Overview
overview
7Static
static
3a804ece5d5...18.exe
windows7-x64
7a804ece5d5...18.exe
windows10-2004-x64
7$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3CompleteScreen.html
windows7-x64
1CompleteScreen.html
windows10-2004-x64
1InstallScreen.html
windows7-x64
1InstallScreen.html
windows10-2004-x64
1InstallPrompt.html
windows7-x64
1InstallPrompt.html
windows10-2004-x64
1InstallScreen.html
windows7-x64
1InstallScreen.html
windows10-2004-x64
1WelcomeScreen.html
windows7-x64
1WelcomeScreen.html
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ks.exe
windows7-x64
7$PLUGINSDI...ks.exe
windows10-2004-x64
7$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...g.html
windows7-x64
1$PLUGINSDI...g.html
windows10-2004-x64
1$PLUGINSDI...ib.dll
windows7-x64
3$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
CompleteScreen.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
CompleteScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
InstallScreen.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
InstallScreen.html
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
InstallPrompt.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
InstallPrompt.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
InstallScreen.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
InstallScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
WelcomeScreen.html
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
WelcomeScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/balrocks.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/balrocks.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/loading.html
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/loading.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/manlib.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/manlib.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target InstallScreen.html
- Size 9KB
- Sample240614-e7sv4sygrp
- SHA256 4d86b36c86907b34e7631f2ea28c6306a851604caa4deed99409f616a11c44ae
- MD5 eeae93190e02e53c256d99c34947c498
- SHA1 3ce43fbf28a287159762294430cf3c6a01fb7071
- SHA512 9d43190765d5ad20399f6cc6f4dbfdadfcba39b6e32ecbf3c329520a72377729859641588d83e5904c43e737d773486f502bf6c3932cd11f553e0b9d1c1207c0
- SSDEEP 192:SI1yaybwZ6QodpdCYv71QX2Bmfi9ikkiniNizowQiwQj4It:SI11yb5hl1u2Bmfi9iviniNizd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3996 msedge.exe 3996 msedge.exe 3892 msedge.exe 3892 msedge.exe 3596 identity_helper.exe 3596 identity_helper.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3892 wrote to memory of 2164 3892 msedge.exe 82 PID 3892 wrote to memory of 2164 3892 msedge.exe 82 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 4588 3892 msedge.exe 83 PID 3892 wrote to memory of 3996 3892 msedge.exe 84 PID 3892 wrote to memory of 3996 3892 msedge.exe 84 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85 PID 3892 wrote to memory of 1456 3892 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\InstallScreen.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9095c46f8,0x7ff9095c4708,0x7ff9095c47182⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,17475589673720595214,2694954986652499090,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5684 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2064
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
- MD5 db9081c34e133c32d02f593df88f047a
- SHA1 a0da007c14fd0591091924edc44bee90456700c6
- SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
- MD5 3a09f853479af373691d131247040276
- SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
- SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 2ed71bf3b59a01e2ffc8c5ca93c2fa4e8f561836108d5c4d3e5a4030a7b7487e
- MD5 e161127e9fe29e0cf0833a0db01c7865
- SHA1 6b1adf7a9772bd7ca48ca5bbf50d380d1c5d1fb7
- SHA512 69cefaf7629d5b487ac5c650688007e9fe4297949dc76fb9923cb18545c8abc969ee9ec8a1f68dcc2e15817e8c2dcbaef2908bd0c34fb51f597cc59261fbdbdf
- SSDEEP 96:nHk/oxm/Dnmq/1vK/wpvWMoiVmdeHgiOXUWQyV+VD7AiEwb:nHkB6MVEGWMXOXrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 cb287c209e9b24b81befc4582e7468b8de77cec079cc754872a9e3ec0d28d57d
- MD5 29a7be5710c74013181c2159fe01ecab
- SHA1 8551b0e6473095f10c70efe8f074fef590217760
- SHA512 6b2d646a6b21cd4cd753846d17337c7bd0bf7fc67dacadc4715af4af71a0d919bac9e871ad62d40e52ecfa19f696214465381ad1224bbd7453d4390b4795226d
- SSDEEP 96:nHk/oxm/DQYmq/1vK/wpvWMoiVmdeHgiOXUWQyV+VDCziEwb:nHkBIMVEGWMXOXro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 73787c2f98a41314ee1ad9ae3eea281c10bc662831d9c94d20677fc2021f1059
- MD5 c15e7f1ac8761f1d9400e45f82890955
- SHA1 bc9570bc9a01def11e6e17cafd7fadc20262fafd
- SHA512 23e936e1d33b1880dbef6856f84ffa9b41efd79d042d19d12f181f945afe4d37629053709e0caa8f64afa0f3a5e0fec6c6eaeecd8c37ab1b620fa527a83e4970
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRQe2RUL2kM3z2OMDCRHqlU:A9iIxuERzA83h09RZxYROqMaOMWRHqlU
- MD5 SHA1 SHA512 SSDEEP