hxxps://cdn[.]discordapp[.]com/attachments/1426979780724658392/1510436828468088882/MemCleaner_32[.]exe?ex=6a1ccf6a&is=6a1b7dea&hm=3de0a0c72bf0ad0beb162f9c5511aa27cf0f8c4fb1ea15bedbd215d522a76ef6&

Analysis

user interaction
yes
max time kernel
2s
max time network
13s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/05/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1426979780724658392/1510436828468088882/MemCleaner_32.exe?ex=6a1ccf6a&is=6a1b7dea&hm=3de0a0c72bf0ad0beb162f9c5511aa27cf0f8c4fb1ea15bedbd215d522a76ef6&
Sample260531-ak55psft41

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	4912	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4912	msedge.exe
5764	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4876	3720	msedge.exe	84
PID 3720 wrote to memory of 4912	3720	msedge.exe	85
PID 3720 wrote to memory of 4400	3720	msedge.exe	86
PID 3720 wrote to memory of 4816	3720	msedge.exe	87
PID 3720 wrote to memory of 4400	3720	msedge.exe	86
PID 3720 wrote to memory of 4400	3720	msedge.exe	86
PID 3720 wrote to memory of 4816	3720	msedge.exe	87
PID 3720 wrote to memory of 5484	3720	msedge.exe	88
PID 3720 wrote to memory of 5484	3720	msedge.exe	88
PID 3720 wrote to memory of 5084	3720	msedge.exe	89
PID 3720 wrote to memory of 5484	3720	msedge.exe	88
PID 3720 wrote to memory of 5084	3720	msedge.exe	89
PID 3720 wrote to memory of 5084	3720	msedge.exe	89
PID 3720 wrote to memory of 1996	3720	msedge.exe	93
PID 3720 wrote to memory of 1996	3720	msedge.exe	93
PID 3720 wrote to memory of 4248	3720	msedge.exe	94
PID 3720 wrote to memory of 4248	3720	msedge.exe	94
PID 3720 wrote to memory of 4880	3720	msedge.exe	96
PID 3720 wrote to memory of 4920	3720	msedge.exe	95
PID 3720 wrote to memory of 4880	3720	msedge.exe	96
PID 3720 wrote to memory of 4920	3720	msedge.exe	95
PID 3720 wrote to memory of 4920	3720	msedge.exe	95
PID 3720 wrote to memory of 4724	3720	msedge.exe	97
PID 3720 wrote to memory of 3124	3720	msedge.exe	98
PID 3720 wrote to memory of 3124	3720	msedge.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1426979780724658392/1510436828468088882/MemCleaner_32.exe?ex=6a1ccf6a&is=6a1b7dea&hm=3de0a0c72bf0ad0beb162f9c5511aa27cf0f8c4fb1ea15bedbd215d522a76ef6&
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffea17bc188,0x7ffea17bc194,0x7ffea17bc1a0
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,13153279998000398808,13752966435683703899,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,8194455061007490999,10133703593609493497,262144 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,11040741159513276774,16620540979900367900,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,13336290075771161597,6004019794439817871,2097152 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,6930234515134584803,17574885457597028342,2097152 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,9022377781399148300,4191406062261848905,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7032915939297444536,2498861231155386933,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5552,i,4400077300788386038,1880461179822590209,2097152 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,13130097223020459326,16087999975469112551,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9289086173756544630,12795071116800192494,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,6276178304335495051,1893606786791719664,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,16750455726059245029,6435093400682963831,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,16750455726059245029,6435093400682963831,524288 --field-trial-handle=2320,i,14293542620944119120,5540559338528334967,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:5628
- C:\Users\Admin\Downloads\MemCleaner_32.exe
  "C:\Users\Admin\Downloads\MemCleaner_32.exe"
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffea17bc188,0x7ffea17bc194,0x7ffea17bc1a0
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,4592709867194957405,7801722416204312560,524288 --field-trial-handle=2172,i,12253321691043677586,3366929331378950318,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,12289831704722700850,10150647357440603814,262144 --field-trial-handle=2172,i,12253321691043677586,3366929331378950318,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,7090316087329996204,13773063613869980805,524288 --field-trial-handle=2172,i,12253321691043677586,3366929331378950318,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,11676791835160262323,11715561529276014,524288 --field-trial-handle=2172,i,12253321691043677586,3366929331378950318,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,11676791835160262323,11715561529276014,524288 --field-trial-handle=2172,i,12253321691043677586,3366929331378950318,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    3⤵
    PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2555f8f2cbc630b9fbee53e445505f585ae832a21fab9515ba9ef3bf0824f7c
MD5 f022389c029a61beaa429c58a0579715
SHA1 232b60f516e8cb8a4fe3f4e553ae2fcfea0932fc
SHA512 07667a930112f289a21afbc0d41df6b2798622b6841108a494ff1330fecaf59efbca3bf7f9e9c2995998d5d700be535738d13bfe1bfec656f1105def16a8b524
TLSH
T139D0A7586FB6A9C1E2F8103E27A44B442B8C5D821645255807594C244DE10A354C1AD9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59a8c83b38f78a2d8ae75e2582bffa91e7cf628dc01be2a04735e07741e2bc5d
MD5 9c6bb5a69aa5ebf6e2b3c46211711fe0
SHA1 142d6992688c7b12c0f8a72c42161073c38db93b
SHA512 abe1ca07402fb07fdc078f4a0df3cadf01a5b724da085db821c4f09f8adae23753fe7576feb8de7972c12da5835db44d724662a030500271e3c1df89b44eee2a
TLSH
T1E1D0971C3BA26881D2E4143B26888B882F8C5CC054802864038A0C100ED246240C48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 21785e55651cdf2ae111f42b885841a4d32eb29dc4b2661b61afdc49eab2bff5
MD5 8d6b45e05238215cf7cc10f4ffe5bd87
SHA1 eca12752399bc8c36fb28c86b44b09f3746ed784
SHA512 b724b6cc3a98ac5c60761482f4fbe02af9083672d62ac4d3a304d30da1ed5329ba316100bfe15c13d61de4f1aef26eca413ff95a39ebd50abaf3ec498441c1e8
TLSH
T181D0971C3BA25981D2D0143B26888B882F8C5CC154802868038A0C100ED147240C48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4479a36b7b992bbec7177088f2e15db8dffdd7e78e85279d2c83088a29343e2
