Overview

overview

10

Static

static

3

6b6b2fa135...07.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    110s
  • max time network
    113s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250210-en
  • resource tags

    arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-02-2025 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6b6b2fa135738671e1a1f90ddd5fe4f567b1b7d9415ea8ebc32b56f846dca607.exe

  • Size

    6.2MB

  • MD5

    3b8e1edc5b493c9ff10823942054d3bc

  • SHA1

    9b5979457a083498360f2f8c802b31a4710f7bbe

  • SHA256

    6b6b2fa135738671e1a1f90ddd5fe4f567b1b7d9415ea8ebc32b56f846dca607

  • SHA512

    79b0b50fece8ab2a0c55878ca607f98ccbf1fc8c00a97d404c5ac6c20df78af1f7bdba060cd0a856974c4660833d359c5f33399b1a0a3839e3c1555ae04bad2b

  • SSDEEP

    98304:ndfBvDtB9eRVW1fLIfxIeDdgVOGG380vJNdE5zPeTWdAoH:ZBvMiLIZIeqVOGGvKzPeTgAu

Score
10/10
cryptbotdefense_evasiondiscoveryspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx17

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b6b2fa135738671e1a1f90ddd5fe4f567b1b7d9415ea8ebc32b56f846dca607.exe
    "C:\Users\Admin\AppData\Local\Temp\6b6b2fa135738671e1a1f90ddd5fe4f567b1b7d9415ea8ebc32b56f846dca607.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:5752
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4108
  • C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3268
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4148
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5480
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      2⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1536
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      2⤵
        PID:1528
    • C:\Windows\system32\BackgroundTransferHost.exe
      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
      1⤵
      • Modifies registry class
      PID:2132
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=6b6b2fa135738671e1a1f90ddd5fe4f567b1b7d9415ea8ebc32b56f846dca607.exe 6b6b2fa135738671e1a1f90ddd5fe4f567b1b7d9415ea8ebc32b56f846dca607.exe (32 bit)"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5200
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff835693cb8,0x7ff835693cc8,0x7ff835693cd8
        2⤵
          PID:3096
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
          2⤵
            PID:3672
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4564
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
            2⤵
              PID:5128
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
              2⤵
                PID:2164
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                2⤵
                  PID:5996
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
                  2⤵
                    PID:4148
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
                    2⤵
                      PID:4656
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
                      2⤵
                        PID:5228
                      • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
                        2⤵
                          PID:2352
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
                          2⤵
                            PID:3124
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                            2⤵
                              PID:5856
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
                              2⤵
                                PID:1800
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                                2⤵
                                  PID:5676
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
                                  2⤵
                                    PID:352
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
                                    2⤵
                                      PID:5264
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3099933256490129627,5360752748851355225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
                                      2⤵
                                        PID:3228
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:684
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:3840
                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTdBRUUxQjQtODc4Ny00OEVCLTlEODYtMTQ5ODI5RjgwQ0M1fSIgdXNlcmlkPSJ7Njg3RDlBMjMtNEJGRC00ODI5LTg3NEQtMDRGRUY5NUQ2Q0I5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Qjc1M0QwN0YtNUM3Qy00Q0YxLTg2MTctQkY0NDgwOEMyQzU3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczOTE4NDMzNiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NjQ3OTQxMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzNjMwNTA1OTgiLz48L2FwcD48L3JlcXVlc3Q-
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          PID:5132

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                          Filesize

                                          280KB

                                          MD5

                                          d291bd42277228b740e4aa643a564f08

                                          SHA1

                                          76558dae81ba3eea7076ebac174ea8f228ac3671

                                          SHA256

                                          dd043e788c71e49813abc1f8ff5112257ef3dae5298562418a1e0e32259f2e28

                                          SHA512

                                          ced016ef5066c5d7c9ecc1478f0708c71131588b455024e5816f37c6948231ad072c1ff961b37c85f0f00559b11c2289e827e2f172fe4252450f3360f86da9be

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          Filesize

                                          152B

                                          MD5

                                          e6ccdd370d8b96a5ab810745b4732161

                                          SHA1

                                          a5ab499e95cd44dec08f95f9c1cb55ba8207cf76

                                          SHA256

                                          50f583c9aaca6e9d27312793e40a7a8592cd360d0673f0bad9dc96f3da4f0b2a

                                          SHA512

                                          fc2db021d290fa4e63566ac0e6f5f28e44dd8aedfc9b3e3009db898d072674fd5807e472934423c601b5e7da3972a1bd710845eb612eb2486915f1e2627900e4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          Filesize

