17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExtraTools.exe
Size

280KB
MD5

0210d88f1a9c5a5a7eff5c44cf4f7fbc
SHA1

83bff855966cf72a2dd85acae7187caeab556abf
SHA256

06c8e0f6fa2616f4fa92c610a1faea23887ac31db8fa78cede49b6b8c80ec22f
SHA512

42445a8d1a3662e16ee1f5129b8792a47c8b17992940e1ba97a96c11d038d0d5088ca00719c6031e204adefbb18672c58113ac5de66b016a63e330b672fde132
SSDEEP

3072:il+Lkqpd5vh6+RDuUZbEl+Lkqpd5vlpcslRnXfFdRIVLdkVz1ZIGWSt8t81U3Uxu:Ppd5vhrDuUZxpd5vbXfNSLdkryGdY

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	ExtraTools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4868	chrst.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExtraTools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
1652	msedge.exe
1652	msedge.exe
1832	identity_helper.exe
1832	identity_helper.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4060	2796	ExtraTools.exe	83
PID 2796 wrote to memory of 4060	2796	ExtraTools.exe	83
PID 4060 wrote to memory of 4300	4060	cmd.exe	86
PID 4060 wrote to memory of 4300	4060	cmd.exe	86
PID 4060 wrote to memory of 4868	4060	cmd.exe	87
PID 4060 wrote to memory of 4868	4060	cmd.exe	87
PID 4060 wrote to memory of 4868	4060	cmd.exe	87
PID 4868 wrote to memory of 1652	4868	chrst.exe	97
PID 4868 wrote to memory of 1652	4868	chrst.exe	97
PID 1652 wrote to memory of 2192	1652	msedge.exe	98
PID 1652 wrote to memory of 2192	1652	msedge.exe	98
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2088	1652	msedge.exe	99
PID 1652 wrote to memory of 2740	1652	msedge.exe	100
PID 1652 wrote to memory of 2740	1652	msedge.exe	100
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101
PID 1652 wrote to memory of 4712	1652	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\ExtraTools.exe
"C:\Users\Admin\AppData\Local\Temp\ExtraTools.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8DE8.tmp\ExtraTools.bat "C:\Users\Admin\AppData\Local\Temp\ExtraTools.exe""
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8DE8.tmp\ErOne.vbs"
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\8DE8.tmp\chrst.exe
    chrst.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=chrst.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd675a46f8,0x7ffd675a4708,0x7ffd675a4718
        5⤵
        
        PID:2192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        5⤵
        
        PID:2088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
        5⤵
        
        PID:4712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        5⤵
        
        PID:1184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
        5⤵
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
        5⤵
        
        PID:844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        
        PID:2788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        5⤵
        
        PID:1176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
        5⤵
        
        PID:2512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
        5⤵
        
        PID:184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        5⤵
        
        PID:1048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6404443149906503273,5979442725708006353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3056 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=chrst.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:4500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd675a46f8,0x7ffd675a4708,0x7ffd675a4718
        5⤵
        
        PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a5d1107ad646b86ad0c78a152a2ece81

SHA1
6f2ca812c647f290ed27d2c96ce734b46754f5ea

SHA256
17cf02578c4501f4caedd3e33584846a01702365a38588193f2ca49650bbdd0a

SHA512
05766921f2361e86a236de8d39fb56b2473dfd8867f046288b4eb0696a1c51fc0810b304fa3efb428abe93ae8eadb44f1af128ee3afbdf7e3aa1e5383f6a3857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7379466647e3765c092f6185c2a87874

SHA1
b0484a18f4b9f04c5716bb590facbb7d323e4f1a

SHA256
7e5d0dfc993a56c57f80deff53e52bd1e5d6e317d6420fe0e049e6d77c5897df

SHA512
200d9b2f9bf27dc969ef3be7cd68aa0d9073036090c8b31297f89b2553765886358d3f00389dcecb559d45bcbc65adc46f44c4eb1b4b2e819e7a4a8e32da68ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5c5d431ab1d75854f1f8e48d9588b00

SHA1
0e6fc95bf5c6a91b86e8eda3126b8318643d8626

SHA256
cf2507ecf83d7a810c9794f579934412c030c12f45816f6a6ddf17e9b05b05d2

SHA512
9d8e77567b785d9f91f316060ffe73f6e0faf7ef45e0234559e944e1d18eb28d5566f4812609743cc4238527de3f8b57aca3b2342777e1b54fbe1395f8d613fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ba8753bd535947a7de592b28172e18b