MD5 03578bb8b6e22240ff9f962052e3bfd0
SHA1 e88cfa2a99ba4cde156cb76df3c1e5e4d0f31844
SHA512 14b486114c608d9c481d03eaacc4af4e96cd2250b09e5c1fbb1fe214e6bcbd9291efe72cc52c99c5a4d7d0533399a4d773de86fc6cc9233bb147b5ebe349bec8
TLSH
T177D0C0333F4AB000E2EB4132F363C740337D04A12C824604A25CC87C4EF00C022C22C7
MD5 SHA1 SHA512 TLSH

Submit Download

9a2b3eee-16a4-489f-9c4a-86d4f5fb148e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a2b3eee-16a4-489f-9c4a-86d4f5fb148e.tmp
Size 15KB
SHA256 ca8d9905c7ab8a318e3a8403a64d40609e5f56d4210aac44e906d52970835671
MD5 0e8e25f56fbcb90c0e7e11497c9cd81e
SHA1 9f30402f7fcb2ec139f71162926e10d759ece1ac
SHA512 a018b744d25fe445acb8e8f2976b28c822664eac38eee600a39658b0e70bb30e8d47b90b14314a52a92c7fdc6edd0834ff94faf2b6f204d096dfd86a320c041b
SSDEEP 192:sxZpRtyMqZjK1Ml879v/ffsmzWpVLKOCZtJNzodpLHW6+WNGYq6aXIgZ/J:sxZpeQv/ffsmzWveOEtJGLHbGJZB
TLSH
T1FA72D716AA38997BCCDBD609FA457F53D7F9552392904E4499FC8B0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ffa333a4bf867a9b199ac69d793c5e1cecebcf158f8f1a5ab335d8f010aff0b8
MD5 c677e2110464fb5eacd23412f9d94d18
SHA1 495235884619c0ffd10600843393265d056e8922
SHA512 50e8c1ba0a0e2917ba3fc33d8d25a58f7a5e23e97803642f71f4fd67ae3d55c5d898de4039a2c252faada2f2e191df2b4ad96be08e0e634cf71167a0e92539b8
TLSH
T1C8F02DB6CA31AC2708FD0B1920940F06FB9013572791844F7B3D530D8FB463B4696C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c1f6e5ade14d5fb8d90d3aa2013bce5944234c57609db3dd41121ce2b4340d32
MD5 5431a2162b0d036e451ade2ceb7b894b
SHA1 54fbd4575f519dc4e48dd76f2c03f50a5d1a00ec
SHA512 7b5def0a3330d27c82bf7a2878d609cfd4bb8c48fd76781a4fe51cffdd8dd08220ecd35e23c2e94b652503ccf315767dd40c208165b45b57c9747fcabae8bdda
SSDEEP 384:YJLj/JgSQd1Nccu3C/CJsd+BakgtRs9GGAzwZsc51oFA:Y1TJgSQd1CcUC/CqGgti4wZV4
TLSH
T1EF13D63EB6504DE7CAD65EBEA91F6A31673ED876C5C0131B333238810BDA31A185EE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5d9b71008634a95bd428675bbfae38e8c1028d9168fc70be494792a6e5fedff5
MD5 b260fc7a05d2a56fbf969c61564481e1
SHA1 54999164e2679049fc9b7fd040542ff3906594d4
SHA512 c32cf81167f9993c0d02bf42e0ed76a75db71656b383517dff06a5eaf557ec17d1d590efbde5adbc0d247b7f156d5a7d90184557c08139f6afdf26761bbcb0b4
SSDEEP 3072:ML/3L/X3djK5wXL/lL/8usCNrwE8gwgY9j:ML/3L/XthL/lL/tsywBR5
TLSH
T16E446FF71951A05BCFA842F5D2033A3DD17B055D2DE1F9EAE63C0C852825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 bb5155acbca2c6ea2fcd170b52d266d4823e1acb73a02ad9592b55e139d27397
MD5 8c8e6102798baf29c22b06e5664ffbb0
SHA1 1d3867468265b95e25711f23b4d7c60b8c57e1b5
SHA512 7d70d5419df93b3e288c9f67e1e83479b80c6937db3b88444d21b1e08f534db9ba679a6836a1e90d943991af3c0fa05c7c91577995a893030dd46bdf8e4871f5
SSDEEP 3072:qDfTTmSH7gu9qa/5stwFvwH5WUc6UwHX5mv/w05rZhTMrp:uf/mctBu5OPwHX5I5Zhcp
TLSH
T1272518EECB682C92CE6B877470E0D9077E712183B68DC0D39944C5D897D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 7ec1906b2a5c6bef8dcac0bb6a99af45d96df03b2a187b92295b13492ed8f2b0
MD5 c6e5da87e19172a05da6e70ca49e22ed
SHA1 9242cbbf634ffc236bdc9ec5196a8fc1baed80e9
SHA512 88813a3da6478f2b1ca90c5c3aea63e14dc4ed4aeaf7e81f9c1fbae236cf8249ca4bdbc20a59246107b98dd7be5b330b0796aa9efc4a763b2db053525cb23731
SSDEEP 24576:pol4Y+/c6mNo8XzQgW+6Trwmt0QnKlnduOy2IONWW+dWZncmYLKh4O6SJOZW:bYaZmNW+MriQK5d16ZnkchLhDSA
TLSH
T1DE867DEDCA6898C3CD639970B0F0ED477C7413C3F995C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2ed60aaa9fa6710ed81901496f95b007700e471b37751093aa21e3cc0c941bc4
MD5 e23248c2f64f471eaa054e3b88db74b5
SHA1 c317a1c05384f84239a57dfcbfcddca019f12362
SHA512 eeb48e4f6d993d861813505585d362e181b5c71eb2e4894a7a5758c63c6a0371d5fc3aa860a84aafe4bb38f781ed06c84062121e2a404c9781f4bf7b4805cf7a
TLSH
T1F87185A9058043E7E761CAF192D2FE4C70B185757C23AE392DD064B93E80711BB7EA78
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 739f95a411476a2dcd6a124cbfe65a10780b8d63f52e4459ff800579acb09773
MD5 5ebed01476fb12e3e9693c13b336468f
SHA1 8f3a58c67ed8b4a9914e1eb4563bdaeb4d101747
SHA512 5b06b267d396d2475321ff7ff0c6a66249dabbf74e33ee16934cbaa0377ff5ed15002b663d521dd0ec93dc0f973ae4331a6b6058cb738a9f4491cdf42110d8a8
TLSH
T13DE0DF9AA6CBC1AE662038E786247B58D2C53487D7C96D431704C8C8B607019B3AEEA6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 63630a5543fccb1fea484543846fecf21f7d30a27777babe7b136127d3237a47
MD5 ebeb9b9495906402f0c5503b946ec94e
SHA1 b9beb31570299ec469683ffc851924f3fe69147a
SHA512 4fa503eb2a11847cd28f9870f83794fce0fdeafce019c456e6fada491c89b64525aba3f86788de9e62c2d5249cda161012f262ef724f11ae9056176d6af0ceec
SSDEEP 48:Tii+7f+UZD4jJ/BPWxmfkWxG8mCWm+vyIt+FpyH:2LnD4jJ/tbknRzm+vr+Fp8
TLSH
T12CE2FE8D3A12F912C4ED733FA1C585E05EFC687D4A497131563888768C639A2F45E24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 1c9890159e0e1a62075d2d0f42854f94f6bdff678e1c3e0e5fd2d86badb5064f
MD5 4162eed09bcbf7181d09a7e33596bdf8
SHA1 efdc7b96c4a195557e5623849162e58bcc051547
SHA512 39f3c212424f879ab722b45e36bdf643848ed157effae4a4c67cc00e45a558de50c7cff616cbc39982060148e2b3d4b9ac90c68d967c5aa55d70fc7791768feb
TLSH
T1C8E0865504CFC129A275A8E3C77CB318D2D63646A6D83D0A1709DC487109649E7BE691
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 83eb881563fa1b3c966c133822b2b76384b89e65a29aeffdeed8b89c76741de1
MD5 19314755be5d8e817d7aac086791be58
SHA1 9c8af8c3ea948cf4536076f278dc2e7a6e1d95a6
SHA512 3ecb244923e426cea003d04c916dff03cc12f0910ac551ab0d006de817267ed385823c41c584fac715c4f3b9322d0a4e1d122360559da022dd67d1e82b3adf7b
SSDEEP 96:nzBv5IU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+M2:nzBv5f+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T14A14211F5F243321CDBD817628E744A35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 1397c8b4b29ed60143428aa096283fce728c5f95f4ae8e1651e71b439e1c4853
MD5 34bf68ac721048c741b028f5077d1263
SHA1 d8f10c7d2dbf25573121235bdaa25963977f9450
SHA512 8d35fe9cfd1cdc4379b24ec278a8e6f6a0fc61d0019576f639c273d1dd988167ad627d5075d9e28ddac21a4376b383b4903ca3ebcb5297749f1ac71e4dfeeae7
TLSH
T1EEE0206146DEC15D532464C7C334B70DC3F0740ADAC97E015B04ED68B081108E7FD9D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 4e4f4449cb3a2c714a6680c35c3c5fc3130f2a474ec168ef26b8102ca3f2409e
MD5 44a0915178fdccfe034f228e1adf8d54
SHA1 c76b4747e7892e1516abf07c3e48b108e20c9c20
SHA512 3c9f1f2577a970d7afe58a496cd75d817efaab8a6b5578c332d8739cee37bd7b237a0a12c7f06a1c509e799a157530d7da0c91d567b819f5906a31a03e9ece18
SSDEEP 48:T2SLopFMatSaw/auUOt8BmoSAAAkyZZ+o8wQCf1HbMPwH:iSeMatUaAKUGiw1bEA
TLSH
T1B792820E5F206221C1E56BB3EDD084962E7C121CC3672A8AEA0460F38DA369FF1050A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0cffc981538e93979ea0d3b13082ed04e866d8a76690a1b399993b72148364e5
MD5 285e4ab33482487443f98617387c8225
SHA1 11dac0b0631c195d860b82f936137b31c04d4838
SHA512 f19ae019b12bb9c179d69d99f72cb040ed38ef8a6dc9b36597312bbdfab1423aecdc648def0255265caed9ca5a1c9f5bae097b668c9afecce1597d904b35a829
TLSH
T1D141ACF7C3E8866EC90156F0BA146E2BCE2D0914436C3D5A88E4AF5B97E3471E18194F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 5c9f406beac81c29051183137597e35b2a68f0578f72938ee12e75f9314c3e64
MD5 e3b5ae4fe338452ec1f3e1a809319d3f
SHA1 c84f9fb2c7fe1d0a837bebfd046473412444a3c1
SHA512 d08c82e9f0b791e35fa1fd4d67d24f86cff33a9633ac20727454018d2c0f54c40fde7d9470fdadfff1436b9534741db2df237fad6c70a04ce20660f92c4f8fa2
SSDEEP 96:eIEumQv8m1ccnvSXhCLcvfRhhnFKIVq44g:eIEumQv8m1ccnvSkuwK
TLSH
T16DF2D0FB06275206C98444B0A404AB8FAF16014B47B6B6ED66D487F3F7A31E3F1A9746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 c44c2d3b7c9d60948b614136d936ad76462a45c591c51f172c709b8d07addd5c
MD5 bdc19287f6179d3ced6ccbfd177fb167
SHA1 312067601554b7f47956ee2db8964a5f5568ddec
SHA512 e23870b7fc70e8a27a998c2a164a3a1b0877e983d3db8f8a9a50c08385339885071cb81c2f65734747312205dc4666aeeb0180c5c0afb9cbeca64699e7862bad
TLSH
T144C0222AC0B8E03700F884391AC0A8806A36D830008044E0E895937CA4900FBAA1702A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 54c0d2908abc4f801b85b15ee8bae010f11a8de4cdf1b0543cf08b176dc281b6
MD5 d3f15e771fa2b7ee6da101fd50f53aaa
SHA1 f4dd6abeb047243724c34e7af3a92d56c175d79c
SHA512 6443f2bae428fc28edca3e5f5ad2341b1f8b05c62bec17d256e37d400a9935c3cc50b0499d165622179a10cdbc90d95f7a2539e381fc4b0d6f7b1a148005194b
SSDEEP 768:+IM2tRw7pLuLnF5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyf1sLl2cNV9roF:+IM2tR8EnF5WvF32/u1jajf1sLUcV2lX
TLSH
T116F20B3B6C0CCB7A4F844E9CDD2A6E8A6DE8018FA6D8895487F9484C03C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 cc9027e15399bec466aa4d800d079e0542462d2121ef3f271b597ff04555cb0d
MD5 a0b771e417ec1898548905d3720c3a2f
SHA1 bde2960b1d3a2303f25101c822343cea2eb55583
SHA512 88b18212f9cd7e58f9c0cd2e8b18cd172a9de046ff4663da50f975b30763a10dcff263b770235da41f78a7ce67dfdb3ac522f088334528d961bcccfaa1ac51b1
TLSH
T175E0269905CFC17D61A960CB8735B34DD2E97407D2C83D022F00DA98B58360DF3BE590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 8bc5ce320f8f8d233f13524dc462aa25881fdd1534f20b3ae59e54e1cdd0334a
MD5 3f8887b86840190de68da3ee6c6c18ee
SHA1 6ad06c46a5456157e22a1a27c873324cbeb87633
SHA512 ec7869e4bd937b646805a861b3706b5fca8d8c9fcc65670ebfa920502ac2ffc1d47c6b2f1284413629615c1ed532ac79f320012b066a80680cc7fcff4d07daf2
TLSH
T151E0D82455CEC32A625620CF9765FB18C2E2B406DAC8AD523B08F9487247144B36F991
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 f9587ecedc0817e39e7b1b411fbaff99e7fa5470917dc904e813bcde466aaf9c
MD5 7f2c11ce41bf398e87b4a529962364ee
SHA1 1aa2134e19705f7802c86a654145d373b3e01eb3
SHA512 08b93f5cb6d357e39d672ec5d2744907820bef1f0bc14b4bfab9178ad6d3d316ffea5350635a8264e3a466299e49f697625617d6fe8bbf1aadd4d8e5d9511f26
TLSH
T193E086B545CFC279521860C78B74B74EC2F5780697C93E465B089498F502158F3BFDD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 30ee165aa40fcda9f7387b8557b1eda1e19c0f41c86b0526eb1fa19b1c14b6e8
MD5 92b293740b9565aa194eb06268158c48
SHA1 fe9c3b8d8a2e3d1e2a852ffc569c2fb89f43c277
SHA512 0fa3ca33c3bd7b723ee1f87766e657ff36bace8ea64fdecf84a6fe5ef85d2eaa8cf6ea51852dbdef8386bcd97f2d8384502ecacbac24999cb1b8a414b7e7a239
SSDEEP 96:KMkAKd6OezWKEADWcKHqy6UgKhCK7+Ko8iq68K3qYKAKjai6oIKp+SaUKXquWJSZ:KrFjPXY9/gfrWThFLh/DNTVlff5htlZ
TLSH
T17DC26E16303B12423CBD6808A7E6D6778E8231B37119E66F7BA804664E67E125DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 78b4ee293ea4403574e7cae164562f5cfc38f92b517ce71bf4ea80a4013f14fb
MD5 f7fe4e35966fed573f71899f3c578040
SHA1 02d39cb1d993facdbc4a20b10fa50cca98d2e25f
SHA512 886a57b6dec0f816d98c2ee37eb81279676569db92996e9e2bee3da1c9f6643f872600a882549b1715b140218545f50105e48581b7fdc2c2a28b75b9d549e057
SSDEEP 96:KMkAKd6OezWKEADWcKHqy6UgKhCK7+Ko8iq68K3qYKAKjai6oIKp+SaUKXquWJS1:KrFjPXY9/gfrWThFLh/DNTVlff5L
TLSH
T172B27F16303B12523CFD6808A7E6D6778E8231B33119E66F7BA804664E67E125DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 4661c6b7191efd25595a38edf345179c03a9c2bdfb2bc2f5af98d6cfef18e69d
MD5 869c4c396d9aaf12f04873cd3f75794f
SHA1 04bfc6d360fed76182f28b1520f70caa8fafb0ad
SHA512 661bf4303ff66a60fefde86fc447c7d7ff4a6a40ca94d742ce8c5beb00917c1a8e7b82d9822dc1fe4d4e5c8b8d8d0fee3fe97d88c52ddf3b6587a632fd48d7cd
SSDEEP 192:P+xW2XefT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxbOfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1A224840A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 3KB
SHA256 8fc9dabdb8bc8dc24e7c95132c373edb1275b7254d7ddc46f49a78d37e3788e1
MD5 51ac7580e6384572858af09c3f26db9b
SHA1 bd7e7e280108f372cef9f7fdac8eb0a5f8053c1f
SHA512 53370ce7c2c8c61005f2493cc48ab3a07dd129bf32a33e14402ccb400059ab5558c6460d2b9083fad04a6f731c7c953b3556684cc1aa1d3c520408274e737983
TLSH
T1977187C1A3A914D6EFC9A841C31A9513ADE13E77220EA875332E84F44F84C254F3FE65
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 5a50a71bb4103d354901bb8725292bbc32ea4d452e4ee4ec190a983e84232dec
MD5 90c67d7a6188d35ba76a90ad1999b016
SHA1 498e2d4708e2d2871ab3af615e6c75e2ccf1bea6
SHA512 6af976a6bdeeb601fc3472699fef092226d5dfd2d52c8aed86351eddcbc4616ec2adde19c55b7162cc08abcd13c94ed80b2b1b4f0cdfcdce9058ec2101747f82
SSDEEP 384:b7hsjB2sy4Q2IIIBb5MIMiBA2eB2ew2ez2e3:XqjBy4QS2O2z2C2C
TLSH
T14D72B56B2B181737C28F5FBA127DCA6113D9EC814965266E30A1281F5CF2E3787C45FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 5382f2b16fd0e5703090693f53c47694190ca5ad88284f94482ac0ad453a1e09
MD5 876ea4d6088e80b041df24a2bcc19e3c
SHA1 7498f13a819d14298faba10bd667919cfffc750e
SHA512 4dc4e9d438b6b3531c9993266b1125cdd7b965d0171f5be01c6e9629329ce487d17346dc7e8f3cf0fb5940ce80aad7672bd0c541134609fad7e9fcaea97c1d20
TLSH
