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/Progress.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/Register.html
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/Register.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target $PLUGINSDIR/Confirmation.html
- Size 2KB
- Sample240715-fxzrcaserc
- SHA256 0de9b6c025ad8da5dcda86652f455edcac12737a8975acd770af18ac32c0beea
- MD5 191aceafbad365636cb7643c203626a0
- SHA1 eb6c68d54d6a000106ef98333e70a67095eb0012
- SHA512 4c3b2bda77ab2d52812acd5250b0fbec7f7be756d3e28ccb9e1c401177e682ca1f020de61b3311635829825365db222000555284502f8598332fa48fa5b4fcbe
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1624 msedge.exe 1624 msedge.exe 1888 msedge.exe 1888 msedge.exe 1748 identity_helper.exe 1748 identity_helper.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 4148 1888 msedge.exe 83 PID 1888 wrote to memory of 4148 1888 msedge.exe 83 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 4940 1888 msedge.exe 85 PID 1888 wrote to memory of 1624 1888 msedge.exe 86 PID 1888 wrote to memory of 1624 1888 msedge.exe 86 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87 PID 1888 wrote to memory of 988 1888 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Confirmation.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb034646f8,0x7ffb03464708,0x7ffb034647182⤵PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4486422030416385275,18407147967407031098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1220
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4460
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
- MD5 c00b0d6e0f836dfa596c6df9d3b2f8f2
- SHA1 69ad27d9b4502630728f98917f67307e9dd12a30
- SHA512 0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
- MD5 54f1b76300ce15e44e5cc1a3947f5ca9
- SHA1 c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
- SHA512 ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 55ac0f095e86516b618572d1acc579362f60a4165d7ede8dfbbfab48b85f8c6b
- MD5 08adf15661c5d7a252b19fdafd738b5a
- SHA1 f2bf90b857bae86581e73831cbe3e4d4b500512b
- SHA512 511aa96d82a77193a681f259faa532dcdcb93fc66ec8ee011afcda2e64a58923793a1dc32bf703f0d40ef6d1381b2df5077fe87afe56814e40d56dfd9a8cf193
- SSDEEP 96:nUkBxm/vnmqL+1qsUwpvWMoiVmdeH7cFL5UWQyV+VD7AiEwb:nUk6WU+MsUGWMXgZ5rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 0f1725f66693e4174decb0e6e9cce31469bd37ce8cea35982ee4ab8662cec95e
- MD5 c4245349a1b019620b18cb6f7a4ba56f
- SHA1 6e16d9a17a3271e241effb5219ee60f61db2ceab
- SHA512 bdcb79c66fd883bd50889d38eadc599de20c1250629084a7ae10ecf198de02e22cdfa3d85788efc061481bde26a9e9ed3c257e3daf52a372fc0e42573ac06682
- SSDEEP 96:nUkBxm/vQYmqL+1qEUwpvWMoiVmdeH7cFL5UWQyV+VDCziEwb:nUk6kU+MEUGWMXgZ5ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 b854532caaf414a57d125b5c33b44d7cb4e37aa1985cecfec97c3201ba5aef82
- MD5 bc94180d9024c3da36a1ce61427149fa
- SHA1 a48096a0758f253fefa4dc2d07abf74faf8dfcec
- SHA512 7f769255acf4e8bb41c09481c9f91d00ce24bf70e576155844eff4f17ca41fd3fe55ef355ba7a23babd0c31d6b952b366b549d976fde717d39499155b7f2a707
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkiJe2RU1dFjLgcTzwxAULS:A9iIxuERzA83h09RZxYNdKjEh95Lu
- MD5 SHA1 SHA512 SSDEEP