6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

max time kernel
273s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20251016-de
resource tags

arch:x64arch:x86image:win10v2004-20251016-delocale:de-deos:windows10-2004-x64systemwindows
submitted
22/11/2025, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Malware-1-master/MEMZ-Clean.exe
Size 12KB
Sample251122-vsrmhabm4v
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\Control Panel\International\Geo\Nation	MEMZ-Clean.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1035038232\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Mu\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_80176167\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_200958436\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Mu\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Mu\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Sigma\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Mu\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Sigma\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Sigma\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Sigma\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1035038232\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Sigma\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1035038232\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_80176167\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1746196321\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_200958436\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3992_937831330\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Mu\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Mu\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Sigma\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_80176167\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_200958436\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Clean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "20"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134083055394627928"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Telefon und Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indizierungsoptionen"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Wiederherstellung"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker-Laufwerkverschlüsselung"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Energieoptionen"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Windows-Anmeldeinformationen verwalten"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Bewahren Sie einen Verlauf Ihrer Dateien auf"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "Automatische Wiedergabe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-389786158-2176552546-1679795138-1000\{FD1FF5D7-D7CE-4C3C-9162-F5AE4DA13281}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-389786158-2176552546-1679795138-1000\{12921B02-28A0-4A2E-BDB6-AF3DD286E5F6}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Geräte-Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Internetanzeige- und -verbindungseinstellungen konfigurieren"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programme und Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Ändern der Indizierungsart zur Beschleunigung der Suche"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Synchronisierungscenter"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\main.cpl,-100#immutable1 = "Maus"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\sud.dll,-10#immutable1 = "Wählen Sie die Programme aus, die Windows für Aktivitäten wie Browsen, Bearbeiten von Fotos, Senden von E-Mail oder Musikwiedergabe verwenden soll."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\main.cpl,-102#immutable1 = "Tastatur"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "Zeigt Geräte, Drucker und Druckaufträge an und verwaltet sie."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internetoptionen"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Konfiguriert Wählregeln zum Telefonieren und Modemeinstellungen."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\main.cpl,-101#immutable1 = "Passt Mauseinstellungen, wie z. B. Schaltflächenkonfiguration, Doppelklickgeschwindigkeit, Mauszeiger oder Bewegungsgeschwindigkeit, an."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Wiederherstellung"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Erleichtern Sie die Bedienung des Computers."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "RemoteApp- und Desktopverbindungen verwalten"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Netzwerk- und Freigabecenter"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Sparen Sie Energie oder maximieren Sie die Leistung, indem Sie die Energieverwaltung für den Computer festlegen."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\sud.dll,-1#immutable1 = "Standardprogramme"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Konfigurieren Sie die Funktion der Spracherkennung auf dem Computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Passen Sie die Anzeigeeinstellungen für Sprachen, Zahlen, Währung, Datum und Uhrzeit an."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Deinstallieren oder ändern Sie Programme auf dem Computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Ändern Sie die Standardeinstellungen für CDs, DVDs und Geräte, so dass automatisch Musik wiedergegeben, Bilder angezeigt, Software installiert und Spiele gespielt werden können."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Geräte und Drucker"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Anmeldeinformationsverwaltung"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Ändern Sie Benutzerkontoeinstellungen und Kennwörter für Personen, die diesen Computer gemeinsam nutzen."	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5512	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5512	explorer.exe
Token: SeCreatePagefilePrivilege	5512	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5512	explorer.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5184	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 372	4524	MEMZ-Clean.exe	92
PID 4524 wrote to memory of 372	4524	MEMZ-Clean.exe	92
PID 4524 wrote to memory of 372	4524	MEMZ-Clean.exe	92
PID 4524 wrote to memory of 2880	4524	MEMZ-Clean.exe	97
PID 4524 wrote to memory of 2880	4524	MEMZ-Clean.exe	97
PID 4524 wrote to memory of 2880	4524	MEMZ-Clean.exe	97
PID 4524 wrote to memory of 3992	4524	MEMZ-Clean.exe	99
PID 4524 wrote to memory of 3992	4524	MEMZ-Clean.exe	99
PID 3992 wrote to memory of 3644	3992	msedge.exe	100
PID 3992 wrote to memory of 3644	3992	msedge.exe	100
PID 3992 wrote to memory of 2556	3992	msedge.exe	101
PID 3992 wrote to memory of 2556	3992	msedge.exe	101
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 5268	3992	msedge.exe	102
PID 3992 wrote to memory of 404	3992	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:372
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffdc5e5f208,0x7ffdc5e5f214,0x7ffdc5e5f220
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1856,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2252,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2068,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4896,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3612,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3712,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4932,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5576,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5816,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5816,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6076,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5856,i,18009748925210084096,11668486274953189799,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffdc5e5f208,0x7ffdc5e5f214,0x7ffdc5e5f220
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1944,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2300,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2076,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4176,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4176,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4632,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4812,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4820,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4828,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4068,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=752,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4668,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5008,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4604,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=3752,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4996,i,11444261192379120090,7592269868039926691,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      PID:1704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5512

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3180

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Staging

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\Sigma\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1019233335\manifest.json
Size 132B
SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
MD5 a4d9ab812da8b2906ff9d46f9ffc07c3
SHA1 48b428dc760bc008058e6df47a9f05f2f86b4abb
SHA512 5a2ba950ed85ee55bc1402d57d09ca8d54c0c2df5b43a402bb8bf3668920a40d584fa18d270376b046e23be00698bd1399ef6a0b695ee6c0b99fb454616b1cb6
MD5 SHA1 SHA512

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1035038232\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4268_1035038232\manifest.json
Size 176B
SHA256 3e4c1b4b8dda29ed41f066d52ed35694e70f4b8a583efcbce12f661a49b57ba3
MD5 43c5775bc9bc99578d9a96958edc8864
SHA1 580dcf0609fb7931c7b5b7f8b787279bc1f6ec13
SHA512 0ab77a360635d032eb96b5d107626d24504e42522c0fb6f5bdabcddbc80129d05ac240b0ddcf21718308340676836d14feb677f8c0f3ed9d721bb0f623eef940
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4268_200958436\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
MD5 SHA1 SHA512

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3ea53b6e6e94502146db86ec1621ce9186593ecc7c01908b2b9e5d417b91ef8d
MD5 2e61d2c63791efc8917e359fc147cb17
SHA1 23b8e20bd5ff76407915ced029a6fba9fdc8d7d1
SHA512 ed15ba96e0902909d30ffa5dbf7bf22bbdfe97e953087111b9ec45cd4f776251a32c87066239dcfb073b44fa4d9b497c4bc73ade521ec0e0323b9975282fd8c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 352059e173cc1297f1bb93eddbaaefeeea2646e26e39c930922d18e5285f7ce6
MD5 8227f4e4997195ab9b994d95aa3de48f
SHA1 c33e36c573da21c5bf80a8c358461e642cfcac74
SHA512 b8059b6ba3fdcfa56e6db9a41e852e4537e6a4e2e00b8ab66e834410f15026a16c0133b7280fe8dfc24ac37192c544e7370698870a4968fb02271a2ecbe2cb0c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f09b5d8bf8da0c97730d16b14c413552ec4b7c736e69b65c637f6c128552f9
MD5 e09c972206390c4593dd8d45e4f5cf81
SHA1 d121d974e9e116202123b93c91dcbfd4b754ff58
SHA512 bb0bca3b5f188a3192d96814a56b3f04d522df230be3b558ace7566bb761d01111f19f9fb96e1082fe69b0c6c2dc21f6911d62d09c55b45ee9af8e7316d2bc7c
MD5 SHA1 SHA512

Submit Download

625c07cc-74e9-43bf-9039-647372007e2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\625c07cc-74e9-43bf-9039-647372007e2f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 16657bb3f274b86d377f0e735afa8c0a5fa44bb47fc8833d414c5f6dfb8be740
MD5 08ede9a6775980e449cfb1c7b2e53290
SHA1 0acd3d023ded30743c0a7c98f73ad25ed6e66c38
SHA512 532d8716ec9fd8cd20e12bf9f153dc10901facfb7e0fda83732916b86d64f27040eb04911a012634cf1d17e38206cd8ea1f27aab080431aa8dce87fffba1eae3
SSDEEP 384:RBVwdnXEIQqM/h5LNNzqe8cLD5bmHLbBk11cz8eP+08c:zVwJzmfLNtqe8cvMPpoeP+08c
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 608fe5b2199efff9b9368f1d9e4af84dc9149e22d3411b35901873e6229e4075
MD5 e36cc63e81ec5dc91feaa7b711d4935c
SHA1 f24ff828386c76f6b24df36cbee4a314c9b91230
SHA512 81fa0c0144cbc65a2d0421cca5b1fd46b10d76744a7f9b223d56dab2c81b40099b944c9fb79260fe84993a85be9324dce1b9fbfff89bb755223d608372810e1b
SSDEEP 1536:NkXHaw6Kf5r9kGMAtYQjIYyyJGq6A3zv5SgSSV6F1bwVnI:ijBZjzMSV6nbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 32aec5576dabbc5186f498f54e3ac7b9fc50ae8e15600737c16cf4acdd301cc5
MD5 5203a9e72994be2c91515d1d741c126c
SHA1 553abd6a6fb40d39733c48ed2092799eb06ac689
SHA512 074d33ff91f0bdf1ec12d0d97b9608c27eb8545ed49d1b65bcb7a0fd2e9afa70af29077379a49eff7c1d5affa9976ccc078b675f5776f13a071202fc98c6e2bd
SSDEEP 3072:WI5mCkdTDeH67TgzC0Y5oVvynvWaNCviLhaxEwJUcAdDk1tIG3+eWKpyrv:f5fCDtwzC0Y5oVvyvhjRYgwIGOeRov
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 3b0b08335cd1576b69d15f92dfc5c89d9bcca2d498790d504d3a7dfe35cfda84
MD5 74db2e324d979f896788bd7b84da2d48
SHA1 8102105176f93ec08ca0533a792fd581ff3f2bde
SHA512 bf50ba3a3cdd1a88bd8d34e0d206297517a11d8851e7f0e38407e874602894f88b8e39a5a65c083a58eb7d41583943cd376a473d944f543604415c8a25dd81ba
SSDEEP 24576:gEPhVBUwGTWJe4q+/C9LNfYsjYjYZXJjx4JAHkSF5Its0oR4asmO6hGa+eUkHv4q:gEnGwJC9LNfhwYTFk6na1LmO6jwzxYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 19d8373b6116ad6f57eed7e5f440f05b3369623a2683f4079231ee1c4b2a5975
MD5 5b9cab420e24dcc5c785f7f021054c0c
SHA1 4577ef31484a5c1fcc2b95376687827f86162e6a
SHA512 fd9c30683893f791b27eccaa149817cd42411c3fef16198128adfdc3db3f6a1fd29479562c1f05974a8ec48d2b53fafdbd6d2a2dab113f92365d3a9095f8b614
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 a1e41a8d980989b4317b4994b9e60c88177393c56c72a1f6023ace25488ad413
MD5 b3028d5d7f10b029d18a245cf18ffdf4
SHA1 970090ab3ed33051578149ea83de43fac89a7009
SHA512 cba4037ce49c58c86f0611a15278496153f275fcb912153ff4d9b11d29dd6f46f93c0167d4d39a29474c4f49f7c28d286b4faa2b358db3b9cc472b71ca33bafc
MD5 SHA1 SHA512

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 eca74a3644f4b43b7246de1517a81fdd85bbf2ed56cf18eadb75a72627d283d1
MD5 a8bc33fe48026271d8708b54554fd395
SHA1 834e020f46005206a14316d0952d33b1a0873e1f
SHA512 fe716c220e43fa9b87f91c5927e4fed72f0de81cde699890bf8e60bef6355e33eef6884a238bc7028bf44f938d8764e4cc2d6695b3d3a2ba37fb53b3341870aa
SSDEEP 48:TlgUL+lfwD4jJ/BdX9s3CzyPsu1o8KGsDgXLGxCvm98oasM+Y6+WpaCc:YwD4jJ/1s3CveMG3XLG0w895+Y6+Wpat
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 106a346ec16071ce53f48d0bbc0f5cb9e68944b539e0b71d6c0be1148895cd7f
MD5 1215f2ad3819dbc72af4540a3a052dd7
SHA1 0a9ac507a731fbd0a450fc5ab4b860992764ed4d
SHA512 20829ba278dc518e4e5f85b7ac3f8fb0987f5ea0ce69f6a6151a0297815dd1776c8f528c5be43962cb2867e86e9772c2f878308467092164d650c176dede7cea
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.98.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 109KB
SHA256 4c4bf802373aadc6e968f420123ba2efc9ca7b9d9d8220fcac5362f01ceb94ae
MD5 c792176a4680d0ec9f45a79587896492
SHA1 fde76c08f8800149464e91e76c7c09a9afba343a
SHA512 18fd1d76bc0199a8eb24c07c6e99344ae662dcee271177edd993220a83373f9da878cae78b16ae3508fb0950a771bf941c2e737d03e22c79cda13f8ad4b3187b
SSDEEP 1536:RQJV7loQNNGZqW3w5PDuVjbpBuW8CRZsM62UhPq:kVOZv7ZU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 20529839976544bf957c196fc27b7a39c4a566278b47bba338d428946050e083
MD5 df6fb882a849f7c157f9bdc9063b43dd
SHA1 10973d4fdff8c9a17e17dbcd491fe191e54e5f9d
SHA512 829ada52433d5810a837e5ae5366fc31dfa63140980edbec3243724b8f08f84c47493cd89f504202576bacc826ad0192792f8f1a9e8648ec5929229f8ca53fa5
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 23359480ee424d8520e51bc4fe2d9dba74b579be8a87e0feedce30f5af54b0b9
MD5 1e15c09eb8c9a841b2a1ef524d097fa9
SHA1 c5356eb632fa4591ed8a4b941e49e77ebc84eb46
SHA512 473ca1d355021b1d44d273a281b08f075878ebad5bf86bc03a21f1f7df0b561fca19f322beadde18d49ba0ca38d53d1328cd0f39ba3e01953478fa34b8a1160c
SSDEEP 48:T2CLopFMatSaw/auUOt8BcolwRgyKfuJmhDpqJdPwrm/:iCeMatUaAKnEgyCGkFEP2O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 44baf8b0aef5ccd96f697b5d03cb5d0eda6300de5c356efd5fc653583b63250d
MD5 b142c5a5daa52adb441ef5a70e71c797
SHA1 22c206f462f655653c03a52de442ac0f217cce03
SHA512 33c945bbc7d46f30c565a38761a1639b9407d8462b3df84d9fbb3887dc80de9f1d061abf5510bcd2aeabcdec1859c3b4d6a4359a28f0795d0a33cef3a6d599b1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 481a6076bb341aa5055052a7996695f3bab81427d971bb8b9d06ef30ce95fb02
MD5 a7da84e30f155bbc2812d1914df574ae
SHA1 af321ffa2234f39e6d3c397ad8c6e9e2e0fac9bb
SHA512 fa52d47fb4f32ef9ebd32e14bd5de09b392a7aa77972d91dea06d422ef1a348a0a05e7cde27e24a13bc29f648dab9bc2170e11f0310101b2d07774dcd37bf7df
MD5 SHA1 SHA512

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 fbf8096ea117f31fc187a65b8a32e0742fa88265c973e7596dd8e9895c7c83db
MD5 1fe46d3fd10546f4ee0a1078777e852b
SHA1 e840c2ba3c1eaa0b76530c35375ce7e3fdd8796d
SHA512 592308538109163e580878051f3b0e2bb4f715479c6fe5d7f6d5b564c77aa0567b922d4b3e06be770020c088f998cd14cdf50326bf44f2b3ff52febade9fdc73
SSDEEP 96:eIEumQv8m1ccnvS6YcLL5I0DI3G5EOAu/40:eIEumQv8m1ccnvS6Y4Y4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 afc774e2f21da722ba0889bbeebd273cd7eded30da2325572aff1ec69389db48
MD5 2108b852bc2ba549d67777c3f7c93e2a
SHA1 19e021b7f830bfd4a49e7fce93c435b3fb5a103e
SHA512 25a130f2ed2a5fb618fc0f3a37973cbeec7069a9ef21e2f1851effbe5c892703ba0759ff53a6b902b4baabc2e4c214f004f1780cd1b28a716dce258df77b5cbe
SSDEEP 192:sV8R9yijDKOMl8UgasGWc2vd5aEgxXE8wHZzoZ8p78HXR+WNrYKm+rYnqDCqcIgD:sV8cqasGWc2l5aEIXVw4HDrfDtAD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c91a88091c61139c5a21e3561e0a605391414e1fa9723fabbfba23dddf3c36f8
MD5 0e70d6e4a92ecf80575f3a17caa0bf00
SHA1 ccf755720167f7efdebff4006b551b7ae57655ee
SHA512 926370f68d937839ccef2a78074e6213361db158aabfbf5d8c62a9f865fcaec2b8d16c5da6571ca1e38fd7cd447cea471599ef7daf0055a11676a8dba08f102a
SSDEEP 768:dad7XkI7pLkiLZxOWFOiea8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOZM5LltDGIkri:dad7Xk0koZxOWFOieau1jaRZM5L76Ivp
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 7edebc2072d0cce5c179e7fa434e0e652338c7561bbaff2739e09232383766ab
MD5 c5f631aa0ade62b9a098f690b5b0cd02
SHA1 25a0851d783a2ccb002bfb89e6690be2944ae7a8
SHA512 c6484ba7024b9192c87fad403410738fcb4a62d73e2484e04726a0ba4c552d2ce8106c508ec098e2f30dcd07e6b8d3a523d8c9e3058e7e297c76eb1af1d579eb
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 1887d6bc8dfaeb8ca7fde996e579310e585cdfb7680003e5e50c181ee9afb10a
MD5 264363abaaca15ff763d8a18f9047291
SHA1 f6455a3f55b6f1903e3eefdb6614027be98cd547
SHA512 38e7829e1c6a4341901e318bd9f972ad32757139af36a54b50dcdc44d9ce528d6d45ad58743965041ba72f546ea6df12727aa170e8f3bc09a227174d011a78a8
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 05198bf88f06a12aa5082c704eda95336179467a1f7dca2fd72c9d2db8c5553e
MD5 e49bf30a39f97d6112284cafde899498
SHA1 17b7f17648af89b44b32236290913149c78dba0d
SHA512 af9a7d9603cac0401f0923eb04c7fe8b096ef9d1197d04f5d0e4f8b719015f4a9735fedf082dbbecfcf45a91fc9e08c03c4c69ee4555c2dae24ea06a85faf9e1
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 4bc5923f903ce647404059beb67ace19ffc10b2f7d8257a0b3a2ffb7d8d5677d
MD5 9f2d40481f2936d187b0dda78583c893
SHA1 f69142cf53e4addc6fa1195e7bb479f6d3ed3708
SHA512 393cb767f6f4ea3e8783eed22135039119dcece4af7f85085197eb73d5b7de827ede6d59a995985469f0fb5dea89967d2b568bc377c33bbf7e0e8f0c8a09275c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 93b794f0e8867a2802f09261f176e85ebc56f7b92b384aaad6bd15a40c3988dd
MD5 dcdd722a031a5f1e28a63cd909d98702
SHA1 7d9e48ec8e576977685d03aa7f3fc731a31be021
SHA512 650a285a895a71079d99e9c5aca9ed7cb8471889ac12c9f5fa5ba25ab38bf3ee9b4060ad46655bd83f5428d11eb29b43e0d8c38e9f682e88d86275bc94c4453d
SSDEEP 96:TmKZerKPyZKhyK5afK7+KZqjKHzKHGeK1UKF2SKNFKjKlKdqKZeqK65KrqjK7aKY:j/zrMytr83421g
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0ba60d7667eff12c23530fc724db34c4954899d7f9fa253d01679149f17a6d9d
MD5 7b998ee7cc85604775cd2d4d99a9a2bc
SHA1 3c98202c8d461665e9e667cc76fbb6f667d9469c
SHA512 71560a3476f0522c850f68b28388d9d8aa51958165c990e42f1e6f915d3990ed1f8fe0c1f7434a5f8dd88f354fdb6c6c61cf4f5478cc53d7699c7d9f560564c6
SSDEEP 96:TmKZerKPyZKhyK5afK7+KZqjKHzKHGeK1UKF2SKNFKjKlKdqKZeqK65KrqjK7aK0:j/zrMytr83y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 556f88ec711134efbf40c8d6006b1af273085801204b39b747d1a3cab8f652c3
MD5 2b80f0e6aefc57733c8cbff66c851d0f
SHA1 5989c1b513d88dced1514bfd64cec66dc0e8a98e
SHA512 15ab07d75e3fc05112709ce41ab6e31f786c8df73669a4f71f12f8bdf5f19cf289cd89e710622e566f6a8ba0f35decb11f8f1d3ecb15e8a6abc639485e72ee7b
SSDEEP 192:51moNY3fT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:b7EfQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 3KB
SHA256 6817f2df6991244a3d5462abcad9e3bc400c2768a4737e9706905ca14c3a8160
MD5 927c06f7629f650f1d0448e182d7f886
SHA1 6e4257567b2aaac01229ac0f1a3f1ee2cb44c49c
SHA512 4ac5a8d7d777101d6ea482144ca9548e51c6079a8c56e200fb9ea6eb5899817ef91eef6a523ecd7089212513c0f3fc4e7efa8372d76b77487237c6205c7e320a
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 9KB
SHA256 b1c033c97ebca4e7d410f79d2701dee437a49f24274d4862bb0ad4dea0cb7b67
MD5 4f9bee38775ccb43dfc294d02397e1b7
SHA1 d413c4719916bd21e043393d506900b83477abf4
SHA512 4b4fe7420f1666b82089d3a732f8b84e85ee912400fbb39beabe5bc00f0c16070ce103a6e57e1e97b053faf7bc4ed2c6ac609d5e479e0a9e3912d5ea0f190e69
SSDEEP 96:W89+LVgxZvggNN/+/+/+/+/+/+/20HkDXmYzRQa1IYjIYabPMYjMYwxUxYcYm7dH:U6zPGGGGGGPyQa1IIILbPMIMbxUxYcYw
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 b00901ed5d0bc6ffe9e3e4a483f27bc755982bec80b7b2a4ce91823c89b2901a
MD5 a62054d3fcfc3d6074906cc54c4a9b6b
SHA1 326b068eeddde88605a3bb9be5fe8f108c0870e9
SHA512 1fb38d736e01c618fb66a7ae5b8b411fef4e709f93b3b75fa4bbad441e5396a7d36083f12d30e9ea770545a74aa028d27677b420084a1a3f98e13843b7c7ca8f
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 830a67825bf6a4810d82e6618548906bc313f7fbd60a91bd346a6ad53551b29d
MD5 e810bf208fe81f9cfb2faaf1b876afbb
SHA1 4187001539db65e2c1704b108451f7fe986fd871
SHA512 1987b46bac255bbff4c776f8cc9b18b59276a27a7b0e54773a0205bd03d320438712f8f3541e8c9d834388f6d1b7920d6740baeca50c98deba26298a31e63b41
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 6673faf3f9367a03f22785cd07023b28f787d5d34dec31c847f77dea124ddcd0
MD5 a0b4d40eeb92e6a78321cd00dd84c30b
SHA1 bf70f36703a557e7724de9174951e4f508f79a2e
SHA512 fb13d7b9cb952dfe91f7658c65ae8e4d961ff6de224aeacd60afde4e019320ea65f3dbd64ce2254bad704eaade041fe2e6108c3614c71a7f65714f83ab87b18c
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 5a4202339c8efe482723ca9bba284fbb108377cbfae6095d8f7830cf4f5d72f5
MD5 59eb7cd4a1f7f8b7315e0622864e53b3
SHA1 7767bab5fe3c17d11d4863dd27aada92451118bf
SHA512 2d3ad8a778a5db31c77ce0d622d47f2ecf2928263e44db7ff58c18bcb12417e9520b00a9d0cc2f71c9c14b4b0b972d1b93696e0d9e21560aafb97381bc44a808
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 17b14ae3a26c29f15919d24be2a53c20ce3bf29ca408b47422c5dc770069011a
MD5 82a0a6bd75750137f8c66b578cab04a3
SHA1 0db7b21eb1a82b8a15f316e083500f008031db70
SHA512 e2a103afe3792e088c618ca548ed919f7514901aeb2d904d91426650711722ceeaa746e14739a15869d8c45380a6cb94482e6942a6a19ca3ff0c5652cc7724ee
SSDEEP 3:MsEllllkEthXllkl2zEfl4ll:/M/xT02zrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 32230ccf3c2c7481a4e43af33486c8addb5bb872bb873cb5742dd7b93f0f721d
MD5 6aea82780624c702711823b37c799bd0
SHA1 6464215ac78f4fdf483e2a455c30fea1eca237f3
SHA512 e318494788d4518472285a98a0bc8fa105322461f917354bb79d495496ea7176d6db6e54d1baba59e2af1c607afa1ee86b74170ad1ac74385bd51a5ce025f6b5
SSDEEP 768:hF5BLv7I5wCPFdV6Zi63rCgjXO1OE0ADRR0lHk8msaOujR:ZJUV6ZL3zOJslpmx5jR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3dca3ac3950e7794901b060b44df1c750278d281cb6ac75ab44d30fa2a466f6a
MD5 92750254f0116780d546c08a6b1cc115
SHA1 82830e73418f70fbc031447386580e44341b0ab1
SHA512 c77dc74e984a2d0287712487297da2afb79580c926bb104ca7198d6e18c2fb7de2cd70f60374989e20f29a57dae53e2d355a4797258867aedce5f688ccf33732
SSDEEP 768:WFTYfJSJLdOuDwLALuCgHXO1Mr0ADRR0lHEkoUAtwFsaO2H:eYfEhOuPwOcslToU4wFxD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 90f533af7dbd201c6e930fa30e8ba3dc588f44abae20f2d40605acdf4970b5fa
MD5 9d4200e56e04729f490e73a24dafaa13
SHA1 39ce93176c195acb07112d38cb1f5d789bc997f8
SHA512 be6778046859ab443b9daa4d443887612815df402646b4ee7686684481682d6e009a327fcabffdc51e5c34ad312016bcb64906cb8bdb21a689eec746daeb47a1
SSDEEP 768:yFTYfJSJLdOuDwLALuCgHXO16r0ADRR0lHZDM5TCzKAc9fTBtw6jcsaO2Y:yYfEhOuPwOmslhMNSKpTHw6jcxk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 f39093f041ba79237f89287522a28e16c0e730ea0997f0c71fd5b5d19bb2f267
MD5 f335a949d9861fd810fdc6813686f2da
SHA1 511cec68f8c6a650b30c69f098396f3abd904344
SHA512 8176d75e6b6755e87e504300f06820ca388b123c018bb9d9f41598e68cc3c4c07f08facfb7ffc3a2cf11cb20c6f4ace7c4f783157cab29e2f8847d75d87c8c8f
SSDEEP 768:yFTYfJSJLdOuDwLALuCgHXO1fr0ADRR0lHZDM5TCzKAc9fTBtw6jcsaO2Y:yYfEhOuPwOrslhMNSKpTHw6jcxk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 50b493051969a5ae1bf0c9b63c8f64b3d4cca704fe16e18e1d10901078f37e30
MD5 10278781c557f06160e40ce7a1fc2695
SHA1 45b452f418cca1e2586263124b271303aab3106b
SHA512 149a07539d3c3f4217dbb43ee4101f7aad228a08caa95368e85bed1397e99ae385fe8267100992537e80e4b417ff81e1655e4bd164bccf5806b4b4174e64c1c4
SSDEEP 768:yFqYfJSJLdOuDwLAm3uCgHXO1Vr0ADRR0lHZDM5SRBtw6jcsaO2Y:JYfEhOuS3wOpslhMIRHw6jcxk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 182aca5a5d3ba091e998412a9031a8dd3d38b495509f31fff6b4e7c61d780916
MD5 8ddd43043c72836c6ce579d288eaf652
SHA1 416a965a7c4156d750e9d13f7a5b09b78d0c1e1e
SHA512 d647474964b561cf9e0bd5b79d015f1a267d3c31d50e5e2f5b134e50f183d7d5258de82cd7dd2265aec11dc0b5dc6906ed97c5a230a4fc0cdae424790d7985f7
SSDEEP 768:nF5BLv7I5wCPFdV6Zi63rCgjXO1gO0ADRR0lHZDM5SRmsaOujR:/JUV6ZL3zOJslhMIRmx5jR
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b429f279a85a61c44caae0e9e8517c05e25278e01149424f0d8679275d4c3991
MD5 270bf2482fe3cfdd8e481eca8c504a19
SHA1 25d91b7ba1a15b5ccc550be3b9648319d33f5ada
SHA512 32b57c955b8a6ccaef314d900cd3b0dc524dc61769fecd4e5f27b9cd3169fe421ef72b6eb3dece1052614a9f1d9b1b48c628fe3403e90d259f40c35d9db5aef4
SSDEEP 3:MsEllllkEthXllkl2zEflZji/lll:/M/xT02z4i//l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Advertising
Size 19KB
SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
MD5 3495430eefd1e96e8bd95b67ccab0f91
SHA1 54129d2d72e062ad36a66922331818e81bd34df3
SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Analytics
Size 4KB
SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
MD5 db9a3dbc4820c8d84a0a569be1234dc0
SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Content
Size 4KB
SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
MD5 26c006f350f70dbc8c18098b773c3d4c
SHA1 eb015f7010dd74c874675d0599e634027363b7b4
SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
Size 668B
SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
MD5 95aa820d67ec466eb3444a9458eb7e56
SHA1 f93e178ff40310e071e4d596f0aff0514666f787
SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
Size 1KB
SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
MD5 3d90e5235a4bee8f1dccfc2aecf7c585
SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
MD5 SHA1 SHA512 SSDEEP

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
MD5 SHA1 SHA512

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Advertising
Size 20KB
SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
MD5 6959a6835772c67f4e72105e4be259a2
SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Analytics
Size 3KB
SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
MD5 e018dfa2df54c80ffbfd02c6d2ff5430
SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Content
Size 5KB
SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
MD5 dee2a727844dd3cea088941e82722406
SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Entities
Size 106KB
SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
MD5 751e7cc660220e7464935a9b90643274
SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
Size 2KB
SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
MD5 5330ccc991b45c6f2777d23c7d8afe8d
SHA1 d11187c035458fe1201608a91062962903de2e53
SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Other
Size 198B
SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
MD5 7bb2f4076e4f47781b77d811b21ef1ff
SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Social
Size 3KB
SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
MD5 fbfc314bba2160b09a3376521c762772
SHA1 3566357486c5d466958334e813c90c0a97bfc985
SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\manifest.fingerprint
Size 66B
SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
MD5 0f487a41f1bb9a49dfc5814815dc8b1e
SHA1 39e5af8034fab47bdfbaa2a66455c74185756f0a
SHA512 bbbd1619eead82c70cdc0f72867db2ffdd4a45cb908c81e852eec8c1293bcafb90c554bc3d51afab7fd7e478efc15aa9ad90fe1b56a01d0012ecee493184d36a
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 2e44a88f75fab5218f11667714f90308100ceb1ec33cba58e85cb77c54ade894
MD5 7163be694c45c971f7cf96bc836c40c8
SHA1 e6dc587404834981bda8f3ab68268d69096791b8
SHA512 758fa9088cf96eee8ddb16ed1f9b328b24d479a5075b0473365b5d8ad84f977217652e3732c8fd7767969fab0f772b3235c6f6fe760f8624141241d6ef91d32c
SSDEEP 768:VQIOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:axhaqLI1WcxKgdfHJHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 1a0cc4d14eb0b90184251789408c5c59cc44c3f02cb3bc969aae6d6dce24ee46
MD5 44d05060b239a863c4c5820ec1c6661c
SHA1 cfa27caa022846321f8c710e42507e8322064f3a
SHA512 1de5f6753ce2608539ebfa48a06cd6a57c6e37cc1d40e858a34f0bbe59762ebc56f2f86512bd31794102f85d99167dd7434406d81ee8ce0cf8ec31093603f30b
SSDEEP 48:7MbYGwefLvqJ/IHRH34kWqB1kQnjhHmr6ITmUBn:7+7w4vKIHRHIbKkQndHmLrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e7dc76d7b89995eae5ce3928fa4569f74744372a391f2b785c4e61728364e4b2
MD5 a790ac100545b690b9bdcc6d1c241f78
SHA1 8eb523a57e7e6e172d673eecadccfdf73fe17a89
SHA512 6acf75c5ba3fba55e7466136982175942b70817166b21c419d883b7e4dde0c845104ceb20ec796be0161f46a8f2e74767673e9af3460bbf22e5127efb0c6c4e9
MD5 SHA1 SHA512

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 bd52669ed6dc9af4803f9b6567dad8dbd848e5d572190264d8caba429acdc1a9
MD5 ae3e123bc8bd02f2157c2142dbcbd767
SHA1 17f23eb8313795a28bae66e095496cee4ea35875
SHA512 db41611b8f3de58987320b92284d31c66306cfd73d1ea4e3130a09ad8e4d4985da754e7a828e0954469c0371bfe303631b694df9ec88720939d7048f8cb83baf
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 c1abaa08c7522e2b8b98595d59626cf68f2514a388b15b306b3890d0b72839a9
MD5 db077847a1c457fa64f50d470b206c3f
SHA1 de5fcb8d79b172757d6c3fcaeaf2fc85d195c538
SHA512 648d0ce9d88accc14885d86bdc300cdcc699e60ac7be1622b651b06f6ae8752082d8a2c537f1f2c6d5e903dea75b767b808ceeb4b783db206a87597dbf9af3c3
MD5 SHA1 SHA512

Submit Download

memory/368-609-0x00000189DBAE0000-0x00000189DCAE0000-memory.dmp

Download

memory/2228-454-0x00000235114E0000-0x00000235124E0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads