hxxps://cdn[.]discordapp[.]com/attachments/1522295949840482485/1538606059340562504/Cool_Antivirus_FREE[.]exe?ex=6a834a0e&is=6a81f88e&hm=4a95ac7d040d4ae20bf5218d2280ab6a81f21430247e182a003950edf420a8fa&

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
76s
max time network
80s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/08/2026, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1522295949840482485/1538606059340562504/Cool_Antivirus_FREE.exe?ex=6a834a0e&is=6a81f88e&hm=4a95ac7d040d4ae20bf5218d2280ab6a81f21430247e182a003950edf420a8fa&
Sample260816-wg955stdpa

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	5216	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4556	Cool Antivirus [FREE].exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cool Antivirus [FREE].exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5216	msedge.exe
2128	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "15"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313765300842479"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{285C727C-C298-4CA9-8D0C-D81557E557DE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{88EFF72A-B694-4DF3-B362-813E730B288A}	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4556	Cool Antivirus [FREE].exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3892	LogonUI.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5032	4588	msedge.exe	83
PID 4588 wrote to memory of 5216	4588	msedge.exe	84
PID 4588 wrote to memory of 5224	4588	msedge.exe	85
PID 4588 wrote to memory of 3308	4588	msedge.exe	86
PID 4588 wrote to memory of 5224	4588	msedge.exe	85
PID 4588 wrote to memory of 3308	4588	msedge.exe	86
PID 4588 wrote to memory of 3308	4588	msedge.exe	86
PID 4588 wrote to memory of 2500	4588	msedge.exe	87
PID 4588 wrote to memory of 2500	4588	msedge.exe	87
PID 4588 wrote to memory of 2500	4588	msedge.exe	87
PID 4588 wrote to memory of 5444	4588	msedge.exe	88
PID 4588 wrote to memory of 5444	4588	msedge.exe	88
PID 4588 wrote to memory of 5444	4588	msedge.exe	88
PID 4588 wrote to memory of 3592	4588	msedge.exe	92
PID 4588 wrote to memory of 3592	4588	msedge.exe	92
PID 4588 wrote to memory of 1272	4588	msedge.exe	93
PID 4588 wrote to memory of 1272	4588	msedge.exe	93
PID 4588 wrote to memory of 3164	4588	msedge.exe	94
PID 4588 wrote to memory of 3488	4588	msedge.exe	95
PID 4588 wrote to memory of 3164	4588	msedge.exe	94
PID 4588 wrote to memory of 3488	4588	msedge.exe	95
PID 4588 wrote to memory of 3488	4588	msedge.exe	95
PID 4588 wrote to memory of 3556	4588	msedge.exe	96
PID 4588 wrote to memory of 5788	4588	msedge.exe	99
PID 4588 wrote to memory of 1856	4588	msedge.exe	107
PID 4588 wrote to memory of 1856	4588	msedge.exe	107
PID 4588 wrote to memory of 1856	4588	msedge.exe	107
PID 4588 wrote to memory of 4556	4588	msedge.exe	109
PID 4588 wrote to memory of 948	4588	msedge.exe	112
PID 948 wrote to memory of 5996	948	msedge.exe	113
PID 948 wrote to memory of 2128	948	msedge.exe	114
PID 948 wrote to memory of 1684	948	msedge.exe	115
PID 948 wrote to memory of 1684	948	msedge.exe	115
PID 948 wrote to memory of 1684	948	msedge.exe	115
PID 948 wrote to memory of 5584	948	msedge.exe	116
PID 948 wrote to memory of 5584	948	msedge.exe	116
PID 948 wrote to memory of 400	948	msedge.exe	119
PID 948 wrote to memory of 5472	948	msedge.exe	120
PID 948 wrote to memory of 5472	948	msedge.exe	120
PID 948 wrote to memory of 4832	948	msedge.exe	121
PID 948 wrote to memory of 4832	948	msedge.exe	121
PID 948 wrote to memory of 5628	948	msedge.exe	122
PID 948 wrote to memory of 5628	948	msedge.exe	122
PID 948 wrote to memory of 3940	948	msedge.exe	123
PID 948 wrote to memory of 3940	948	msedge.exe	123
PID 948 wrote to memory of 1968	948	msedge.exe	124
PID 948 wrote to memory of 1968	948	msedge.exe	124
PID 948 wrote to memory of 1484	948	msedge.exe	125
PID 948 wrote to memory of 1484	948	msedge.exe	125
PID 948 wrote to memory of 5924	948	msedge.exe	126
PID 948 wrote to memory of 5924	948	msedge.exe	126
PID 948 wrote to memory of 4656	948	msedge.exe	128
PID 948 wrote to memory of 4040	948	msedge.exe	129
PID 948 wrote to memory of 5556	948	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1522295949840482485/1538606059340562504/Cool_Antivirus_FREE.exe?ex=6a834a0e&is=6a81f88e&hm=4a95ac7d040d4ae20bf5218d2280ab6a81f21430247e182a003950edf420a8fa&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff3242c188,0x7fff3242c194,0x7fff3242c1a0
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,2160296855618004303,18185183902623745041,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,8269213140341816000,13461845533929637699,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,15618203203894329408,7831157961551248542,262144 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12969181918001102678,5651597547964039303,2097152 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,7297794564068071813,833805752353946612,2097152 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9745451239381440345,5194717731090106492,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,3694498513183582941,3510890975312600048,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,3476694700466286399,4651741258388531776,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5728,i,15588127915639849962,12592797279878314082,2097152 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,14845744344988603405,17753606602820649411,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,9517654789807235184,955968497934575956,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,9517654789807235184,955968497934575956,524288 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6736,i,11754211046232545599,244265899461603065,2097152 --field-trial-handle=2320,i,1370414692579930783,6100921690434516282,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:1856
- C:\Users\Admin\Downloads\Cool Antivirus [FREE].exe
  "C:\Users\Admin\Downloads\Cool Antivirus [FREE].exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2bc,0x7fff3242c188,0x7fff3242c194,0x7fff3242c1a0
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10398719145449476609,17394898902121116468,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,4862655064824297485,16622991748778574121,262144 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,1343705029843222822,13998690451426924600,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,15314630062407489780,10836647939218799836,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,15314630062407489780,10836647939218799836,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,7288826243790343826,6482469118015698414,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,1699028537022255061,1847468675251813793,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,4166258698373650663,15831012435335035029,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,13439138120501658022,4384780567355946002,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,4491192483287083297,7801369089373842175,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,6809534408985475793,1668709648252561961,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,8942932761536879499,12756273480155547254,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,687720530298421266,15345396311742292173,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,7999901075871993673,7496357570023057244,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,8330906674832062079,1170629595842455476,524288 --field-trial-handle=2112,i,17669394986659227528,2886127294507321032,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4412

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39da055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fac342855e0ea00984effd4d6b295e883218a325f3cf76e6026a2e1d4d3b698c
MD5 ab8336b0e6f029cc1752ce3bedc34ae2
SHA1 6053f6fd9560f5f71819851a37f90af49fa16449
SHA512 5dbd18a79f9b30967c8149f64642c055e7ab93a51ba3e39aa6820f0715bf8fed58d5f1bdc3edee7fbdcb266c09e7dd45c4208304f8033354ea109b9d47664da2
TLSH
T1B8D023B431577255E71D0071D51062447315C97534AFC392D075B94E9B15114D2FB0D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc1c55a2e96b339c0850e911d4a1ea97dabc9a1f42a3d0f00b206fd43c8fd073
MD5 f4c8727fae57735f9f097734d347c3af
SHA1 65ea8e4eb28968052828b4076840c6ffd69df843
SHA512 9a1dd6ea0386f403d91e9ed44a74de8f34803baef5706feb64c4426543885aab668de8de2e1df00776dc0b1a56f11b72674b8a5fde69ea3fdd07b82a88f930ea
TLSH
T1EED023B43545E571D14E0831E45076147212C935207FD6D655F5648DD55051DD3EB096
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b04bddb87b91d3d6e93bd392600d3c79960aa998c87a96367301b64963adc888
MD5 89a714038e4b82c93a75a0888b7dd496
SHA1 875ff940de49bfa75325d1bc0584717c94c3faac
SHA512 1ae96eecb56b9e33a14861952e9c610c29fc196ff0ddb2cb8815234c2fa02120b217ce5fc9e0b8707db6ecb1d9f63716fcfb5f6cf42c1939053bc2ba3908383e
TLSH
T1D5E02BD5CD61EC371AFC171954644746E75013572B40494B3E3C5108CF70A3B4586D6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ed5c7b689c5ac22d9ae452aa332490cf38ea610f8a640dd3ca00309bc69b18c7
MD5 f2760b64d61975255db75c26a9a7b216
SHA1 39ed1109c5f056136d57cb7227a96faa404d2337
SHA512 4ab2fc8463dc41e4ce5dda4c17c8e8a5f54f88c94c52d1950f088a75990cda2444819ced923b5e79eed7c4bcb2937ff9e81ea8b684cd23e63a6553059aea51c2
SSDEEP 384:K9OuBHp6ebBVZ84QUFcUkfnVqTZkgFqsFUUTo4d7Zuu:K9OuBJ6evZ8nfnATZkgFqKrV
TLSH
T11013E5BDBA2A2C61CDD651BD101B8A32273EC9A4FFE757A3B770366087353521B4E121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f87b57efd8d01641bca183be5fe5dd59f768b9564025fe2e704959dd2ef3da32
MD5 e91623f1d576a25a126ccc5ea6d3880f
SHA1 64bf11d0fdfa43b1117b4a1b21f975b169643e21
SHA512 c17191f209c0c3e2b52c713a2a3983796f7436be258a868ddc72fb356c08ba6f3b70d04e0738133577e5b4f55098a0b0482392c52c5d369aa82b78c231d9f3ec
SSDEEP 1536:pk8NSNt6WL/UkjL/FfFFqZDVluDL/npL/UAI3oycEZn2Li1:qL/lL/7EREDL/pL/bIBx1
TLSH
T1F4444EF71951A01BCFA802F5E2133A3DD177455D3DE2E9EAE6780CC12835B22B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e3d22ca0a4b3a1c89137d2acf97165b9e6d7899c4e26e2964670a77eea9f4956
MD5 c0ff86449ab4e1de430fa8587b0c1efb
SHA1 3f9d4c6216241a727c6656f1e6f4bdccafa33882
SHA512 414978f2292454f893363b600637fbd4d5992653278c075f24de501d17052188a9b5ef8f48a870d4d34baba449863586733a6fc43a1a7bebc6a7d33e0725715a
SSDEEP 6144:b75yfEaHaic3yaYnOnNn8nZncFCtPm+ZB:b75RdicCaKtO+ZB
TLSH
T1BE2518EECB682C82CE6B877470E0D9077E712183B68DC0D39944C5D897D6B8176E92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 54abe94729ffae4e70a4e74066019c44e77c7548c4dd47e8877d738bb43af49d
MD5 fd1dbf44421c4dd3efe0325ada31dc32
SHA1 35595cc15c992df3113320cac5133aa170680754
SHA512 7e448ddb28e4ad208e87bdc60ef26f0e2d8b94c3187d895f4cb9bb79086a0f430e7931380497b0f8aa2bde75c7b8ba15cc602476b7cb7a65a10b8b8e274f9758
SSDEEP 24576:S5IYdoln5Rj7PPPpmtBUWCLlrndx/YnmhD07x+2B/NuD3dic:SiYSRj73mKLlrnDQmhYo2/Eti
