Overview
overview
7Static
static
3a804ece5d5...18.exe
windows7-x64
7a804ece5d5...18.exe
windows10-2004-x64
7$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3CompleteScreen.html
windows7-x64
1CompleteScreen.html
windows10-2004-x64
1InstallScreen.html
windows7-x64
1InstallScreen.html
windows10-2004-x64
1InstallPrompt.html
windows7-x64
1InstallPrompt.html
windows10-2004-x64
1InstallScreen.html
windows7-x64
1InstallScreen.html
windows10-2004-x64
1WelcomeScreen.html
windows7-x64
1WelcomeScreen.html
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ks.exe
windows7-x64
7$PLUGINSDI...ks.exe
windows10-2004-x64
7$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...g.html
windows7-x64
1$PLUGINSDI...g.html
windows10-2004-x64
1$PLUGINSDI...ib.dll
windows7-x64
3$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
CompleteScreen.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
CompleteScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
InstallScreen.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
InstallScreen.html
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
InstallPrompt.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
InstallPrompt.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
InstallScreen.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
InstallScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
WelcomeScreen.html
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
WelcomeScreen.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/balrocks.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/balrocks.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/loading.html
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/loading.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/manlib.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/manlib.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target WelcomeScreen.html
- Size 5KB
- Sample240614-e7sv4sygrp
- SHA256 59d23122b2adc2e656145dbccfba45dfca33fc3db9fb9a42fe26a4d02f5901fe
- MD5 1f4bfdf66d6903dbb746134e91f26bef
- SHA1 fce29730b54c9d1c681f09b0b5b0f88bd4d8eb73
- SHA512 3ee71af8a2a54d5b0522d880b0767dd84017f65d667d1bcc2dcffe20eb3d214e002310f5ecaaf6021e3c4a711a887719b921e129cf50bb4b15d5e0950ac03d6a
- SSDEEP 96:SI1lZUYEd43JOdf9oPKjcjtA6jmdjiQXbbbqPK/EltTYW:SI1zLJSfVu/jCj9XbbbqPK/EltTYW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5312 msedge.exe 5312 msedge.exe 1672 msedge.exe 1672 msedge.exe 2464 identity_helper.exe 2464 identity_helper.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2804 1672 msedge.exe 81 PID 1672 wrote to memory of 2804 1672 msedge.exe 81 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 1312 1672 msedge.exe 82 PID 1672 wrote to memory of 5312 1672 msedge.exe 83 PID 1672 wrote to memory of 5312 1672 msedge.exe 83 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84 PID 1672 wrote to memory of 6096 1672 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\WelcomeScreen.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa819846f8,0x7ffa81984708,0x7ffa819847182⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2708 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:6096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:5772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 /prefetch:82⤵PID:5364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:12⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1121013420948647838,7336636488715298453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4908
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 008fafedf9f1788b24b8dcbb1d83988db9c0c31eb182c190ed34a348c554db21
- MD5 a6c51d435988654152beb8922c9ecdec
- SHA1 e3c90b8f741da1dff835a6e718d5b74a72b3e2ed
- SHA512 4dd011ce86c7ccddf41fc8b4e033ca402b6d9987ac9dd2b8301121ad19be713bc063fdaa91ac1f89a691226b1d37ba622c99d2cae3ece5725c8f7bd52333f374
- SSDEEP 96:nSkGw1uoj0wpvWMoiVmdeHmQIjUWQyV+VDCziEwb:nSkr8oj0GWMX8ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a1e5575b10bad7d41a74925df0424070e7430a22c3d456d7cc804dc0ccf5f019
- MD5 2e2c6af6c1a5626b9fc7d0d902c033e9
- SHA1 3d0c5adfa9d4148ba83219bef37f4a1312709f0e
- SHA512 e3bef1b856b064c0bf149157e50a8168b6588a499faf7b95c7ed5ba25b4734804e870b5083cd62e6cbe41c322c2b00018a969c92f750be55c5d56f2ef64610b6
- SSDEEP 96:nSkGw1uYj0wpvWMoiVmdeHmQIjUWQyV+VD7AiEwb:nSkr8Yj0GWMX8rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 6e16c6f1e443151471ec2f6657f274c401df3a01f37e19d3b6d69d7ab11a3232
- MD5 cd284b462b11ada6e55e6611f78b78ce
- SHA1 ebb4f9c9bf50c9ec3ba14b8427dc25a1cdf2dd42
- SHA512 9bd6199fd676eb8504247a50bdb7fb3c0ba99cfe90159bf8dcba699a35086c97642fc9f8cde803aa84a4013bb345e4255a268b6c13c4a43d80ecf463b4fbdc37
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphBe2RUlIKbBN:A9iIxuERzA83h09RZxYhVqBN
- MD5 SHA1 SHA512 SSDEEP