Overview
overview
7Static
static
31bc877ccda...18.exe
windows7-x64
71bc877ccda...18.exe
windows10-2004-x64
7background.html
windows7-x64
1background.html
windows10-2004-x64
1ci.bg.pack.js
windows7-x64
3ci.bg.pack.js
windows10-2004-x64
3ci.browser.helper.js
windows7-x64
3ci.browser.helper.js
windows10-2004-x64
3ci.content.pack.js
windows7-x64
3ci.content.pack.js
windows10-2004-x64
3content.js
windows7-x64
3content.js
windows10-2004-x64
3jquery-1.9.1.min.js
windows7-x64
3jquery-1.9.1.min.js
windows10-2004-x64
3jquery.uuid.js
windows7-x64
3jquery.uuid.js
windows10-2004-x64
3mz/background.js
windows7-x64
3mz/background.js
windows10-2004-x64
3mz/content.js
windows7-x64
3mz/content.js
windows10-2004-x64
3popup.js
windows7-x64
3popup.js
windows10-2004-x64
3$APPDATA/S...ll.exe
windows7-x64
1$APPDATA/S...ll.exe
windows10-2004-x64
1$PLUGINSDI...nz.dll
windows7-x64
3$PLUGINSDI...nz.dll
windows10-2004-x64
3chrome/con...d.html
windows7-x64
1chrome/con...d.html
windows10-2004-x64
1chrome/con...fig.js
windows7-x64
3chrome/con...fig.js
windows10-2004-x64
3chrome/con...ent.js
windows7-x64
3chrome/con...ent.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
06/05/2024, 09:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1bc877ccdae6e341b8a3ef1e3507be67_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bc877ccdae6e341b8a3ef1e3507be67_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
background.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
background.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
ci.bg.pack.js
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
ci.bg.pack.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
ci.browser.helper.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
ci.browser.helper.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
ci.content.pack.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
ci.content.pack.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
content.js
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
content.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
jquery-1.9.1.min.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
jquery-1.9.1.min.js
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
jquery.uuid.js
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
jquery.uuid.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
mz/background.js
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
mz/background.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
mz/content.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
mz/content.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
popup.js
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
popup.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
$APPDATA/SpecialSavings/chrome_install.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
$APPDATA/SpecialSavings/chrome_install.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
chrome/content/background.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
chrome/content/background.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
chrome/content/config.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
chrome/content/config.js
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
chrome/content/content.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
chrome/content/content.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target chrome/content/background.html
- Size 118B
- Sample240506-k65feaad75
- SHA256 373fafb49216bd341a8517e9836364001240323410a109933eba77c158b4eff3
- MD5 01129decafb3b274f13331448125b482
- SHA1 239bada95abb067b680d079c54b59d22d89cfd90
- SHA512 5b62d19cafd15fe814ff6036debeb43986a16235da77029cd4ab6027651ef608f1715905783e9b4395cd7c8a4588da71652a696ee5b6aaea6895df478598d314
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1644 msedge.exe 1644 msedge.exe 4288 msedge.exe 4288 msedge.exe 4932 identity_helper.exe 4932 identity_helper.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4288 wrote to memory of 1148 4288 msedge.exe 84 PID 4288 wrote to memory of 1148 4288 msedge.exe 84 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 3568 4288 msedge.exe 85 PID 4288 wrote to memory of 1644 4288 msedge.exe 86 PID 4288 wrote to memory of 1644 4288 msedge.exe 86 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87 PID 4288 wrote to memory of 5048 4288 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\chrome\content\background.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d47182⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:12⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,811142900453304499,391135229965960296,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5304 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4844
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
- MD5 4f7152bc5a1a715ef481e37d1c791959
- SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
- SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
- MD5 ea98e583ad99df195d29aa066204ab56
- SHA1 f89398664af0179641aa0138b337097b617cb2db
- SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 0f9214af89b85cb9260dfc3274f0590cfaa659788f6fddaab77c447b6be0ecdf
- MD5 b2bdf3634b7c282ffee7a3a9af2ca21c
- SHA1 973e906f4f7e543a181029e3feb4a825576389b6
- SHA512 73826a21033e5575d9da30ec53db4de754f927e8af5963d1ff32835b6ca8bd2de13018e0fecfa2deb259f6f77a6cbc3b74ba1f399e0aa868c2fc1b3491ec3108
- SSDEEP 96:nnlkYxm/eQYmq3aY1E+33XwpvWMoiVmdeHp1kFZUWQyV+VDCziEwb:nlkZHa7nXGWMXpkZro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 44a04cd4feaf563ba9890237f8a7955b9d1607de5e937d834d3373d1a1157d71
- MD5 5b92bb16c2791518973af6120bfec4fc
- SHA1 80535778d8c228083ad1780c12e807d38be1a071
- SHA512 b614bffa7e4a8c67fc6c479ae562fe04d28370d9a46ac74058b9340b6d886127a5d007775ab6f5dd0f451a81c3ec25744de779ddaf8e1ae0da53d31ada5dd3a0
- SSDEEP 96:nnlkYxm/enmq3aY1E+33XwpvWMoiVmdeHp1kFZUWQyV+VD7AiEwb:nlkZZa7nXGWMXpkZrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 3e3d46f8ebdaf8f5d0ec79ff7f2cd8e1756c13291d8c80cb5971c841caab02cc
- MD5 a1c52b06368c50cb47a27e1fdd545728
- SHA1 456592064be7694089ae7b33f5ec0e57fadc06a0
- SHA512 e5f73f7946a888a6783f40fce0855300188e65b8cc000343699453b29b337288f35309d2d57e6ba0c122a13c8a9a2133b452ea22a4fc703db8e727d16e48241d
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup57Xe2RUT/o5d+OblfBhDaE:A9iIxuERzA83h09RZxY5L6wd/XDafEBb
- MD5 SHA1 SHA512 SSDEEP