TLSH
T1DA868DEDCA6898C3CD639970B0F0E9877C7413C3F595C1D68C98C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 527f33c145102ecbaae1c77d2c6311ad4054c248bf0360c80d9ae69d9e3b3f42
MD5 fd0c313d0dadde92bece598f622fe6b2
SHA1 5a21435fc3b4108aeb2ee0bfbb1c143d76c8889a
SHA512 61e46840a26a592123cc9b0a791fde49b85862506ff2377668e30ac3fd3220f60acdb65f34ca5f86041714510cc925179df12339139e1404a8a41402b02f42bb
TLSH
T18461E7382247E560EF2801F09CE9D1D03A7189D0FF176E93E0A08FB216E7722C3607A4
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 222d4cf64763a7b054fab583cff57098b5ed5cca0ca50fef502440bd3f005579
MD5 e2cb051d038b53060fe2d121b20686e6
SHA1 8ca43df6aa436744a2fa40737b8904e33d996f42
SHA512 287513e5fa2c1f328cc8f3a295db7a1288c14b221f7206276f69d7df1dd2ceb59ad423da00bc8ae45aaff47c28ac6a2f1ba4d44cc687dde83c52a830cee1b98c
TLSH
T1F2E02094A5EFC1DD5F5434C753246F5C81C03552E78DBD4B2704CCC4B642101BAD3646
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 857bb3963c5f7728cb34264aa6c0181b51ae1356b454b7aa271fb4c3ccdbed43
MD5 035c111991b2274cead23aadcc42620f
SHA1 ec3c76cd33109f219eea0ef154a5d2b9705b1b47
SHA512 6e289e07bf77e37694b7dae2e4c1a8f413d502fd7aa0669e12f7274ff12c413c94c066987384b113c032cc881f80a9cc90e840744f3c42a3a603a761e210c439
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j8dW5LGqK5fKFtICqYp9:Tyi+7f+UZD4jJ/BSWxFCKFOCTp9
TLSH
T14AE2EE8D3B12F511C8ED733EA0C2C6F09EBC697C864E717191389D728C536A6F1AE10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e7768d1045e4b6936afd02c0308f42f852192f5a67130a68d59c3918155f6192
MD5 7a555625a00da584a0610c684727da00
SHA1 1e03c768ae8827bf38f49e731abd3eda310f50a1
SHA512 43354337da226e0da86c2d4778e1cd983885c60083c029756b441c05a819e1ae35adb7266922d29b65582bc360b7564ae58d2f18d81d97204e015def66d9250f
TLSH
T1F5E0260444CCC1A99B546CD7D36C670882E0350EBB8C394E278C9C48610224AB387380
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 7e0f735ae48558d65bf1aac96593c3fc4b2db5237e7c2787dfe1c0f87e1c3d05
MD5 be1081af762e52d3ca3991f79e571f0e
SHA1 917c920251ea6e60dac9b974186dd4ed3b058581
SHA512 a7d9009e371651deff11ffed39374e624cd2e4a41af7fd1765940d930eeb9102d9ed94598a2d4fd6d85fba4750a696e9c9bfff5ec62d556896264c81f9298772
SSDEEP 192:n+SPRS0f+G83uy3Ct7XBBKjH7DXspU3i:n+wB/83uICtTBBc7DXspU3i
TLSH
T17614301F4F642721CDBD917629E744B35D7CF03F8B5266CA686114B4CEE3652A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 53122fe5fdbd5621ddc080638cb4ff96055c4ca0c5d53db4e195f52a803c34dd
MD5 42c82afecbf3823cea1205d8347ba897
SHA1 1a26acdcffd596916946cf23b8867d55d09484c5
SHA512 f3f3cadf10fc172661300f606dd398f1fdb3cf76791542dc58221b5deae955cb0a80c7375f567e03ffaf213441095412545b13bb0ead45fceea26bebf9968a5f
TLSH
T136E0DFA044DDC2AA6F44218B9328B748C3E13606E6CC7A0A3B08AC49B80A084A2826C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 7d2c8326fbbc997d576c7a024b933f835faba20cd87db58afdba3e6bcc47266a
MD5 4053725ac8d1489d4601b32ec071726e
SHA1 0a95c999a2fb61be69be29298aba11f772ec8842
SHA512 bf937640c4b4447a4fe855aee05e1de62dfbb791246e99e268eea465db0ea00caad70eb7c6734be24b57a61be7b0857bfeeb07bb697f927e121d2af14225baef
SSDEEP 48:TNLopFMatSaw/auUOt8BPoih3bvMxnokJwb5XttfPwH:deMatUaAKlbMxJJI53A
TLSH