                                          152B

                                          MD5

                                          cb7fc9b0c2b21e5706641c421c4f5f84

                                          SHA1

                                          b911ef5164b8d968972e026743652dbd37e9d111

                                          SHA256

                                          aff9a8e6cfc7e101c493a18f07a77645b292429ba65e28c964445b0020bc3c96

                                          SHA512

                                          81f3ae6deed2fb35b46eec2a1ffe2fb31a430e91cda046d57b51f6a5a8a3cf757665a7c30e9e341da307ecf2049e44b4b34b6979fa953216295c5043a4f428d4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                          Filesize

                                          936B

                                          MD5

                                          4c3263993a2c61a26cfb0beec0a92b41

                                          SHA1

                                          9dc9688bc6e4e55d2eb7fb7a2c70929a28ce8971

                                          SHA256

                                          0d888e8a61f097e1d78b1c194b4651b4f2be8ac822b3cf5ca8c07c75dea37e9b

                                          SHA512

                                          0f50edc538833d406624a19ae7c639cade6b45dcc2ae06f6fe02569b14dac57050618dfcad1665eb7458013ca0d6e91556d33386ebb5e3a5ee0a2ac637e3ef41

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                          Filesize

                                          111B

                                          MD5

                                          807419ca9a4734feaf8d8563a003b048

                                          SHA1

                                          a723c7d60a65886ffa068711f1e900ccc85922a6

                                          SHA256

                                          aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                          SHA512

                                          f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                          Filesize

                                          471B

                                          MD5

                                          8da293ab43528a7a036ed41dcc209947

                                          SHA1

                                          0b5209f84ce61603f3e370bbe42b287a1ca94ce8

                                          SHA256

                                          ceeea8048657b1cd7a620af1570ae43a08b115354ea2265272ae96925ca56321

                                          SHA512

                                          30f61d55f3cde1d0812a4f267cd3162e3ac115fae9548ef9bf21e8a07f2ae10ab4aaa4d07cd764694d68fe82d6f4535ac5302caa1dc09ac3efbae63d5bab4a0e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          6KB

                                          MD5

                                          1c52def24090c44d5226db76ea5eee97

                                          SHA1

                                          1636fc0683bb25e4a8721c537f750915f6576911

                                          SHA256

                                          d634ad00d4e935ec7eca4bf16ca8d7eaf0b99c0bb8f7b2203f3676f2ba258a96

                                          SHA512

                                          c205e2d5bef98c3e14bc85e6205a4eb3eb66f277ca52f81f4ff8f31b6b3df7af97171c544e5ef36254d5ffbadda373d1424992d5bb7a892bb85391fbf03e122b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          6KB

                                          MD5

                                          3391eeadf18756e6aeb2f856fb503010

                                          SHA1

                                          03c513133fd65d91f77709da6487dcd8548333e6

                                          SHA256

                                          f81d65952f59073270f6b8c573a536facdfd27e0a1f06e67b586e90352e71655

                                          SHA512

                                          e8f1d21484447fc1b88204d2e1cb3d7add8f07b2417b0bcceed3e8a98dfe17c65d4322c63a69f8a7f5bd01a56de0eb0eee33e86d49b0600f154962307adda5f4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          5KB

                                          MD5

                                          ac64ae818da17ead0b889d4fd956a9b7

                                          SHA1

                                          c7929410871fedb12ff1707dfc09d9f2fb535da3

                                          SHA256

                                          12cc7138952f14192bda7dafb5985660d8587f92d34c8e5a9b835a95f24bea87

                                          SHA512

                                          eaf1aad50f511c769bc2dc5c9926dfff57e23baeb8b5f5565fae6eaebadb062bdb254c9b3abe01f320ca9f4e2b871efbcebc11dfaeae472513bff8a2594b4dee

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                          Filesize

                                          534B

                                          MD5

                                          3bc357bfb45fa478b8d86d7ce340e3f6

                                          SHA1

                                          4b086f9194239044c0e32d9550fbe4d019109a5b

                                          SHA256

                                          2a482b4c05bfaab0da8a7caec69d88539d5ae7b240fa40a4a5444f6fc2cc45fa

                                          SHA512

                                          713048e6fcbd978fd6c8f1021b7d025827c9e9167b1f0aaa765b4b4d906385f35bcaa2c28c1cb9221a643f728ae09d31001c685841f368c74bc24372efbb9219

