Overview
overview
7Static
static
34e6875dca7...18.exe
windows7-x64
74e6875dca7...18.exe
windows10-2004-x64
7$PLUGINSDI...am.dll
windows7-x64
3$PLUGINSDI...am.dll
windows10-2004-x64
3$PLUGINSDI...08.dll
windows7-x64
3$PLUGINSDI...08.dll
windows10-2004-x64
3$PLUGINSDI...g2.dll
windows7-x64
3$PLUGINSDI...g2.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3DTCommonRes.dll
windows7-x64
3DTCommonRes.dll
windows10-2004-x64
3DTGadget32.dll
windows7-x64
1DTGadget32.dll
windows10-2004-x64
1DTGadget64.dll
windows7-x64
7DTGadget64.dll
windows10-2004-x64
7DTHelper.exe
windows7-x64
1DTHelper.exe
windows10-2004-x64
1gadget.html
windows7-x64
1gadget.html
windows10-2004-x64
1jquery/jquery.min.js
windows7-x64
3jquery/jquery.min.js
windows10-2004-x64
3jquery/new...ons.js
windows7-x64
3jquery/new...ons.js
windows10-2004-x64
3jquery/newgadget.js
windows7-x64
3jquery/newgadget.js
windows10-2004-x64
3message.html
windows7-x64
1message.html
windows10-2004-x64
1Analysis
- max time kernel
145s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
4e6875dca7cd0e0f0adf0b442d154e54_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
4e6875dca7cd0e0f0adf0b442d154e54_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/FILEDownPlug120308.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/FILEDownPlug120308.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/FILEDownPlug2.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/FILEDownPlug2.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
DTCommonRes.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
DTCommonRes.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
DTGadget32.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral18
Sample
DTGadget32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
DTGadget64.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
DTGadget64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
DTHelper.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
DTHelper.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
gadget.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
gadget.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
jquery/jquery.min.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
jquery/jquery.min.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
jquery/newfunctions.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
jquery/newfunctions.js
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
jquery/newgadget.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
jquery/newgadget.js
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
message.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral32
Sample
message.html
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target gadget.html
- Size 733B
- Sample240517-ezzcxshc96
- SHA256 cda12ce5dc43e497a8178af29640c7ce68c9d705cbff4f8dfb1a6ee88b8c3d92
- MD5 4464c90fda3793b1d2a052924f101630
- SHA1 6d345ddbee572c72fafe8a2ae38a58ee964b8141
- SHA512 786c41e4230e7ddd4c205810f4d2563e226fc0a457349be57a1da2c1cf8b3a57d61d1cf4b25a129973864a11fc785263b61158207b7a0776da002e9b161d0af8
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4572 msedge.exe 4572 msedge.exe 3012 msedge.exe 3012 msedge.exe 1200 identity_helper.exe 1200 identity_helper.exe 1868 msedge.exe 1868 msedge.exe 1868 msedge.exe 1868 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 4368 3012 msedge.exe 83 PID 3012 wrote to memory of 4368 3012 msedge.exe 83 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4488 3012 msedge.exe 84 PID 3012 wrote to memory of 4572 3012 msedge.exe 85 PID 3012 wrote to memory of 4572 3012 msedge.exe 85 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86 PID 3012 wrote to memory of 2304 3012 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\gadget.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7ba46f8,0x7ffcb7ba4708,0x7ffcb7ba47182⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:22⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8257829690701874023,492797180920388940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5108
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6a93ecb5a2484371d0016a99cdb917d78fb15c09fb6afec0f41f2b267161872c
- MD5 0cb4f6419758d4c6b3c4f3551bea6e53
- SHA1 6946ade1b25332d08d65b8cb8f2654561694ac9c
- SHA512 dea8feac9c95677f8071412ad56c05e16264334ad28f48ece34de9136a6c4fc56313f3d645a53d29a141e0480c447b700e9517bc8702f92a9aff30100bd949dc
- SSDEEP 96:nV2kmH61vEj0wpvWMoiVmdeHmQIzCUWQyV+VD7AiEwb:nEk261Ej0GWMXCCrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b9d57236b7dd64b7c3c6b13a1beeb1e87faeb4e8dc53e1d9c7f57cbf464294c8
- MD5 ca331b883a3f7040bd204e806f7e9fa1
- SHA1 f9699c589cc6dceedca8011b1a920b57637bf6e4
- SHA512 67863ca66e3a490d308b51867ddeb982c33ddf8eb9e4fa704d9a9b1ff9db390c273e58165f70f00154b68901b66d000b327e193f4fa54834d8d88b8107a166e7
- SSDEEP 96:nV2kPH61vEj0wpvWMoiVmdeHmQIzCUWQyV+VDCziEwb:nEkP61Ej0GWMXCCro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 f8c40065fbae2500d3910af76d9297b76fa9bfd106ea0b55481795a2cc9dbaaf
- MD5 668258c318c79f363b262891b33eb580
- SHA1 44ef28ca459b9b1064fe18e40576a3af35257fae
- SHA512 7c12039de51cda7807669c2eb829c4efd8cb24e613a6fe8006b93cd744c3a27916d342fbeb8e45fa013444063cbebeb5119e388a55f936c135d7835715c84579
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLKte2RUdkIKbd+sJP8B9jV:A9iIxuERzA83h09RZxYmpq24spW9j3XV
- MD5 SHA1 SHA512 SSDEEP