Overview
overview
7Static
static
3485fd9e0fa...18.exe
windows7-x64
7485fd9e0fa...18.exe
windows10-2004-x64
7$PLUGINSDI...IE.exe
windows7-x64
7$PLUGINSDI...IE.exe
windows10-2004-x64
7menu_en.htm
windows7-x64
1menu_en.htm
windows10-2004-x64
1menu_ru.htm
windows7-x64
1menu_ru.htm
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7wit4ie.dll
windows7-x64
6wit4ie.dll
windows10-2004-x64
6witapi.js
windows7-x64
3witapi.js
windows10-2004-x64
3witmain.js
windows7-x64
3witmain.js
windows10-2004-x64
3$PLUGINSDI...s.html
windows7-x64
1$PLUGINSDI...s.html
windows10-2004-x64
1$PLUGINSDI...n.html
windows7-x64
1$PLUGINSDI...n.html
windows10-2004-x64
1$PLUGINSDI...l.html
windows7-x64
1$PLUGINSDI...l.html
windows10-2004-x64
1$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...l.html
windows7-x64
1$PLUGINSDI...l.html
windows10-2004-x64
1$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
1$PLUGINSDI...ss.dll
windows10-2004-x64
1$PLUGINSDI...r.html
windows7-x64
1$PLUGINSDI...r.html
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
15/07/2024, 05:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
485fd9e0fa159847c99fae2d1463a838_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
485fd9e0fa159847c99fae2d1463a838_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ChameleonTomIE.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ChameleonTomIE.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
menu_en.htm
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
menu_en.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
menu_ru.htm
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
menu_ru.htm
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
uninstall.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
wit4ie.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
wit4ie.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
witapi.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
witapi.js
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
witmain.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
witmain.js
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Components.html
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Components.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/Confirmation.html
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/Confirmation.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/Final.html
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/Final.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/Install.html
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/Install.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/Progress.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/Progress.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/Register.html
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/Register.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target $PLUGINSDIR/Register.html
- Size 17KB
- Sample240715-fxzrcaserc
- SHA256 ae58fdd1ee8f76df9096451a6478f859b0d79a0c5a90abe612c6dbab2d249c98
- MD5 9e98a5ed249763fc62459d9137d712ee
- SHA1 0fefb6aa793b98b5e8eab3339dfaea70036e64ed
- SHA512 0875240c0ca0ae108f31f2b9e12ee79d7940596e2660a6022a1a02543388b31bf929bd9f6ec8b15a2ac9f1298bda1353f1dd50a54edc50a567b3082387b26a8e
- SSDEEP 192:zDEyoZbgnNAa6x9Q2vOXQyuv48238xglTWlNr33G+y2SeSpUHCh:6g++2mG48238xkT4rm+ygHE
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4596 msedge.exe 4596 msedge.exe 3244 msedge.exe 3244 msedge.exe 4616 identity_helper.exe 4616 identity_helper.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 1948 3244 msedge.exe 83 PID 3244 wrote to memory of 1948 3244 msedge.exe 83 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4832 3244 msedge.exe 84 PID 3244 wrote to memory of 4596 3244 msedge.exe 85 PID 3244 wrote to memory of 4596 3244 msedge.exe 85 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86 PID 3244 wrote to memory of 4904 3244 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Register.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb0b46f8,0x7ff9eb0b4708,0x7ff9eb0b47182⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4464724807116121206,14370702412897807796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3748
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
- MD5 bafce9e4c53a0cb85310891b6b21791b
- SHA1 5d70027cc137a7cbb38f5801b15fd97b05e89ee2
- SHA512 c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
- MD5 a499254d6b5d91f97eb7a86e5f8ca573
- SHA1 03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1
- SHA512 d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e7efdae000cc5dbbd459e819566f2b48dd1122c29f06cbcf8e41123189d2b0b1
- MD5 9a1909fd5fe3ecc49fc3b635aeb61f5f
- SHA1 9bf50de9cc7af059a286bec4d39288cb3c8d2f36
- SHA512 747821426a5151b513dc6413d1d1bcad7d351a4e4289bddb1b203f43071411c474fa0131df07c01eb0362aeb899df8445d15d4599028c11cef40f2717248e4d5
- SSDEEP 96:nikDxm/vQYmq/1mXALwpvWMoiVmdeHG/oIUWQyV+VDCziEwb:nikwkEIwLGWMXAro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 4654a5aa30a5638cd33de26e853e4ca3a7baff7b2a38e3b73a661f6abe9eb3a8
- MD5 300436632dc280b252ce66b15d99b0c0
- SHA1 62d70c7da4a7bee1507ef65f76c618c534d81127
- SHA512 c20ee9210a4e92573093964603e307ceba65e71b685cb81c1070137cf99aa5ec198adbd39c39e1b83e80302885a850ad381019fe4d94e96644c7e00788e1bc88
- SSDEEP 96:nikDxm/vnmq/1mXALwpvWMoiVmdeHG/oIUWQyV+VD7AiEwb:nikwWEIwLGWMXArg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 3ff483d3c7ba714f4e4310315f84bb77a8665d75d682cbc008755a9c85cdf3d7
- MD5 97ebe268d6f416aec073c8efe1cd9a7c
- SHA1 9d5d6c1db7477bdde055fbd7234f21591e40afc2
- SHA512 9cda2599f1cfd2ee6b615b2fd97ea51d2289f1234bc92c98ff7780a9e3cd814d4f02d5f50d75d86a8c6f2fb60292ea82f82a693fdb550b8a46a96bfd97a6a71b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjYQEDqe2RUB/XBFLgcTzwH:A9iIxuERzA83h09RZxYc04xFEh6M5
- MD5 SHA1 SHA512 SSDEEP