Overview
overview
7Static
static
7daa22c1916...93.exe
windows7-x64
7daa22c1916...93.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...le.exe
windows7-x64
7$PLUGINSDI...le.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3MainInstaller.exe
windows7-x64
7MainInstaller.exe
windows10-2004-x64
7PingMe.exe
windows7-x64
1PingMe.exe
windows10-2004-x64
1Setup.exe
windows7-x64
7Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
7$PLUGINSDI...oc.dll
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
32YourFace_Util.dll
windows7-x64
12YourFace_Util.dll
windows10-2004-x64
3AddInstall.js
windows7-x64
1AddInstall.js
windows10-2004-x64
1background.html
windows7-x64
1background.html
windows10-2004-x64
1Analysis
- max time kernel
158s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
21/03/2024, 03:57
Behavioral task
behavioral1
Sample
daa22c19166975e28e58c7e7c9027b93.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
daa22c19166975e28e58c7e7c9027b93.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240319-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bundle.exe
Resource
win7-20240215-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/bundle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
MainInstaller.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
MainInstaller.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
PingMe.exe
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
PingMe.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Setup.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
2YourFace_Util.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
2YourFace_Util.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
AddInstall.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
AddInstall.js
Resource
win10v2004-20240319-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
background.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
background.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target background.html
- Size 1KB
- Sample240321-ejenksbd37
- SHA256 b14df17e9b5eda2f908d1a50d37bb287d4c7a42f9732d397323685bfce1ca2c3
- MD5 765526318b49b078d35a1a736bb96eb5
- SHA1 6dff92a26b1e1194f32ba3f55765d6f2c705ef29
- SHA512 a948e1be69de00552772d81cecc62cb260e9deaa8821935abb94194a5a4f5f547e47c65dfe2fe156008aaf69064cbb08bf3a874003e31c4cd0a5c580ba1a8e75
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1596 msedge.exe 1596 msedge.exe 1912 msedge.exe 1912 msedge.exe 4576 identity_helper.exe 4576 identity_helper.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 1408 1912 msedge.exe 87 PID 1912 wrote to memory of 1408 1912 msedge.exe 87 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 624 1912 msedge.exe 88 PID 1912 wrote to memory of 1596 1912 msedge.exe 89 PID 1912 wrote to memory of 1596 1912 msedge.exe 89 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90 PID 1912 wrote to memory of 1824 1912 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\background.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe0946f8,0x7ffcfe094708,0x7ffcfe0947182⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:82⤵PID:1824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:12⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:12⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:82⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:12⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:1896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18002063494269816595,17610899598212923144,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
- MD5 36bb45cb1262fcfcab1e3e7960784eaa
- SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
- SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
- MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
- SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
- SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 cbcc9b43eb741377e26a0172ab9f512a3d11225f8969073e13cce38198311706
- MD5 f7369f554a2005ee03149b8a1a4ae14c
- SHA1 4ecac758133bb9931c75b9e05e3d501d1076b3fa
- SHA512 fb6e85e4963cce5005c6cebd0703f0c2c801e1a2a0ed610e801ba3edfc661599de882f708f8782aec1add6c8c7ab11ee8bae61345903e0fa6e26b4b05b95877e
- SSDEEP 96:n6QkFKR1RUZsV8wpvWMoiVmdeHCurQtsUWQyV+VD7ziEwb:n6QkYRkZsV8GWMXlksrt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ce43c711737914ca0209341aa65807b28381ce3aa366cf1cd587df8f767a2d28
- MD5 db2d8f39b3b2f7f5aa3ccea68a06dde5
- SHA1 046015348ba7246af7d5c33909654ea0b32d5c44
- SHA512 30c178d0ff0d8c8b2a027539261dd5cc234b26ed124016f5974e5dc179fa68747f0ae00e36df369f125973487bd0be3b74bb30c24bad21e79bc0d0c859a339b3
- SSDEEP 96:n6QkPKR1RUZsV8wpvWMoiVmdeHCurQtsUWQyV+VD7AiEwb:n6QkyRkZsV8GWMXlksrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 20ead8f8b985a87cddfab0440b79f0766ae15cdcfd01dbe6be397df379023c60
- MD5 2a23ffe2902d9ce31d2a334770dd52d1
- SHA1 6203b79132089c326a4810c9160fbcbe0e536fd4
- SHA512 1047b52266175457baf76d618dac6df0844dccc26e2822d7b6f468868146d9226a9f2ca9de27c0c0b36015f4eef9f90aa445ac05cae84e2dee975f938b830132
- SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTiGe2RUMRR/Nvbqr+3J:29iIxuERzA83h09RZxYTiIpRRV+rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 119cb33763cf65c3c5e1b2c3dbd0b678b0ef3654144f2152f88fc161694f929c
- MD5 50aa9ac77696c849d097790a15637bd9
- SHA1 f8385f0f0bb88fa5d9701e9f691c899a1f6d1959
- SHA512 c33ccd69a133ff3939a8efa69eba585575ffb882c9ee810e453525154128e303ade25d776a6649b5507a7fccde1b0370013cbea89807682987c0440798b330cd
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTiGe2RUMRR/Nvbqrl3J:A9iIxuERzA83h09RZxYTiIpRRV+rz
- MD5 SHA1 SHA512 SSDEEP