SHA1
00563b46e74075b78853a5ed0ee089f1a0186b9a

SHA256
04bd1b6698415910dba0a4c3e59e0d56b6011d785f6c33011c902383827c1793

SHA512
609be33c5a12bc6f55f1fcd9269402edaaabbc2f0a23363802969b394408d89523fafd4fc493a6ba8ee745088ca1016e5ff1f0fe5e7ea72531b904a37cbdad0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9d5136804451ca102c1f0a4d4942bec3

SHA1
b5b31fa6119b31c430589e56cacd817df24a636d

SHA256
5f5cd1f2c21356bf89d5ad8858e7038ffdfc0099dda225f58721f9a56dd53cb8

SHA512
7043d3d5310358329274fe0f2974f2243b22f9e485215c3abceafa73c413d95268dd3e9a488df32bc9c807d1486a19fc0e35d497cf2e528010fc617ddc2273fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58029b.TMP

Filesize
371B

MD5
bfab0336c3c8c190e2853b4350b0b88d

SHA1
9299456e262fdc0d2626c29ae3dce4490525323e

SHA256
e6d82746a35a0fd8b56f453e0a04d95c955155cb1c71dd9ecedb34e04dc24e71

SHA512
1514cf7ce819887ceccceb7bb1203ed2dfd8a8e629f4499a295f0ebe814fb2ee34b29bc6d47c44cbf5d9d3ebab83556476d2385581334c390809d65a8d0f2f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8c20e44a3f8d8f5e996a9b6d4cbb77c7

SHA1
fd3c00496bf3b9bdd138bd0bb196cd90ee9d77e3

SHA256
17be443fdfb4688771fd7b453af64b2c0cfedb699858444d98a7f24ebac90f51

SHA512
944349ecefffe87bf15c67c9fa3095a682458847182cb2e0827d18012ffa5189d43464746e70a01d6f10c7cfd1c5066f4bfb811d032cb1d356b6f36e5bf8f4df

Download Submit
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp\ErOne.vbs

Filesize
59B

MD5
a764fe63c6cc48c851f0d2a8ba73c2b7

SHA1
e16351bd38ebcac7e182905767f9b36e078fb5d5

SHA256
8c4d90a5343cea107fad96e842404522aadfc416e7cf84adc58fe2ba72bbc919

SHA512
b0a93898c66c2ff97f9d8cb1f75364a6c4a0ad5cf3158815f94ffb900796065c8e0d384b392d59bf2b01419adb8c65d2dc846ddebaaea971d64c3300edc63571

Download Submit
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp\ExtraTools.bat

Filesize
817B

MD5
8f07fa594d84c6e234b336def0b47cdc

SHA1
34b88980635c3f2367af03caedc01d50b5e4624a

SHA256
dd79d7a80a9087e1fced76ade08394843eab01a8ce263dc2306f46435b451f77

SHA512
c33fd26b5399771f4bf9877d717bb730a8101b9f6bd24847084c50b066db7f6e43d56cbf44792eedc94d117c50a988f5d4a46127a34a2115c50fbb4a67ed2047

Download Submit
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp\chrst.exe

Filesize
130KB

MD5
c657daf595b5d535ccc757ad837eebe8

SHA1
894e953e86e54a830a14fac94e57569d184a9c09

SHA256
a02565ec78fa1221433e720bd57b044938345b8c65a73143bd9ff73529767526

SHA512
21a26bc146dd2a915c17b268b13edc565e9a582d11c1714d89741f4156a880dfe35415d4920a6326d164519f4b28b6371ef9c7bfdb5e19080448bd77b4a20a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp\firefox32.exe

Filesize
62KB

MD5
866604f3adb9207e29505012215f203f

SHA1
718b342c3bc42f3e73c4014c2b105c4d467b0ba6

SHA256
978ed9b9c86653e8f10feb9e7f93eb32f2dadeec42ccce498403e96b7bb3e3c9

SHA512
cdcdd94e2a4c550a819a28085fe543ed944da298da1409ed111380fbde89f6976a4c7d040750307579b007b4551aa86182d453408436bd7aef35423c49b60f79

Download Submit