T11892410F1F306120C4B58F7AEDE0C5561F6C115EC3B76A5AAD0520F2AC5266BF506466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b3c52ed0344bd8736a8072b61a20bee42d8d0d1c5245ee97a731bb69054ea453
MD5 05ee530f765e6e46afd83a9cbc4dbae8
SHA1 57eda6456d1fe92e654e59ce2ac73b3f8d120685
SHA512 5f8ae09e68df923dc4b3f121a112af73a7cb32f5b89875a40f8f8d0e547a51e588e648b58e9d0c16f8d229471eae5a7666f6ffeb0a1a7922d854d5941f7ccf43
TLSH
T161417DF783F4866ECA1156F0AA14BE2BCE2D0514432C3D5A89E4EF6BD3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 09c5718d23c5c02eb396aa65e2833b1df47346a44b3da7cbf105752e5b8155e8
MD5 34604f018f970b75f0496d56df89f6b2
SHA1 986cd8702c7c401ad91d5c752928d61bc76b8f15
SHA512 85c0ea293e3996c461e5c306b652a71848c5dff8c63194a61a5f75413dbac052e1c3974f729217843db0bd4caf1e3c165e1f8389c651cb147c67ad8790249345
TLSH
T1CFC01262C4BAF476603855B91F84BC85A675D874105094E5DAD9833DA1D40FB5B5203A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3b4df0ee1bb7c0001fe6a8900d3ec9a3c71f85bd776f7082c4676cb79d6eb299
MD5 0373fa2efc728df0fff533b7830266b4
SHA1 0e11ecc42f4f207cbd9b6f377a71f2c4cc839d33
SHA512 54684636b0da62d87a71f3e3c09d09bd7532d8e3fdea55a15c4e32b21d1422a9727b11ca34c3952abf6312028b38a16328aa233aaa20eb1d220bdf45238f143d
SSDEEP 192:sxZLRCyMqZjK1Ml8K9z/fSsu3WpVXyjI8Z5z/OzodpLHW6+WNGYQ3R6cv7IgbMLJ:sxZL9tz/fSsSWvXSIC5rVLHbGKc7Ad
TLSH
T11E62F8456A38997BDCDBD21DFA557F53D7F91523A2904E4499FC8A0C00E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1c7288e649233489f358c39faff71d9607ce8fe46a3efff044cb563e6b1db931
MD5 0a5ca2b7fa2406aea1d2a04eaa48bccf
SHA1 4546ca01f7822248af4c90ad529e2233565ea468
SHA512 76a0c815becbff16f841698ac52b661037acb3c1345e4415111cde70fd77a4e51a35e9f4fc415ece18e569d8e156fc209dd8f6cc76affa7ba73020a43aec94bf
SSDEEP 192:sxZLRCyMqZjK1Ml8M9z/fSs92yjI8Z5z/OzodpLHW6+WNGYQ9j6cDRIgjLJ:sxZL91z/fSscSIC5rVLHbG2cZjd
TLSH
T14062F8566A38997BDCDBD209FA557F93D7F91523A2904E4499FCCA0C00E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ccd19472c1609a385c35f532866f12be669e16d3358e83e1e03460d40f7d6f84
MD5 a120b250d0948c6d182020d9c02fc1d9
SHA1 a6099a9f46be21cf38ce033539a8aa68d8d184d5
SHA512 ff80bd90354d040eb1bd5c617dd648a96794117f9bccb55a3ad4603817159d8d2071a29bb1cf287beebb1857d2c9fab3dd05e2acf9d659875065f642e31f03df
TLSH
T17BE0265005E8C2BE6B99A08B0324D308E3F47607E2CCFD0B3F84DCCA6582508B2931C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 cf13ef30697477a302a5dd42d6a6ed8244ef705a26149fb6db3fa45bc144b840
MD5 ce58ac83c9ac737404294b9a06148296
SHA1 2a9a503247515bb91836d8bc79adf396d0878291
SHA512 01805c7de4422fc571bf6bad62ea23116ced6a9ebee928bef8d9b2f1d49e080eb3176c76abea7b9633c778ec9c3cda421833be212df19d3040d461319a35b1cf
TLSH
T1B6E0DF2416CDC66A6B9D30CB5324E7A8D2B27502F7CE792A3B0CE8C5A246548B387280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 c938c0852920b32340aa0b363b9498e46e2db3857ba871d7e016a0f961165171
MD5 c737e7936e51541362927a983794a7a0
SHA1 2dac0652d5eddf95cd41697b4adbdc0473077cfe
SHA512 cd58f76c031134e3e0b0efc677922a12a17eb3051d0a1b1ceab5dcf3584f838b516a25618ed1d2cc220fc1580b91c43b228a6975d80fd004445df68a38bbde3a
TLSH
T1B6E0267055ECC6B95DC870CB4364AB1DE2F07946A3CD3A0F670898CAE141198B2A7180
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 289e2f596f4f9c143aef4a050637c9034d6dfcfda22757578924cf8564cbf79d
MD5 ea266e3a93ee6334a6781260c4141f05
SHA1 c57293e76bc1da602af0147de8baf56a587212a9
SHA512 8c7732d686ac275440ff09606729c3a2a042933f5be95f608681d40553d74d5e3886489a2a2719bcb028cb4ffb3b92fce24827ab91fabc1d5df4a310770df1c6
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2U:cVSnNDxZ9l3iZ3QxVl/1hVPutJ/T
TLSH
T1A3B27C16713A420238BE6D4CB3A68A774F4271633418A5BF3FB850720E6AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 7573ab5d424b80bbd1ab2a7d4bea4ebaaca8996565eb9926cf6761e6d8e18779
MD5 6541a2a7f0b03d505c7316ab8dff01d7
SHA1 82fa1542588b03fa7d0f588c2d24a0d1add796b4
SHA512 f2b0ffe29328aa0c6e9e750805ed8c86762836b2b4cf2451f4cd43ce10eb1bd21cbcb0583c5b742310a386baa15592ca6092d829f3a6857cd627c82294d0ea6a
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ26:cVSnNDxZ9l3iZ3QxVl/1hVPutJ//b2Hg
TLSH
T10EC28B16717A420238BE694CB3A68A374F4231633418A5BF3FB854B60E6BE115DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 58ee3d23713fe388e0442526d3063c4d5c7cfa9cb8b8f10ccd78b7430d980c57
MD5 f13827a7c3bbb3c4a656d0c0d4e31830
SHA1 a90db64a5767fe52da518d32c29eef6bb800d31d
SHA512 5fdc858c3774d3109b604b02348e4784573f547919bf5eabd3f8b9fc20594e823ceaf03bf54855fe112f62af383153c55f9dc15d1ef960a13931908a50732202
SSDEEP 192:P+xWHrQfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxDfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T13224530A7B747001EDE6D9725CB080771E3CA16E8F22A6915DB254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 6f5ec48f97dea06937d57aae2be076c2621fba8299fa0ec5931941c79ad5cd5b
MD5 1c5e211fa2fb5859218f0c50e4652bbe
SHA1 42e006f6058c5e2045372138bd865c73c819745f
SHA512 682edbaefd9240b98aa88d1d514d31487e4f4f03c88ab7abe9297a9627a2d9aef4aab5b1a4db78c4d04425e4d275b58633369b5ad07d608703d2fcad48c1c73a
TLSH
T1D151A8C1A3A554C56FCAA985D31E5A13ADE23F67260E58B5332E44F41F88C150E2FD36
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 17KB
SHA256 08065d0d5f965b6ce5a7cb3a467fad220ac7675313a5001d9f7368cf2c84aa1f
MD5 f6bcbf0934e4c41bb4e02116ed2a56ae
SHA1 53bb0781196f3614aca627882fdfe5c0db9d745f
SHA512 50844b23551de657b44646695871935eb82fe4a59367e994623a934f7fa958bcc706de43943878e717b90a62de368b9c5d5e53671ae7572cc2741a35e1aca530
SSDEEP 384:a0wsFf2sGokakdkOkBQeIIIdb9MIMeBZn:/lF/GokakdkOkBQ/n
TLSH
T1B682B56A22550B77C22F9FBF12FA869017DDC8420463565C7061AC8F6CF2A6786D93F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 6604ebe301b42fd7e70ff789a2e4f2ff67f35fb128cfe19a7212dec98b943745
MD5 ca9f4317e039c2fb90b8c9437f336960
SHA1 03ee30a1b7fe673e61917d9904be8eb2e2888175
SHA512 10f8717abf8d622aef7a59db6bcb080bb1666e4161b7f2af2858fe24ec0ba4399476e90a048242ef2dcb6deb8ca11534ebea0339c4a9e1297262d5c3be0075a5
TLSH
T1D0E026D0A8CCC2EFAD5C30D712385789C3803A03FB8E390E2F08C88DE006100F687182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 238c282893cb0a2acf62705464d9b8cf44772a86f352811b8c16c4950ef50e22
MD5 f9ebba5a4c08748e460c175d40a55184
SHA1 48d6a873feaf50e18f19561c232b7c8a12fadfe5
SHA512 93641ec7c60d021c37c29207b02381cad330518eb4d256a2e41ae4803b481eb5d5d23622856b18e88a43f1f4e0f5bfea22041598b459a5bfbcb7ab0d1fc68883
TLSH