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592512.TMP
                                          Filesize

                                          203B

                                          MD5

                                          9785dff72ea39e5e2c5e8345bb456f4f

                                          SHA1

                                          d4db0523cebe032dddf27795aecb8e46536753a7

                                          SHA256

                                          914724ab45200e874e8acfb4dfb8bc01570451377757aaeec65c52699e9a461d

                                          SHA512

                                          7f0571e49480708625f27bb8605085f241b70a3d2ef25ee815b8da6a7e20b835179efcc434494f74f55413d57e777dce372069cca957811a6d76e34922cfbdb6

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          206702161f94c5cd39fadd03f4014d98

                                          SHA1

                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                          SHA256

                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                          SHA512

                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          11KB

                                          MD5

                                          dea12c93d968f7e5e57e01e4ddfadede

                                          SHA1

                                          cf167c63f825cdf6707b19487d39b7f01eae37c7

                                          SHA256

                                          24360a56defc324b2ce1ea95d7ada8aaada4873897af87abe87c99666aa17a66

                                          SHA512

                                          a4647a08d934ae1bb5b67b94446cf7c8864d101bc62738071a776e5f27dd918582a41236a05a1bfaedb2c31f45f61889b4b971773751f47dbc81ad9ff8ddd14d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          11KB

                                          MD5

                                          13032e279aa2326a4465c4effb94df33

                                          SHA1

                                          fdb6a06d9ceb98deaeeddb352c77a8e90c096d74

                                          SHA256

                                          8012062e90ecb37041790827a8b25526c28d118991c4eff6b0cc994aaeda8ffe

                                          SHA512

                                          92c3e58c2b35b600647fe7714bc19112fbc8596c0afa995a9abdc2868624231b9e22cdc32bd85b13e80711ce9d14b2255d218a7b73deb3243b8e8b6b07dda120

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          11KB

                                          MD5

                                          1edbcf1022888f005729e2b5adabd040

                                          SHA1

                                          1139429f4aecfa9f76782a372836bdfdbd21f099

                                          SHA256

                                          65242f1f564d9cdef2daa39b8f8863528999b7175793542932049c25800d458e

                                          SHA512

                                          6b9faee064f94f6742cceb789cce3ea9dd540e78d686d109a868409e8c13635ba8e17f15e30de25be248d1f6c2c392bf1bea850191962a4a72f2412e26561676

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                          Filesize

                                          28KB

                                          MD5

                                          4c46edecd402b1d278a7cf4a2d2ab0ea

                                          SHA1

                                          fbd3b4d52ccd3d3dd3eb4625e6b999e4abbd3a92

                                          SHA256

                                          0c04d1d0e21365e47747faecf13aa4462237963894bac39836e6f32234605216

                                          SHA512

                                          13478df6adf759218e7136724238e3bff08fd29c23c9491077d2eb2003163c3e468659a2520e444e15e6783eb16966b16aa37e950ec1f0ccda4b08d3b9d18aed

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\ddd5b43c-cacd-4a12-8879-d9fa6edfb171.down_data
                                          Filesize

                                          555KB

                                          MD5

                                          5683c0028832cae4ef93ca39c8ac5029

                                          SHA1

                                          248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                          SHA256

                                          855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                          SHA512

                                          aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                          Download Submit

                                        • memory/1536-28-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-23-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-19-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-24-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-29-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-27-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-17-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-18-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-25-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1536-26-0x00000211613E0000-0x00000211613E1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5752-33-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-35-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-34-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-59-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-32-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-31-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-30-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-86-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-99-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-163-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-15-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-8-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-7-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-6-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-4-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-3-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-217-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-2-0x00000000006A1000-0x0000000000939000-memory.dmp

                                          Filesize

                                          2.6MB

                                          Download

                                        • memory/5752-1-0x0000000077666000-0x0000000077668000-memory.dmp

                                          Filesize

                                          8KB

                                          Download

                                        • memory/5752-0-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download

                                        • memory/5752-350-0x00000000006A0000-0x00000000011EF000-memory.dmp

                                          Filesize

                                          11.3MB

                                          Download