Overview
overview
7Static
static
3a804ece5d5...18.exe
windows7-x64
7a804ece5d5...18.exe
windows10-2004-x64
7$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3CompleteScreen.html
windows7-x64
1CompleteScreen.html
windows10-2004-x64
1InstallScreen.html
windows7-x64
1InstallScreen.html
windows10-2004-x64
1InstallPrompt.html
windows7-x64
1InstallPrompt.html
windows10-2004-x64
1InstallScreen.html
windows7-x64
1InstallScreen.html
windows10-2004-x64
1WelcomeScreen.html
windows7-x64
1WelcomeScreen.html
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ks.exe
windows7-x64
7$PLUGINSDI...ks.exe
windows10-2004-x64
7$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...g.html
windows7-x64
1$PLUGINSDI...g.html
windows10-2004-x64
1$PLUGINSDI...ib.dll
windows7-x64
3$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
CompleteScreen.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
CompleteScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
InstallScreen.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
InstallScreen.html
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
InstallPrompt.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
InstallPrompt.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
InstallScreen.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
InstallScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
WelcomeScreen.html
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
WelcomeScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/balrocks.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/balrocks.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/loading.html
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/loading.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/manlib.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/manlib.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target InstallPrompt.html
- Size 5KB
- Sample240614-e7sv4sygrp
- SHA256 97038d10082353fcc1924004430f36ca8ecd74fe7a67bf4fc6ae3f4c290fac0f
- MD5 6e9714d235aae2e8f7102ea2b89ff74b
- SHA1 0df7a08ada3a5bd082264fd2ade7d8c478aff5cc
- SHA512 9c23660cfd9957b829a70b13191b9486f4636791407cec35040d2c286340a71a316641a7244a1ea9e94c50561ec54396174cb0126fcfc31d1f938d9b4fdd47ad
- SSDEEP 96:SI1lZUYEd43JOdf9oPKjcjtA6jmxj8bbbqPK/EltTYW:SI1zLJSfVu/jIj8bbbqPK/EltTYW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 100 msedge.exe 100 msedge.exe 740 msedge.exe 740 msedge.exe 2704 identity_helper.exe 2704 identity_helper.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe 740 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 740 wrote to memory of 568 740 msedge.exe 82 PID 740 wrote to memory of 568 740 msedge.exe 82 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 508 740 msedge.exe 83 PID 740 wrote to memory of 100 740 msedge.exe 84 PID 740 wrote to memory of 100 740 msedge.exe 84 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85 PID 740 wrote to memory of 456 740 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\InstallPrompt.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb7d346f8,0x7ffdb7d34708,0x7ffdb7d347182⤵PID:568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 /prefetch:82⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:12⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8896002443096281699,16866578112320128712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2700
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 080b6405616ce146ab146f51ac741eab421d18f403a3b21fdf421c9051ea5beb
- MD5 9c1d445f20b503797374dde69702acd2
- SHA1 621bbed89f287935aa0c223cb883a294555a7aea
- SHA512 475d373352a2744341b2cd335e6257dbbd9fd524edcee166adb57ccae25e2c86c6d40b04781021d7d7be10ddedf835febf4e74c0db81ce666d34c073130c5451
- SSDEEP 96:ngkUq15JanjuwpvWMoiVmdeHvSShNIUWQyV+VD7AiEwb:ngk7bJanjuGWMXrNIrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 759cae37ccc73ac961c98fd9d29c7f77b89da74e7c9a3d1d3610d1acd017dcf1
- MD5 a06b5940bb4b4fe66ee2ecdf0d4acdbf
- SHA1 9e8c5fe20d8d422117f839f7f76958af924e85ec
- SHA512 ee24f18c7237f44adfa5379a8a09af33853ff42458ca280966e780bf827ee0bbe9b7fd2758c60a8734166385380a9c86a0fcf68cae38c5f00e1497b08f6cb1fd
- SSDEEP 96:ngkUq15JaZjuwpvWMoiVmdeHvSShNIUWQyV+VDCziEwb:ngk7bJaZjuGWMXrNIro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 7400e92dbe174954e9bbb139ef6d956dce8d88dc58d516f5696a39810e190de2
- MD5 bfcfe489abf7cfeedb499bc75067a007
- SHA1 223176d93c957caaf4676843e2ef2f650d52bad4
- SHA512 46625ff6f9b59a40e4108b2d58600fafc7646468da3450310d91ed62290efc1a07524f0fee434a6098d3db4e9dad380e859855ebdfce6e6a2d14e17b53b9900e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDRe2RUF+4ufxA:A9iIxuERzA83h09RZxYDFFK
- MD5 SHA1 SHA512 SSDEEP