T1C921605AF320C158E14E863EA06F97361738D8129FBCED0F547964392E75A010E8B6F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 f38909851623bece9c88216d01275fc4098c9398a9e534524a7a3a5b7879cb8f
MD5 5c28a9af63014d138fd0d83972586cda
SHA1 f782f7a1fe1d1e4c2464f7f20866d33321eb836a
SHA512 b4eb678a25cfb775b2ca0e85a621192026c678a0c08fd9d038766a634aea46d782fcd917a7f81956eda019d53ad20491a3a2b641895b3c06333d3386f1962078
TLSH
T11DE0DF10B8C8C1EF999031C342B5A348C2D1390AFB883E0A2F808C8DB107241B68B582
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 8c4dded98365eca0f344753c1d06cc10a97044d08e4c826992847c4c7ea2890b
MD5 2b51d3d135cce849c5244e4e38102e30
SHA1 2e861ccfbb8b522f32459f9601d9472debf8f951
SHA512 7490a1d757f3c6c180e49f6c3e49e65392eed6bc4ad3fb3633b44435b3af97c271c19f3e31cd5cb0dac3f965d56163d49668173e9dd040a37b14395f45ccbbc3
SSDEEP 3:MsEllllkEthXllkl2zEflCklll:/M/xT02zPs/
TLSH
T1B14404147FC00405C504D1705051CF507370DC50557177433CD304375CC75440C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 90b01af7c59289ce2ef04933ecb5c91acf9ed55adf42fb81fc2b5ffc6bc54b57
MD5 2385ae0ffd5ae43951e39577dc1c3f7a
SHA1 207a042ee340e6a0c0f4280164387a2ad2d50e80
SHA512 bf93cb1a28aae534708e9dc2ded5aaff854f6ec3ebc515b5156cffaf49d0f30b9fdee261e0254fba4d79bd0ef146ae2aa61876d1a6062e365ff9fc47d0a6d75c
SSDEEP 3:MsEllllkEthXllkl2zEfl+TVK/lll:/M/xT02znKt/
TLSH
T1094404547FC00405CD0010705051CF503370DC50575157C334D104377CC75400C50001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2b1713c22d18cca81f6af767c0cd1cce9a75bc56780898f677368b36db370ac8
MD5 05c0ef11ea820828ff86a857598f7a4c
SHA1 b5b579d81e16d1af729c34d721501c247766d64c
SHA512 d45cb7ba12d634ec4ce34e3f3b810c81aafc09ff26ad85ff995ba2b76460a0d8c0a218c11fc2cd3afb17fcc059db0a843d1a1a82d432b9a2018916e68c2fb42b
SSDEEP 384:nGiFiZcIBsNV8TUNTUlI4kvJNYRABfCGoKLMv7xbkySllYJTfY81FHDmF7IgsXBN:tFQB0wgkcoKKbkZuTHN1Buw
TLSH
T15AD26BB2DC94DABBFDEB6B95B7467A03DEE44163868CAAC0D9D85D1C00D71AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f7d76585ecb40b7488d74ef041d527ce884594db163978b5bbad0cd85944df99
MD5 83e2e1ef938036ab0a55cfc85a633966
SHA1 73235c9d573263b60b9363c5a1d63a885337bb5c
SHA512 87e9f397f067719501048029b4789c5e4b526c6c1d45399e66a3f9f18ce466d675e93d763d4dc486ca03dd832151e3b3b3e4ffa7a6e8150946e1dff6a3de8ee5
SSDEEP 384:nGiFwZcIEsNV8TUNTUlI4kvJ+cRABfCGoKLMv7xbwQxv9lMl13ySllYJTfY81FHx:tFOE0wgncoKKbfv9mXZuTHN1Buw
TLSH
T1C9F22979DC54C97FA8EE7B89A74E79178DE80237C5B899D8E7D40F0D80B249CE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d5d938e4cb8a164cc621c1a91aee46f0a5f21baf2ffe717071cfe6810578b4c4
MD5 1becc1f6795964f22155c208915451db
SHA1 464409fe734d792e277fef5bbe7a63c2c560e3f3
SHA512 2ed7484d80d38c15cdbc94cb1b8043fa06877e3f184f8bd47a73e9acbbb987957db34ce6a1b7838af27c69707144cb5733fb68a75152b865a05e62fe30d4e886
SSDEEP 384:nGiF9CcmyWCr3sNV8TUNTUlI4knJ3YRABfCGoKLMv7xgkyhF7IgsL:tFccpr30wgqcoKKgk5
TLSH
T100B23972DC98DABBFDE65B95B24A7A03DEE44163858C9AD0DAD96D1C00DB1EC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8f272e2217ac1eccc47ba1b52ab5e9c160cb09b404aaaa86d5f3f4937dea98b8
MD5 b5c8b50ca8eb129b4e0db144fb6a202e
SHA1 b3fb252e4fd7b41b90c60fadf204867b98981ec3
SHA512 84ed7b0cf6b531c24ff25d0cb333489c15a42336514a22e084ff0bf91dd7c7a1f6a155046586d22be00bacdf62ccaddd0097d917d17aa20d74ce8f68de3f60b9
SSDEEP 384:nGiFwZcIEsNV8TUNTUlI4kvJ+TRABfCGoKLMv7xbwQxv9lMl13ySllYJTfY81FHx:tFOE0wgwcoKKbfv9mXZuTHN1Buw
TLSH
T13AF22979DC54C97FA8EE7B89A74E79178DE80237C5B899D8E7D40F0D80B249CE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e29a64755e792bf641c83a423951df3b2116f7bbe5effaa25fe0b4a3d134dfa9
MD5 d07fc2ea83e020a164d57abc3c5ee2dc
SHA1 5e842125fe1951d30b3c8b2bd40b14e513363851
SHA512 cdc1459356dafe8c5c91dcf1f8e11429a200dfea86ec913434b73ace2db152050f2f4373d0a143818ba284fcc3d981a7aebe9e6b55bc794d24c5e4a87cd2effb
SSDEEP 384:n6iFwZcIEsNG8TUNTUlI4kvJ+qRABfCGoKLMv7x/UySllYJTfY81FHDmJxsIzsXC:xFOE/wgxcoKK/UZuTHNvBuV
TLSH
T165D26B71DC94D9BBF9EBAA85B75A7603EEE41173858C9AC4D9E89D1D00C31AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8a8e254d8336a6e213e753e60671def6ee8407de5b7d2522dbfd7a3bbe686fd1
MD5 2cb9c99df0e96e65180e253a5f074e8d
SHA1 821c317bb8a1dc4307dc0caa9ffa62a048ae0cff
SHA512 eb96902f6960e826f1a27aa90b4f2b24cdbb4c17a6580327b227e89947213619cab47f4a5866704835188631b9d78b6c040da86513d377307b0fdfd2acd723ac
SSDEEP 384:nfiF9CcmyWCs3sN/8TUNTUlImkrJ1UJABfCGoKLMvC7LhkP+lFYS/C1leF7Ig9:qFccps3WwgCkoKJ7LhkoFYS/mC
TLSH
T186B25B31EC98DA7BEDE64F96F64A7A07DEE012B385989AD0DAD81D1C00C71DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8f39a912f339ef5dda65a29ba4246b7c2ae607293c7ec975e83b7c935aaad7e9
MD5 7dd08c6141b9e4204885bca6b9606b3e
SHA1 b91d9bff01c5c5b3fd84c4cbab7a377e6e2183c5
SHA512 a131ba125a1a43368447089da8c007ab11d648b80931583db775702813d2cef75d4003724461b583f9d8e6060d62acf582ca3356d7063b8a60385f405b9abb51
SSDEEP 384:n9iF9CcmyWCs3sN58TUNTUlImkrJ2OSABfCGoKLMv7xkkhkP+lFYS/C1leF7Ig9:0Fccps3Ewg1boKKkkhkoFYS/mC
TLSH
T1ECC25B31EC98DA6BFCE65BD5E64A7503DEE44273868CAAD0DAD86D1C00DB1ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b0a60c6236b38969e03d48a31c5ce4764d02cf459b42f172e6a9c1cdebcf4b5b
MD5 d9e8325388e3512d4a9b396a64f087a3
SHA1 026fcc3e72dede8fee2b946eba51873ebb0c6929
SHA512 4b6df3f1046f825dcf0810d2bd7e3e5151b9af896e097f6763b0764d676d6e481d6f23bbc7744eaea6ba8f2841ca380d158e305129252f3d2400b5eb4b23e6e3
SSDEEP 3:MsEllllkEthXllkl2zEflvVK/lll:/M/xT02zDt/
TLSH
T12C4404147FC01C05C50030305051C7503370DCD05D11574335D10C33FCC75511C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 9f8b486a90a61c1080c5a4a0dcc3dfc61e19308cc5b1c6f2db7e58eac7211898
MD5 9c3e7d24a7b92e1d982a4b9c9c5a13b0
SHA1 66cf6077ec8eacdeebb354c26983f2b5f0d2ed70
SHA512 c518eb66d508f1d3215bc3b32d8640eac11025eec8b6c82284d75a5fd36b6a3c7c7eeb3de28de2620fb2596703dae637ee73569451ea02c25a323fc28569013d
SSDEEP 24:94ZhC5f5qLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwe:Zp5qp/IHRH34kWqB1kQnjhHmr6ITmUJ
TLSH
T12342766EDB2CAAA2FEE00B3ED7D5D4127B36A60EC2E4D9F1095B505746C440405DB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 987b2c570ff2fad8debbaab1daa58e7bc92e86286cc5ab6fee0e528853c44919
MD5 56336e1c042501549177f5fa4d5f4781
SHA1 dda278a32fe03906f3d959c6291c086dc8ad985d
SHA512 a438418e33246b191ace44df887ceb67060c2903c73e73bc3633fe2469178cb93e7c7dcd03f0dc2695356592141b648d0d8b21e97867941cdc53232a2484684d
TLSH
T15141D55CB6E91148B3B76E56AFF6A86E487F7D372E06D45E00110E4E0B62A40D872737
MD5 SHA1 SHA512 TLSH

Submit Download

8ac9c7b9-f8aa-45cd-8ead-e04109f7aab1.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ac9c7b9-f8aa-45cd-8ead-e04109f7aab1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 5fc52cf6256880a3bfe65b42c23a890be42d050af82a94fff8e9ed4a5b1c44ee
MD5 6b48d77608f0efd28ab03502f61b2018
SHA1 36c25a0c2990dfdadbb346c9d6d2c781464e35ce
SHA512 ca3835f174eee9fb15e658d6a47c129ea965fd9b6b4e0fe06bd833877ce99d4ff8fbb10ccc18f5d6a52dbc73c9135a63b78f1ef6d5a9c3e3e2a39705f1679b16
TLSH
T1AD412BE53935A23F5BC787C460754C849560F181132E9A1CAE1AC434BD6CEA2A72E7C5
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir948_317024045\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cool Antivirus [FREE].exe.crdownload

Path C:\Users\Admin\Downloads\Cool Antivirus [FREE].exe.crdownload
Size 346KB
SHA256 8c5dbcdd9e4aa7b0844340861bfcf6e3708715e0d16cff0f06ed60ef60e4a25a
MD5 fca99cb54941abbaa7970358fd35f374
SHA1 47cfd74a5c6e94c26f80e32d0e89fcedec4462c4
SHA512 fa0f2a871110d0a806ab3e8308744e8827eb0d777b82fd44bb9cc983408f7520cc4561113377b3c856a9fea73ce7a41b559ffa4bddc8d40d59b9aac14daa56d7
SSDEEP 6144:l/g2/N7hu2Vm/jgJL65cYT3ywMtNtv2ae5hOIIiMveqPc/86rHv3R36wkxkH0:l4cNU2VMcL65cYjywMt/vTGhDIdvHa7V
TLSH
T167742344ABA05B27DE7156F659684021AE3DB9588C1ACB1D8869BCE64F77F000F32F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-773-0x00000179D93C0000-0x00000179DA3C0000-memory.dmp

Download

memory/4556-218-0x0000000000010000-0x000000000006C000-memory.dmp

Download

memory/4556-219-0x0000000004F50000-0x00000000054F6000-memory.dmp

Download

memory/4556-220-0x0000000004A40000-0x0000000004AD2000-memory.dmp

Download

memory/4556-221-0x0000000004A20000-0x0000000004A2A000-memory.dmp

Download

memory/5788-222-0x000002861CBB0000-0x000002861DBB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads