14c41729b87701905a9c472bc84e5a6ebab8990e666c3918bca7cd2f7d892388

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photoshop-crack.html
Size 158KB
Sample240603-kevrwsad89
SHA256 14c41729b87701905a9c472bc84e5a6ebab8990e666c3918bca7cd2f7d892388
MD5 0b8920675955c946b8ec8532ecb57171
SHA1 51c18e374ba3e195d332a34a362bd87e989027f8
SHA512 7bd51f00651283a2dc297752e6c70bbf8d67ed455e307725b6e871b7e01965599506245a06b95e1c5437b664f604820fae2a05deae96f3da3281a01a2a67430a
SSDEEP 3072:VDXOHX9Qur0C+vlB2kkjfOAteL9k/4YWMmmQmwdC:VbVvn4pCQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{0660620F-3B58-4ACF-A9E5-7F8EC83704DE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3272	msedge.exe
3272	msedge.exe
3616	msedge.exe
3616	msedge.exe
2436	identity_helper.exe
2436	identity_helper.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 3372	3272	msedge.exe	82
PID 3272 wrote to memory of 3372	3272	msedge.exe	82
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 464	3272	msedge.exe	83
PID 3272 wrote to memory of 3912	3272	msedge.exe	84
PID 3272 wrote to memory of 3912	3272	msedge.exe	84
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85
PID 3272 wrote to memory of 1168	3272	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\photoshop-crack.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,11341005119135712913,7970768698089827584,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 3f07722839ddc3a21e65d340f90878b218e9d92d66227880b8e9003c732468de
MD5 1f57aa671861fffccd8173ceba62e2af
SHA1 414e82c7fe0673e556e4147372c04c81c8d06cd6
SHA512 e79073afeeb18d3951a01d830a1fbcf5aa9487a58b26534c1f517069dcfb49b62436422d2c6fc1de0777ed5152b83ed49f8959da07520f30fc8b6a51cb4a3bd1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 d31e5e491811da0597f9e4104b66955f8956ac9d3cf2747d6d1cfade9cff4fd9
MD5 bdcc08ce4fa1decdf8f3f38ed3dbf42c
SHA1 6a2fde85e59a611df10731032badccd0bbe8d7c6
SHA512 2038b215d102a344d0a429f776a35e56e8b3f0652f02b7eec3398aa4c9b5d7bd92e688a2ca16e004a24f9cd6ba0253333bed0da0723b1f2727428bc1ff5ea11b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 6b8148b0d6f4d23320d13a4a20db4c96434acf053240b2facb10024bcf1629a0
MD5 287d1c812c88f774927bc76979579e26
SHA1 6dac99d4aad47bebd74c930cc3e7e680be1b5f5d
SHA512 3a5890406b901b57793ed52df65b8636c5193f2b7544ed6a61294daf238a7709ff1b231a3510dab61f70950781e2155ac40b923b63f609827221a0570b40bfaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ec14a7b9cfba68f4932d94d859ff491bb374cca56b9f936d05c3160b8e7a67ea
MD5 42c79a4cab27bc714f7a4a763f04f5b9
SHA1 3f5f46496d7797139d115372c888c327c4dc392d
SHA512 24b890a405cea1ca1a3f9e41accf2ed8c7a3a7cc9f6423b64016ef9c1ee610c59b17c30b40336ec78511104777bfea46afc901deda4bfc314e146989c7edcdf6
SSDEEP 96:n1kxd1dJaZjuwpvWMoiVmdeHvSSwUWQyV+VDCziEwb:n1knbJaZjuGWMXKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b477b2888b3ba3f22268fd29f02ebfd540f1f878594c21d54dcd9947d92a1e76
MD5 8b2251cfdf8ac2061247c77cf42c860f
SHA1 849da9b45ade69e437df3a498b610f1e607d635f
SHA512 49c3ec735edc68d4f22aeee092a596624308167c66ba7eb4f8cca653bbb6685913b7c942ea282c099a9465d01cc03769df9e31652c4edd806444df9873836dba
SSDEEP 96:n1kcd1dJaZjuwpvWMoiVmdeHvSSwUWQyV+VDCAiEwb:n1kcbJaZjuGWMXKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f0b4f825238a135f2badc13defb09af6105994b9450a18c0e524b7dac031a9fb
MD5 fc33c74e6269ed7fb95207447e41fefa
SHA1 8fe85d9672c97ea92ffbb856647233ca5f4c2395
SHA512 13e15ea7cf30e8824ff6e7dcda63f47a14a222e5df2cb4e2e6980dc1bcecdf26dd3c839ed91614dba418262bd9dc5db5652017503d728312f7425a9702ee0ff0
SSDEEP 96:n1k1d1dJanjuwpvWMoiVmdeD296XArCX3ch8tD8GLqvSSwUWQyV+VD7AiEwb:n1kbbJanjuGWMy9yArCX3ch8tDZqKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0513643b8f04b07419ee7158b840d462963e51a44b38e17d7a0db2c097780da7
MD5 dbff4e6c8a10bb05c2c7c90fa8fff774
SHA1 81c64378154ab2fd5d8f63612af109a05ba4c90f
SHA512 983cfa46a622b99e09cb75ac4b39704a03db837a4f13976150fb78fe29c487e83d29d3fbf83142bffd7e21ae53e517568dcad2ed228b3e7d9ad8a325e0f1b48d
SSDEEP 96:n1k1d11JanjuwpvWMoiVmdeD296XArCX3ch8tD8GLqvS4wUWQyV+VD7AiEwb:n1kbnJanjuGWMy9yArCX3ch8tDZqgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 94a8842c8501791e3edfefa514bde921f786a1d1fd498aff75e7816d0ad271ec
MD5 2ca4755f1da22b0f9162cfd64ffe6991
SHA1 8a31e166083ec5146109fd6a221bbe1a1c1712a6
SHA512 6ea186383641daffcf3210e622d339e41bf3d98dd17b95096c58008b36e16aa3db2f3ed6e5c3d88f131ae9eaa8437bb5e3c45122948e663794c22cbd90c7f21a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d3ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d3ab.TMP
Size 204B
SHA256 fd9ffa1c9fd613146af6ef3d5b8115af3d51d1fd70493fb3550fbc9f4a411b05
MD5 229e3a525ddbd263a8931303ae0d04d2
SHA1 14a7e1aec6925438fb4113068cbb3c1046dfb565
SHA512 8a135fd499e6acd71de29286c47b26c93e6a450da6ea0b6e644f096abe5b426c472b236aadb677613f46f2af4774384d1499218367413f3bc1f927b43705f876
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 944dc93dea4c2e1194d1acc820be6c1bb9dcd7a3a4185b3a851e60460f86b743
MD5 48bb475527f5f5549d6b0245d96f4957
SHA1 7fc09ea40bb3a239a804fe25e6aa7eb4025f5f36
SHA512 107ea4870ccfaec697f2b8a6560bc127d0b9255307a09cc33018bf178889ef622f5edfe0e238ea15ec5639c46bac0b474bb3f6b2833ee71aa1f755d2a9589290
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMvre2RURRuO3z2OMDCRHq5:A9iIxuERzA83h09RZxYMv7zOaOMWRHq5
MD5 SHA1 SHA512 SSDEEP

Submit Download