Overview
overview
8Static
static
3Winamp592_...us.exe
windows11-21h2-x64
8$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...ch.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...os.dll
windows11-21h2-x64
3$PLUGINSDI...ip.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...mp.dll
windows11-21h2-x64
3$PLUGINSDI...dl.dll
windows11-21h2-x64
3Components/ssdp.dll
windows11-21h2-x64
1Elevator.exe
windows11-21h2-x64
1Microsoft....40.dll
windows11-21h2-x64
3Microsoft....40.dll
windows11-21h2-x64
3Microsoft...._1.dll
windows11-21h2-x64
1Microsoft...._2.dll
windows11-21h2-x64
1Microsoft....it.dll
windows11-21h2-x64
1Microsoft....ds.dll
windows11-21h2-x64
3Microsoft....40.dll
windows11-21h2-x64
3Microsoft....40.dll
windows11-21h2-x64
3Microsoft....90.dll
windows11-21h2-x64
1Microsoft....90.dll
windows11-21h2-x64
1Plugins/AV...er.dll
windows11-21h2-x64
3Plugins/AV...ap.dll
windows11-21h2-x64
3Plugins/AVS/texer.dll
windows11-21h2-x64
3Plugins/AV...r2.dll
windows11-21h2-x64
3Plugins/Fr...pe.dll
windows11-21h2-x64
1Plugins/Mi...op.dll
windows11-21h2-x64
1Plugins/Mi...p.html
windows11-21h2-x64
1Plugins/Mi...g.html
windows11-21h2-x64
1Analysis
- max time kernel
145s - max time network
135s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
19/05/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
Winamp592_10042_final_full_en-us.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/Dialer.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ShellDispatch.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/execDos.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/extstrip.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_winamp.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Components/ssdp.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
Elevator.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
Microsoft.VC142.CRT/concrt140.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
Microsoft.VC142.CRT/msvcp140.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
Microsoft.VC142.CRT/msvcp140_1.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
Microsoft.VC142.CRT/msvcp140_2.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
Microsoft.VC142.CRT/msvcp140_atomic_wait.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
Microsoft.VC142.CRT/msvcp140_codecvt_ids.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
Microsoft.VC142.CRT/vccorlib140.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
Microsoft.VC142.CRT/vcruntime140.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
Microsoft.VC90.CRT/msvcp90.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
Microsoft.VC90.CRT/msvcr90.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
Plugins/AVS/AddBorder.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
Plugins/AVS/colormap.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
Plugins/AVS/texer.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
Plugins/AVS/texer2.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Plugins/Freeform/wacs/freetype/freetype.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
Plugins/Milkdrop2/data/vms_desktop.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
Plugins/Milkdrop2/docs/milkdrop.html
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
Plugins/Milkdrop2/docs/milkdrop_preset_authoring.html
Resource
win11-20240508-en
windows11-21h2-x64
General
- Target Plugins/Milkdrop2/docs/milkdrop.html
- Size 76KB
- Sample240519-srcqvach2z
- SHA256 13f5186a57165cc65c046ebb1a36d64a6c722f595beb1fdd37df5642842467af
- MD5 a7fded8f052ed6ffcc61702ec6a528d0
- SHA1 5a3b0ff72e4f3ac91e04cce22669e1d3e8546984
- SHA512 05cd56e832d13da935f9e705490ae9195f54dfaa01f626d0e77533c20a83015279e7a079040e6515f99098175e908b9ab126443adc3d0e9ff10d0160fedea38c
- SSDEEP 1536:2jg7YupSrU2ZXeI5qIEUPVdn1F6wmFwki:2jrupSrFuMquzn1FdOwV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1560 msedge.exe 1560 msedge.exe 4024 msedge.exe 4024 msedge.exe 5104 identity_helper.exe 5104 identity_helper.exe 4596 msedge.exe 4596 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4024 wrote to memory of 2220 4024 msedge.exe 80 PID 4024 wrote to memory of 2220 4024 msedge.exe 80 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 3640 4024 msedge.exe 82 PID 4024 wrote to memory of 1560 4024 msedge.exe 83 PID 4024 wrote to memory of 1560 4024 msedge.exe 83 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84 PID 4024 wrote to memory of 1312 4024 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Plugins\Milkdrop2\docs\milkdrop.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1cc83cb8,0x7ffe1cc83cc8,0x7ffe1cc83cd82⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3508 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e
- MD5 6876cbd342d4d6b236f44f52c50f780f
- SHA1 a215cf6a499bfb67a3266d211844ec4c82128d83
- SHA512 dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800
- MD5 c1c7e2f451eb3836d23007799bc21d5f
- SHA1 11a25f6055210aa7f99d77346b0d4f1dc123ce79
- SHA512 2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 6137c2d089a40a39b19b2d1d198436e6e7c1f049462e4d07e7cf9ddcb90d4dcf
- MD5 d82503c4ace3c784f875ca3a1a71c420
- SHA1 443e9b01ec222ab9abc41d6414b90b13f589e31b
- SHA512 e8cc4028e3d304a5343e4be70e6bf21373312eaebe1ea3290d546edf7bf7b06782ffa3771844993302b66ba2af7eac6cf86d5f409e2b2044524e2eb6b23b0da4
- SSDEEP 96:nBk30/wy9kyvywSv0MoiVmdHINJms0WQyV+VpziX3wI3:nBk3Ywsky6v0MAIXBLx93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 bf7c27e2371940461d12c463c123093466ba7b296809d2038e43dac775530f1e
- MD5 082091bed864c21ff35e266308dd8e06
- SHA1 e71e156acf8c6b9bdbbd98b70420d304aa1266e0
- SHA512 7b8d4ad4089d782efb7086967900e0882e67668eea4c0f701723faff16ae0eb7ef9d16a6c0c60fb6f9ccdc27ef643deb7483110063e4e7e44bd4ee5e24d2fea6
- SSDEEP 96:nBk3N/wy9kKvywSv0MoiVmdHINJms0WQyV+VpAiX3wI3:nBk3RwskK6v0MAIXBLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 1a720cb96a1841200a177234b50be96b8808e1e2d58d6c89751f63d1b084ed73
- MD5 e21a83c080e38a96d3fef3377bef950f
- SHA1 1bb552d6c04570687f4db1724179ea82106e7dfe
- SHA512 80d57b869c58d7a50f40277d280d7fb13ffabf04e7d63ca54ed783b73b40d67a17fccee0685bdc810577e1a04f8eb3738c54316eb26e7f22219520d576cc3b62
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGrOme2RU3gRyUM2TacHlGzxls:M9iIxuERzA83h09RZxASGyoqvUM0VGzU
- MD5 SHA1 SHA512 SSDEEP