T1BBE04F52AACEC16EB22530C74A78635CD2D63A07EAC83E461B08D84CB205148F3BE992
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 d7c902034a2fff4b7394b48ad424278cbdadd29fe6306d0c49c24c8e7fd31c82
MD5 a59c2f423053653a96b0498edd908506
SHA1 48e02d72d943374f90fb279afc484b924a5ae357
SHA512 521c3a2636fb42a5823053ebf7fbef85490032d48395084ee1f07184b5f2549100027ce9ce327506fed525ee813de8d99216f90055dbcff7fb43c8a5e1cfc90d
TLSH
T12021BF56F320C258D14E973DA02BDB391338E8068FBCED0F957920256E75E001E8B6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 41065bb8428471e8bd5f9878fab3130a9afce62413b895e4eca0b92505ca7b0c
MD5 c440601b51d673dc0ed1b75fd2479960
SHA1 3b791e6a238ebfe79415d33937882a77b70dff88
SHA512 dfdfc47372a04fbcfa0deeae6ae86e62d50294bbde56e3e8b9614eff4928b711d0f7f64da66ef1c268be0c869cd209762a750a094092e16fb59afbed5ce8aeef
TLSH
T12FE04F51B9CEC1AFA22530D34A78A35CD2D63A46EAC83F061F08DD4CB605149F3BE992
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 0ba19933c634344f3652353994f691e9b1902300b294d4a019df2c3942d37104
MD5 d711d8ff535a91843b94612a59c1aa24
SHA1 f82567c560f12217c75c3117aa233f9a3fcfe023
SHA512 143f37d1bedef43ab1246f4a69722585d576b7e4ff5a65e05dd062701db27b446e70d0a7db01a941794a6539075f75d7042fc2b87cf2d8eb9ecf0d882428f8a1
SSDEEP 3:MsEllllkEthXllkl2zEfl4/:/M/xT02zR/
TLSH
T1AF4404047FD00545C50051704151C3513370DC70055177C334D114337CC75451CC0000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 952cfcf39646637777366569b9a05848e2cf6e98e3f3fbcf0e61a942e5ebdd06
MD5 dffbbacd8dac16eff9e49d0268ab5c71
SHA1 35f73f9fe73116ea76729060c99c18e936aa1458
SHA512 6040f6cd45c2a95e34eb6b6cd46403b91919047cbb452bb623beefd073ff0beb2b7368931d5826e3448409e1f79aa250ec23dc40daf98c757b68bbce4fe1be6b
SSDEEP 768:8F1jZbC8wgXeGL1YMEn7954kAjygRDhw7:OOUYPJO1jygRi7
TLSH
T1CBF2393ADC54CDBF98DE7B89A34E3912AAE44237D5AC95D8E7C80F0D80B759CE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7b557e7e642c0b68b8e8e5aeaa9492898660344d0b448aca10699188106b6674
MD5 5140dcdc9578a12a0c26f6b88839d523
SHA1 8841172eedf4babf0398db7dd8eede4af1355811
SHA512 7fba3f39f5e150da80ca9441b79d677404e03c101ddf624a1812c62fb37413982aa2e1538d3a9d8a4440fa683437f9aab2db15345b450e4d1316e4a1d5f32782
SSDEEP 384:n4iF9CcmyWCs3sNZ8TUNTUlImkrn7fWmbmiBf+UGCc1v2PHdFne4KV8p0aLwty/o:DFccps3GwgNFGL1eFnI8p0aLa
TLSH
T167B24B36EC59CAABEDE74F99B74E3A03EEE0116785CC9AE8DAD85D0D00971DD0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fef54706206ee4a03bf59f101adf7fdd7c1f7d47b7d997d371a94656434306e6
MD5 b1cc8917cde827a82809db0133c37979
SHA1 3b87e9e1d7b151985c33884b3b980a272c54149d
SHA512 6b7cc1adf8de7dc42344fc409a71ed648e201ea3b318f7f595637a0f99df4f1c6f47b704f512bd55d75f4d45f1b74f7b4b553b6ef1572ad2e1147284731ca8a1
SSDEEP 384:yCiF1tNnNnb9b3sNL8TUNTUlI4kHn7fWIRhiCiBf+UGCc1v2PHf+jEkB872+sRD2:8F1jZbh38wgbeGL1YMEkygRDhw7
TLSH
T19DD23932E864DAA7EDE78F96B34A7A43EFE4025785C85AD8EAD45D0D00D72DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6ceadb2cb0e6ab3c4cac36a7e9b2546e5f34419316bb412cf0648cf8e6fd253c
MD5 d711950c851fca33d7707bcb34c10b49
SHA1 1832c24b0810c5ce29dbb6762860504a29efc937
