hxxp://crissertaoericardo[.]com[.]br/images/document[.]pif[.]rar

Analysis

max time kernel
209s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-12-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://crissertaoericardo.com.br/images/document.pif.rar

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\document.pif.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
2152	msedge.exe
2152	msedge.exe
1952	msedge.exe
1952	msedge.exe
768	msedge.exe
768	msedge.exe
3044	identity_helper.exe
3044	identity_helper.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
664	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	664	7zFM.exe
Token: 35	664	7zFM.exe
Token: SeRestorePrivilege	3412	7zG.exe
Token: 35	3412	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
768	OpenWith.exe
768	OpenWith.exe
768	OpenWith.exe
768	OpenWith.exe
768	OpenWith.exe
2712	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 344	2152	msedge.exe	77
PID 2152 wrote to memory of 344	2152	msedge.exe	77
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 236	2152	msedge.exe	78
PID 2152 wrote to memory of 3268	2152	msedge.exe	79
PID 2152 wrote to memory of 3268	2152	msedge.exe	79
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80
PID 2152 wrote to memory of 3020	2152	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://crissertaoericardo.com.br/images/document.pif.rar
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca7a33cb8,0x7ffca7a33cc8,0x7ffca7a33cd8
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12414633042881522471,12570246793893635011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2712

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3940

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:664
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap22859:82:7zEvent22016 -ad -saa -- "C:\document.pif.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03898a1ea6a0486c4d36b0e7b1c561a1

SHA1
7a78a78b0f322bfd9c6c3b09efd3b929e1ef6c81

SHA256
b1de62c5fd736819975f63137164060996552b0f9364931cd12db40a4647902c

SHA512
cd9a8f271ac86176b9c4196b153b6f983b4727e5ef7b58929c0f59223e549f7c80b8fb01d03d78ff8a4a1d69e42e3d3e9ffc2f081b59669b95bf459a8d2cb6b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19ba1fe3a5c999048f26fdc1f6baddeb

SHA1
ed887ff5aaba5d6cbd25abd5e2b972d76e5d4975

SHA256
a193304835c58cf96be9e57ae6b8d46b80c44a52b962a3a0178b11a5c07ddbf8

SHA512
ad8c667759db9db5bdc82e0c3e623033acdff71dc2a3e048163bcbfb438d7131d38cc1e1426b501e7107e9d5cbed3d6ac780b796782ac23524cc22720312561f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
842a9d6e02366b280cd14ce53153878f

SHA1
4681a2342d3343510942be9a87d77fca2f4c4fe0

SHA256
f818a87fa3c6cb915226acd46d88efec909f0dffdd72ee1f83e9b1f9b5684f73

SHA512
03963d1cb39f76030710c8b30253fe13201b99f887480e52b3f181fa331fb20e947384014ec997fc6c1a838fe4a4f742bb60e908bdd97331feaaa14203114dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1e720abac4d162b33ceb93085e3e2b1a

SHA1
085145fb47c28c8df9dae475bd52b935c5a8469e

SHA256
cbba9b3d23763c1c0b28a7da9b8258ff1f05ef1c386f421883108735487294bf

SHA512
38f4d5b5cc153b9bec303e1b0e90e5eabd407ffb2f04fe55b5232e437c70d9570dc1f55ea441719a7b490337e22ee4a60d9a8ce45547b693a0d6d2b56d06d8c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27979e01f1cf1abf71762d55446cf272

SHA1
399699737bc57e23cfe374af20ec1f84e2cfbdc0

SHA256
7d7539454435451d63e8d7f2876f6882cd5685f61da0aa2238a2cb245e8eefc2

SHA512
c8e5e4af9f85629e7c8cab6eee092ef73cec7549cdde35486a20bd11771bc220a39d792a45ef9ac7a89dcd09a4dc08a0882ee973730403d273313e39743b65d0

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\3b5ad841-e5c3-46d2-9c0e-14c320b14a9f.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
ad7a569bafd3a938fe348f531b8ef332

SHA1
7fdd2f52d07640047bb62e0f3d3c946ddd85c227

SHA256
f0e06109256d5577e9f62db2c398974c5002bd6d08892f20517760601b705309

SHA512
b762bae338690082d817b3008144926498a1bd2d6d99be33e513c43515808f9a3184bd10254e5c6a1ff90a9211653f066050249030ad9fe0460ec88335b3d423

Download Submit
C:\Users\Admin\Downloads\document.pif.rar

Filesize
723KB

MD5
49dcd676257dfd77ba1e04117e96a2f2

SHA1
688095adcdf3027dd7bb18d199d4e2ccf69273f4

SHA256
8a8a245f4eef787d690c44a40d7da7aa377fb73a83cf07e14d8e0b72aadb99cc

SHA512
7a54a43b647633f043b137b95f3890efc1e32010bb537b1aa6ebdcf8371497fa5e9db10113c57a3474a14d28f80fff956f7818b75e48e928b375c94ea576d7cc

Download Submit
C:\Users\Admin\Downloads\document.pif.rar:Zone.Identifier

Filesize
92B

MD5
b178b25f0d289f6a07ebd839280d7b17

SHA1
6bc49e66091232df65abaff5f319893168de5a7f

SHA256
c718d43eb45beee12ded15a7eb370bdba15116ce2e25334e8d8fbecacc2a656c

SHA512
1e05c495b5314212b5cda28cd4ff5902ca83f45d981ea8644fe1d8ca9cfcc69548061e60e97e73e93d40e4e393a48e563e7d223670c6f11055cfe91bbef7d422

Download Submit