SHA512 cffd38f4e3ebcf4203cd5f857ca811e84adb254b7f98d0e016c6c44cc89e69186b071161d6b5ad15f0d525723ba9576021b569364508e90ee8febe14b4f6ade5
SSDEEP 768:8F1jZbC8wg0eGL1YMEn7954kAjygRDhw7:OOjYPJO1jygRi7
TLSH
T1B2F2393ADC54CDBF98DE7B89A34E3912AAE44237D5AC95D8E7C80F0D80B759CE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a8fb536c4b5af1c5f070127b068bba0e917a54cfd23a1af706ad1159d6607047
MD5 5c53d67a88824eb0cd28d09fd3ad5ae3
SHA1 957968a87456eee708954a9d2a6c5e959cd154d9
SHA512 bef24b01689ed79c5097e65fc5bd825d7b0e8313540681fa442cd182aacb4af23c00f23be743e19f8ec18b9bc5c0ed296f471f5ea8f229ae7ce42faaedb65613
SSDEEP 3:MsEllllkEthXllkl2zEflO/:/M/xT02z//
TLSH
T1F24404047FD04545C74470304151D3503770D4354511574334D104337CC75540C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 4cdcc4d52f9d2720c2fc6a5bad0eef484862ae7241e1a7bf923b84b99221ce89
MD5 4d29e8a0a328e49af86e4b107805e388
SHA1 42878f9a3eac5ec6faeefbe513f75c0c019625be
SHA512 f214853e488180473bdde6ff03bdfc6336db8a56e5aacf67fded1c646d5c4ca54c5d0c1da293be240b2a0ab15c943f7fc03498d2a8d90da4d86670e0d8d968f1
SSDEEP 24:d4lhC5fTxvqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwa:5plqp/IHRH34kWqB1kQnjhHmr6ITmUJ
TLSH
T1EF42786EDA2CA9A2FEE00B3ED7D1D4127B3AA60EC2E4D5F2095B905746C440405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 420b8f989303eda6dddb67df7560a2674c33ad8514644735b97847383c5f7684
MD5 5445545cc6546700ca554f6cc197cc56
SHA1 300481d83e524012cd1d32d56ac24e56af30a62b
SHA512 db96c4b7699f0580ef923c3cca36ce0680a2e26d056f8eb73c8337d8014a47af4d13ae840513bc9bef61cd822a0510c5c6260196ca261fe734d6ca59a7ae8042
TLSH
T112412658A6FA114CB3B76F16ABF668AD447EBD372F47D45D00110E8E0762A40CD62737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 12c7ff626b5920f57531729adb04692bf66a62a6645561bcf56f3e221b42873d
MD5 24fe92a512c7133df72b0b494ac15bd0
SHA1 c5b8a3200cfd5a5f43ebd609fe5f6a148192228e
SHA512 720fed3bc8cb00b751caac1f1e9d21c89c4c334caaa1b644c66ec015937d04841bf42d9e72dc20498a734995164a1b8dcf6a30405ece2fc24c0a616448c7019a
TLSH
T1C8514D586AE91118B3772F5A6BF6B86E947EBD333E06D45D10110E4E0B22A40C9A173B
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 bbe94449a4e5deff92eea6e0f799363775c558a507d5b926b9025ab03ce533dd
MD5 5b65ee1f68abba8608e081c297a93bc4
SHA1 81c2323677da58eaa883638605c0447015ac55aa
SHA512 8f05b1ab0ac198e95a57a812370e1ff26b5f30e0303e07dcbc34dff19d454b041398f86817ca5098ce92fc2b23c96b7e4b2a60731d7db6178e47a7596a05767c
TLSH
T14B51E8903521623F6B8387D8A0754C84E671F181132E9A5CEE4AD034FD6CEB2AB5F7C9
MD5 SHA1 SHA512 TLSH

Submit Download

MemCleaner_32.exe

Path C:\Users\Admin\Downloads\MemCleaner_32.exe
Size 3KB
SHA256 b217efd31ba6005293225bdd230a2d39e00e5ca25396961d62a93bd7310ceaa7
MD5 0ac57763f191e95ee9ce052985c850a7
SHA1 94dc4c4a0b82b191719eb871e767f528b81ae510
SHA512 162d7616af48e9a91621fcff6e614d97ae7edcf07e0947edd7fff80893e9dfa014a8e50fcc999ac11e895ff2fa2f01250406d43100e67c657999ab081bd066e7
TLSH
T13651736F3EAC893AC180C7B6016646E93F33873025A2855DD72367E0A650E47B6BC30D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5628-261-0x000001D9B03B0000-0x000001D9B13B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads