9020d16277ca67c1e3b274c098587a0ab268e2951240c425836271d1f1c126d6

Analysis

user interaction
yes
max time kernel
96s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FNAF-World-Ransomware.html
Size 241KB
Sample260620-1jsfbshy5q
SHA256 9020d16277ca67c1e3b274c098587a0ab268e2951240c425836271d1f1c126d6
MD5 6a6cdb5a3a172412ff4705acf4ac7ad3
SHA1 2431bbe1d35a518425fcc2f0201d611e25013ea7
SHA512 2fea56b98cf876c12378683e7e197a22da21dfb02df38662641bf0aeb383cf2c6472b650982d94ac16ed4a8e2a6d5a3b8355c2f21004eafe65c155e0479b3179
SSDEEP 6144:ZeUKJ8hfpZwz/JZI7xqdn5pjUsvVm7MVqWX8ijE9Wjd0eJ5PTQYbeHxHA7op9hrK:4UKJ8hfpZwz/JZI7xqdn5pjUsvVm7MVt
TLSH
T18C3493707178627D012F268AF2709714D3ABE31BEB8951E4BA7F96F457D3C84EA83058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	msedge.exe
2936	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264652833565452"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{82FDEFB4-3EA0-408C-B4B7-565E3C504069}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{572DA201-61A8-4273-8F46-612A0E2E9A15}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4220	3388	msedge.exe	88
PID 3388 wrote to memory of 980	3388	msedge.exe	89
PID 3388 wrote to memory of 2868	3388	msedge.exe	90
PID 3388 wrote to memory of 980	3388	msedge.exe	89
PID 3388 wrote to memory of 980	3388	msedge.exe	89
PID 3388 wrote to memory of 580	3388	msedge.exe	91
PID 3388 wrote to memory of 580	3388	msedge.exe	91
PID 3388 wrote to memory of 5660	3388	msedge.exe	93
PID 3388 wrote to memory of 5660	3388	msedge.exe	93
PID 3388 wrote to memory of 5660	3388	msedge.exe	93
PID 3388 wrote to memory of 5760	3388	msedge.exe	94
PID 3388 wrote to memory of 5760	3388	msedge.exe	94
PID 3388 wrote to memory of 5760	3388	msedge.exe	94
PID 3388 wrote to memory of 1228	3388	msedge.exe	95
PID 3388 wrote to memory of 1228	3388	msedge.exe	95
PID 3388 wrote to memory of 1228	3388	msedge.exe	95
PID 3388 wrote to memory of 2856	3388	msedge.exe	96
PID 3388 wrote to memory of 2856	3388	msedge.exe	96
PID 3388 wrote to memory of 2856	3388	msedge.exe	96
PID 3388 wrote to memory of 5616	3388	msedge.exe	98
PID 3388 wrote to memory of 4980	3388	msedge.exe	99
PID 3388 wrote to memory of 5616	3388	msedge.exe	98
PID 3388 wrote to memory of 4980	3388	msedge.exe	99
PID 3388 wrote to memory of 5308	3388	msedge.exe	101
PID 3388 wrote to memory of 5416	3388	msedge.exe	105
PID 3388 wrote to memory of 1144	3388	msedge.exe	106
PID 3388 wrote to memory of 3532	3388	msedge.exe	107
PID 3388 wrote to memory of 4536	3388	msedge.exe	108
PID 3388 wrote to memory of 4536	3388	msedge.exe	108
PID 3388 wrote to memory of 4944	3388	msedge.exe	110
PID 4944 wrote to memory of 2392	4944	msedge.exe	111
PID 4944 wrote to memory of 2936	4944	msedge.exe	113
PID 4944 wrote to memory of 4396	4944	msedge.exe	114
PID 4944 wrote to memory of 4396	4944	msedge.exe	114
PID 4944 wrote to memory of 4396	4944	msedge.exe	114
PID 4944 wrote to memory of 3260	4944	msedge.exe	115
PID 4944 wrote to memory of 3260	4944	msedge.exe	115
PID 4944 wrote to memory of 2820	4944	msedge.exe	117
PID 4944 wrote to memory of 4328	4944	msedge.exe	118
PID 4944 wrote to memory of 4328	4944	msedge.exe	118
PID 4944 wrote to memory of 860	4944	msedge.exe	119
PID 4944 wrote to memory of 860	4944	msedge.exe	119
PID 4944 wrote to memory of 5864	4944	msedge.exe	120
PID 4944 wrote to memory of 5864	4944	msedge.exe	120
PID 4944 wrote to memory of 5096	4944	msedge.exe	121
PID 4944 wrote to memory of 5096	4944	msedge.exe	121
PID 4944 wrote to memory of 3720	4944	msedge.exe	122
PID 4944 wrote to memory of 3720	4944	msedge.exe	122
PID 4944 wrote to memory of 4380	4944	msedge.exe	123
PID 4944 wrote to memory of 4380	4944	msedge.exe	123
PID 4944 wrote to memory of 4904	4944	msedge.exe	124
PID 4944 wrote to memory of 4904	4944	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\FNAF-World-Ransomware.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff8ca90c188,0x7ff8ca90c194,0x7ff8ca90c1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,14457799002883706380,11608644583378219098,262144 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,12460319627919064758,4780972772036936034,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,11575547640371215297,8038931340873848901,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3664,i,5729440971038699538,4979996827755281606,2097152 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3688,i,6585392666043118178,13526717908278213604,2097152 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,15690229228820870201,5536070982413658613,2097152 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,1861871758624435781,15679462910314722307,2097152 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:9
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,211076909539775555,16679183604338702334,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,17442696206521861232,17656054091820986977,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14874368021394022821,9215209782054278194,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14874368021394022821,9215209782054278194,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,8555970898195246117,9173471251424321646,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,8428602504865067894,13672431984565069692,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,13347933302763097647,12980115764956485283,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,16921134668087784341,13670997799112222379,524288 --field-trial-handle=2932,i,1758373473876713229,7575813016613579531,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ec,0x7ff8ca90c188,0x7ff8ca90c194,0x7ff8ca90c1a0
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4590961989139216799,18033218530812360185,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2074484225257728392,15767682117741776611,262144 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,10731817898570969985,13145291985818223428,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,11994668277470801888,4263470328407076890,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,11994668277470801888,4263470328407076890,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,4098634796096860557,7452635261885838620,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,6802672801742782806,5437338035177003571,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,13889070685096106230,7393282509337952985,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,8667167388126465813,10822891220908943824,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6142280819599860145,15659380903757699670,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,3498295842743141873,14137286040235007915,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14622458799204874142,450979098495961180,524288 --field-trial-handle=2784,i,5595090519615055550,4212988685488144239,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35a098a6875f10e14e08bfb595d517cd7953bdedb921bfc380276e769daf61d8
MD5 35991f3c52f2815322e52e8cfd2b691b
SHA1 f76c5d8e4bcc176fb368fc3551f808c6f1303285
SHA512 07d664648fa09dcc174e2a59810d9ac038decd9234074ca6d32c340888a31964d5731a720f290756e7af52670186004965e3fb9e88447055c8b4161d5596bc29
TLSH
T183D023323D2A79D1D12520B595104274572F49937752D20F7555480EDC75490A3C6ED7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ed7705b6a42af248d127d5d4533d0801b2e299b4debe734b06a7d1f5d8ce58d
MD5 411d5bb111c19cdc1b73534a2e98ef3a
SHA1 00b5d245e8235091b1b76bb4a70773f1d2a8bfe9
SHA512 5c78f6cc8e04237eb31e20c749eacb7823dc5df3d710d78d8f379b0d6a5457a867bb9edde082cec24a0a3a6cba7b2f5af7c6a03112a82aede3dc71c40304fe7c
TLSH
T1FDD0A7623D197C00C50130B4681042645727C94BB651D14B7665840AEC064A0E7C9593
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 63296094b4c9e58cef4367267414738c8d29c67a18393c5aec206d216a13faff
MD5 5b641ada59132eaa5095d4deaa51f2fc
SHA1 59df02196d73537b60e9f4244ec3f2ca57f9fec1
SHA512 c626e23b09e7e72acdf1fec17213dc6d54a5aa8bbf41d688cf4bfcfa3c6ea08ffffeb747e00239ea61fc5293c2f81b6365d6d70b3eec692cf5afa6b4aaedc211
TLSH
T1ADE02B96CC21F82B15FD5B1964510B02E60513172BC1591B7F3D82088FB263B8186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e8db56fa90e5820087ce49509088d974c77c4d1f95f6cf899ad57d677eda923a
MD5 5dc382dec03933de3cefee7a2acfc3c8
SHA1 999ec687e16dc8471ec62837704641b4ee282859
SHA512 53b18df2654ba4f5df479dc0c86771cb123446d9c1513b845d96111d9f81619c410cae231ce879efe16c1825677af86f7ce3e2aa9d0c493aecd3742cb10c385f
SSDEEP 384:MvXPpf3/ZFPnAf1UQlkogDndZ9L8B5AlJU1Nz:UXPp3ZlnAf1ZkogDh2Xz
TLSH
T10513803E79E48CA2CAD6487D490BAB3673F8D7ADCCC11B874A393F315351322AA5E141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 00566db8647586ee07e6ec4ea849dc5a02604f740b41f0cd6da2bb5826e4a1a3
MD5 3d8aa1294db575cf11f4f2fea899131f
SHA1 17685830b89bef43c79c62baeaec08acbac67d3f
SHA512 254d068ed9c350d5284a583d5e3b4bd25164a8207af7655f336a571121be6e1c673e0e6426fc84a453362e05de95f5f6e27e1ad0f990333cf42ded804546cd67
SSDEEP 1536:8rVhPL/DkL/sdXYy/On7MoJIaw/k5EoxlEohp0wALqhC5kCPEF:8xhPL/gL/cmr3Eo/Apu
TLSH
T1C14481F71821600ACF9856F6D7133A6DE67B424DACD1EAD9E1380CC17835F32A2E8E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 06084c70206ac68d7cb0c2cac5d268f6e09457d993dbdd04a629397efe6491d8
MD5 52f4515771047d4a393fd61401ac19c3
SHA1 b2cd5bc5c7e6a416282be6a9cc52323d4b9abc4f
SHA512 f4916676b2da6d84552d7df144bc9bc9d230ecd90da2dd65314dc376b2aac2abfce9a1e47cd41d8317e9ec3b5549016163011f5106717732bc76cf5354c9f027
SSDEEP 6144:BQm9GklazjQe7ByWHFP5Z6YI31QNwZDC8Or2X1F:BQYxUzdlyWPg53CNwZDJOg1F
TLSH
T12C256BEEC7682C83CE6B8B70B4E0D9077E712183BA58D0D39944C5D997D6B8175E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 e1a3e2fec9e58fdc301af5a627b4e9496f263aec7a30795ae1f762920fb5caa0
MD5 f457d394ba1dd7d86126b0642d1da8ef
SHA1 9bbd597f290a54f3d9f3ecd89c77f7356de7599b
SHA512 50829459fdee9ed984818dd6729c1218c712e9fcc4f17826a4fdbd3bb98899fdde2fde09a78246d34bda81c9e821a4b735de846a3699f4b4047cdf0be9f38912
SSDEEP 24576:85p0mnODd9D6snOBCZNWMZ2/ZsK0sFp7HrKzltOPPDeiuHVdDvglNR/ckuXHkCim:SKmOh9Nnt2B30sFp7WAFI
TLSH
T1AF869EEEC67858C3CE928930B1E0ED977D7013E3B954C5D28868C584429B7C6BB9E25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb9ea7084084af2e4b824a42f7169d907b5caca0b2106610a6be49c21ba7fd82
MD5 75e4fbf84e4bd86903ca8b710047bbc6
SHA1 0019eb8e6c1d31dfcdcbec7fa23646f0a8d8c9fe
SHA512 4e5c69d5e70509cfaff38dcea1693942fbdc925de4c721d362d37faeb0b39561d8878cc85f4d11ed15316043e71497850bc8e4b2a771340be7cfbde3f83e632c
TLSH
T13E612E7C51DF39A1EFD4EAF165E2308933B0C5220E47AF534499A13F4BE9BC551A1421
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a5a48fd21a9060f19adeb930467012552bb6bf7af1b5e15e48363b185793408d
MD5 2d15c072fd6cfde6a95304052ce953ab
SHA1 b9d6efdc75353c0620916076c1dd2e55ac70a330
SHA512 2b4006c5468825ca2cb6c0fe3de2198416360502a5fa77c9b4a85aeb2d006c5ce57369ff7b055ae032b085d7aa42b0d5c8b34be9a80cf6eec8d49312778fc9c0
SSDEEP 3:MsEllllkEthXllkl2zEnjqH/ll:/M/xT02zs0tl
TLSH
T1A64402046BC00C15C90024304111835003A0D9110621DB5364624812AEC66800C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 67f119a29667acf27ab8d14b79c9c49daf11f85d7b40164a51dc6e0a48a287c6
MD5 a1d117beed12e9e1075862dad2511ca0
SHA1 346657dfdd2cf6b57c261d7cf4753134d95ce2cd
SHA512 5be81f6fc5ef4e6831aa281a7f0a3e026e3849a5689eca7c6126b38c5781c58217ea48c83d5175bd7192d361d47b775643da81a9cd1a10158ee9ca6341e34b5a
TLSH
T132E0D8E5E5C6C33D9510348242285718E5C0386ADAC66D9717008CD07646205F29BAE6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 b7b38c66e79b21eca154fa6293662ab93f92c5bf3df75ca928eb5e3c13c553e6
MD5 b17f3721d9d1860591241ff2ba9c1ac3
SHA1 9d8190ced7bc8f2e47e35d0938d0488a7b940438
SHA512 aa21adb9583a87ea3c7f08142d8362b5e01c3f415d4534940f7140626417788f3c1ac1018197bbe59283ac57277f9aa026db11be5be8b67cfe6972b3b6b6c110
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjzTW5LCFtIklNVqYpQ:TtD4jJ/0UC+lf5bWxCFOoVTpQ
TLSH
T1E9E2CC8C3B12F511C4FD733DA0D2C5E09EBC687C4A4DB171923C98B6CC226A2F49E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 84a2ff1e0cbb07420a64aae5f3c94fee6047cb8f604086c019cda2b0cf06bd09
MD5 746cb424610854651a9bf7bc919e5f97
SHA1 5d1c0877b6b0bd1e588d99abf5ad64012d126c9f
SHA512 bdb6d8839bbb6f284e8db993887dd994fd05df7cbbf5e0eed989ac595f0771ea3705f05ecac6961d9a3bdae9cd98bfb1ddbc890d5199b43bd6b9bdeb4e84b437
TLSH
T105E026048CC8C3BDE05478A38268C74ACFF0348FAA883D86270C9C847101349B2BA3E0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 7a264cd9b1b89494b6f6edb36eca7a8c3a0a760d89aaa63bb7b5da280ff09eb6
MD5 ced6980969ac17a166aed30e2c5be770
SHA1 4143c8b8818a2407591ce34b772b4dbac1a53c83
SHA512 7fd135e51072538e8f2f3992437f7b312340cdca4dc5498f1905a2849c854401a3535e3ebba7faaf3355f60c0740fb437e50e01b0ec93cef865249585b99eb0b
SSDEEP 96:UBCx/d4yiHLOJsUYlTCLad2bybsq1pW4EM0j:Ga/eyiHLtUoTC2IIhEM0j
TLSH
T182B20997AE317007C7041D3F221D69B28D37E16CDFE1ED5570348426A8B895AA070AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 ede0e034a0560e9af9759df5574443deb68e81d6497b0198e8117bfcb58a2795
MD5 4cc75017086ef2e00dddfb3542a3b1e5
SHA1 3a8c3c7b44ee678f5ab0f97890b883466e49df56
SHA512 8bb90afb6faca28761e4900666b1d1237f9a2466466a69255cbccdf539a21e3564e08c3ea2c8169e0ae8f844ea211de4a4d9f136411e6d2085307d60387a044a
SSDEEP 192:ky9k0/WhH+bF+UI3iWGVoWN3qL/YngVVV63:ky9k0/SIkUI3ijVoWN3qL/QgA
TLSH
T15824010E5F352722CDBD913668E744A35C7DF03F8B5326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 16235eccbe10633a1f29e879adf42c05f59ad0b91a6bd6f4023133751fe5be43
MD5 750426019a82bd1ad2b1600bbb1d51db
SHA1 7219005e22a4aee76d5184184acd15204139f53d
SHA512 37daaf878aeb8b4a60f16bad2f6aadd1f4f18893982c29e8f6852d688bcda58e5b6cb19ae0b70c005a4da6b5e555ba1e4cdda1f87b19021b23dff2b00163c06f
TLSH
T17EE080A089DDD77D9204B057C27CAB0CDFF0350ED6893E55DB04AD54B545548B3953E2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 5c2156a2623fb46fc119aa761b08261fe080be49ec7ac1114cc6890361501f79
MD5 d3110fa4260812a933ce99a6576e2b7f
SHA1 41f2e0573e612bcfcdc7a71f27d20988ebc7c2e8
SHA512 85af3e6914ff1e6c384f843ab3fca6ee6dc1405b042f990bd606bb05c5231bcef93c9a64639d6376e0d477b2b33b5fb1a3f510693704107c03922d6e40e44b62
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7o/w8+PFOoPXICV:qDeMatha9RAzd+/rV
TLSH
T1BBB2208D5F70A111D0F46B37DDD189673EBC111D83B33649AE1420F2DDE26ABF51606A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 77662942861c0f1c4451fb05f7837cd6a19fb3ad7130818b4ee73aad7ad9016e
MD5 3372206bb10739a8a36c777e0c47e653
SHA1 af121074fc6ca2139723d9845fc14c405b729b0b
SHA512 f1293697b15af363ce792bc8b3817d1874e5851952db6595991e1a49cb0a02ca09f3a850cfcf7b0bc92c1347d3046ff37a7d8177625a3a7d11dc4e8fce6b44de
TLSH
T15A51ACF7C2E4866D891156F0BF147E1BCE2D0915832C3C5A89F4AF1BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ff16811eb179a8b1f9b9365661d30647137e9b4f711f4908a58c61b7aa470c5a
MD5 68d31144b402de65e5f91cf76a8f4639
SHA1 1f96f114f949dd974d934f13551ccc76e7e46e75
SHA512 44f723be97394c5277a97c070c310d82be5752bc9a7c224ab1edb9d17b1c1d266424d158e7fbbda0341f4394f3ebf5ea151398b429414975a72ebb74f85116d0
TLSH
T10D51ACF7C2E4866D891156F0BF147E1BCE2D0915832C3C5A89F4AF1BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 0074aa6b0778ed90e8e177513406449ddea486b88bb8f4758122a4618305277f
MD5 b7737d4400e1d2447c8ff8a3ffebe300
SHA1 a38aa3cfac78e9c52a9f123994f7df9aaff0140a
SHA512 2640f659f988eeb8e23304667de2c8083dc0bc2a66a3750645934f5fba332a130d4befa904ecbf4ab8ecd2a951bc09c6f3108b8e3f9754f5626a9848d8c37a8b
TLSH
T1EE017B9B80F9F4AF2079493B1C00F80126B6947610A068F1EB96C36CE0920FB5B20166
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5316464b57bb53a051a3b084e1fe957d27f6ffe10b2aa84ea31cfe6193935c6e
MD5 9097a29df1ab00bab785df1b24fa428b
SHA1 be8387e91f342c22ff6093beeb09b2ef40aa5efc
SHA512 72e5587c3f46e0fccda1bcb99f67e40147e324b5bba5fdd6d11d2ff4037d41cf4cc5b0d5d34038f6c6a5bcad092b26c84f518aecf79d4afc457b5caa8cff7282
SSDEEP 192:sxRnRZyM/jK1Ml8wF4/fmst/NkU05zoA8p43/g6+WNIYZjS+GvIgDtJ:sxRn9b4/fmst/7Fe/5INd7
TLSH
T17552E816AA24997BCCDBD219FA557F53D6F81433A2941E44AAFCCA0C00E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d460523d7b471722ee4276c5353aefb6ed1f32a3bf56b253655f98a358fed68e
MD5 b6a911f8748f2ff102933ea0d4f6861b
SHA1 ab9ae19a5f003230840aa819d842742e12d55689
SHA512 c5d345e7810f157d69d7f620a83bf9566998a6866fd1e326f8f2c227f74711305fce3759c10ebe34af02c866e63624e71250a1253eefcf2eaec7c7e5f1de2c6f
SSDEEP 192:sxRARZyM/jK1Ml8wF4/fmsb/NkU05zoA8p43/g6+WNIYZjS+GvIgIJ:sxRA9b4/fmsb/7Fe/5INds
TLSH
T16752E9166A24997BCCDBD219FA557F53D6F81533B2941E44AAFCCA0C00E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8801fd2734f0d292d8a73f7e9650642d0e48c2603a56dde1d32aafc3b4d88d5b
MD5 85b7cfa51b809e23c8740ca6c2ba46cd
SHA1 07713f8c654242d706f66cdc144b561e73c2d87f
SHA512 85df570703c92935761dc5c0f71204d47542455b24bbb822e8f9be627dc2645f250431f68e0e4e16f29ef512ca9055f6c6340d9a04da0d5a3f04e938242efbde
SSDEEP 192:sxRnRZyM/jK1Ml8+F4/fms0WpVfkNkUr5zoA8pe3/g6+WNIY9U/SigvIgDDJ:sxRn9H4/fms0Wvfk7Y8/5IYTp
TLSH
T16B62C716A924997BDCDBD219FA557F53D6F81433A2941E44AAFCCA0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 387561ef492f6da28f64cce25d5dc7536e0b19b2cf6128ca33e9239df98294f4
MD5 8da07719c92c51e773c625705bee8732
SHA1 6ef521bfeab40e8fd92ba6e6186fd689c9df7677
SHA512 36dafe32f19f3c28a674aad18967dfbcba99d9d70cd62abd3584c820d25c2699c6407a222eede2c26a50643ad93ad7c0fdefbd41c7adb478d43cf5b2407bbe46
SSDEEP 768:eOEt7IWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQjro7ov8nFz:eOEt7IWgKgf16u1jaZ/QQ88Fz
TLSH
T162C2FB2B240CC77E4F844E6CAC2A7E976DD801CB9A988D5447EE890C03C77EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ba26a7db83a05fd65c52730693555e811a2b408a42f7437759ca317af9e32073
MD5 4afaad131278c4ad1ce951dbbdf556ad
SHA1 c0e39fdd6baa11626fe8dc567d43cb1dfcd41fa9
SHA512 4ede1092ab5315a000a1dc10db26fa08c688ee1fe52502ce9ea1d14e766341eaf503c7ae0cc602f2f6eab55c7a3c08633f5a4f85b74775320b7360e2cce53f20
TLSH
T143E0265899CCD37EA16570930229D7088AE4740FD3CC3D462F00DF447142A08B1B62B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 8d973961253657af58ba12ab385cc92702a76940bf693f4d4a86d82744e6a364
MD5 f62123773c4ea4b76c408cc99ac89ae5
SHA1 a4792ee447ebaba1b5638430a4b91005a937b43f
SHA512 a55067c884fb22643d42edf4cc43355b9b8b021c133d759c2181cde606a8023655d008eb875e956a5776c07cd8939d513978b46129b595d4a853c6ab6ba2035a
TLSH
T12DE0D82969CDC73FA19530974329D70885A2740EE7C929652B08AE4472066447267270
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 49a9289df0b9966fe8afd5e876a49c7a2ef600c2f6f80a948f5ae739f001274e
MD5 3b04a10d905d079d89a2a1efd1c3ca95
SHA1 1ca2c40376c0d8041482eb2e8f958678d24dbc31
SHA512 74caa907f0e705306081745d2a7e66f5f7eaa10d5c9e362e5f07dbc5c53c4cd32c41cac1bbd6d250342a6b4c51f0a8629ebab0a1dc64d4494e7dd68ca07acb34
TLSH
T139E080B0C9CDD77E900574A74264DF0DC6F0B80E97C63955D7086C5479C1354727D7A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 32aae822115cdd7374aee3f3c00cf0aca39ddb4ee355237cf79b5a4186fa4fa1
MD5 54bc158fbc2cf520e21db8f933eca95a
SHA1 8155883f24b1aa959faa59048e3860c0ed93839a
SHA512 d04536572c7fa8621199c00c4b474e2fd0e5da839769703f5f7b8730136781b5566f410e3e17cb78699f474726fcae3aab3e683708dcfdbcc705cac0a6eb07cc
SSDEEP 48:KLy3mig8Yko81PI16kKOBG4kqC0HVgC5yFXIBKQAEMsIfKtWcvy9RxR7RH:KQ9OKuIaWX+KQA3sgKtW+u
TLSH
T1BA916650717B635528BE298884D1E91F168630BB3216E52B7B6824F30F6FE005EFE4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 18f6cb389de43962b2e63875c6e3ab9b6b35264fa7cf405b38f881c9d1b18007
MD5 79e1b0a5a873a94573b0f70da04f1e5c
SHA1 80acffbd451eb0bca436f1105138530355a71718
SHA512 1a8ea2235df8fdf1158753071c73d7ca5ff9ace622873c457b0bcc48b58fe9fbbef28f37e2806126880fa3a0852bbab75753759384df5703a6e142d22e32c84f
SSDEEP 48:KLy3mig8Yko81PI16kKOBG4kqC0HVgC5yFXIBKQAEMsIfKtWcvy9RxR7RnRDRkz4:KQ9OKuIaWX+KQA3sgKtW+xg4KR63M
TLSH
T15EC17410717A23452CBD299894D1E91F068630B7725AE47B7B6824F71E6FE005EFD4F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 35975ebd1b0a12f2d1849177a4f679db4f3fc50385e9dc8c4710865988ebbe36
MD5 102da649bd0ca0bfe8dc461e384deca8
SHA1 fe04e63a2c4d081f463153a82364309f2f24b916
SHA512 19fd0d836580d5c146f3d6dd5602ff5a6ec187cce58b6ec1273e58089993cea239e915f761912ce7d3e4caec6ff659c0afdbdc7a775ca7f9358ae6d376baa977
SSDEEP 384:DNrRZyCSDnxTICveMEhIKyll7svbFKfk7:xFZJSDniiyI1l7svbF9
TLSH
T10D44850A7B747001EDE6D9721CB080771E3CB16D8F62A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 c36f568ea5192278f401082c335d54de6289fec4261eee0efe5c5465cc0feff9
MD5 e43cb56570e28c41b3e3f13f1def222a
SHA1 00134b3d3b50798bc66d0bb95a439d32a2f14997
SHA512 144c626ae073dd5c4d08adf8872c28b12a81e271250376f4c51214a67e1d3da7ef797babd017f35c5e3595057b898812649e030c1e5a95cac338097f03ab4b90
SSDEEP 192:0pQiIIIBbxMIMbyYcYLBPOptAsnlrhUQ2sx4O:eQiIIIBbxMIMGBvp+slV2s
TLSH
T11942645A1A051F77C29F5F7613AB86445BE888814132253E32776C1F8DF3BA74AC62F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 3267f3ccfa8a9922c8bca00fd32023ee01b0c0ba67c78e8dc636aaae3a42d6e9
MD5 48a5284c38d36b948eb88da7db2a3e3c
SHA1 d3fe751d9fab56e8afe3d81db18ccf13caf7061f
SHA512 2ebd7812ee261bdade118ff41269ec0880904664ad4b908943462430222e15de1147df5d4b7fa27b9a0318986a1edfcc5a91e3427c859298586fe964d303694e
TLSH
T110E02014DCCCD3BEF419309701158B48CFD1341FEB942D4D1F00CC5470412057259262
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ed2f69a41fc19fce977c09b0a91033bb0e11adaf7d82a1851746849520afd6f4
MD5 b961b81a2c9d1b93df966ddb969e6182
SHA1 2f9999023745d38a4e4bb2392c131c906cf2ed32
SHA512 31e0cd195ac65d44757bfba94f476f6716bf798d8ce7e2a2cdbf5ed16a9cf2f107e95c39dc89fa0f3fbeee3a54700bb0bf0e9400861e9bc8e8d1a0bd56889888
TLSH
T18E21C459F330C108E14A867E647B9B250735E8168FBCEC0F557A20656E76B440E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 24d20166fea7e16c0311ae74be7b69e1e861815c086513b39c2f999141f68f27
MD5 01d76da557ee17aa36e434fb9bb80d2c
SHA1 d94c649434af55f1176d529508254679dfd7c6fe
SHA512 98d9a64bb5a25b763d7f98771cc6d18d516d12ae6b5c8f7aa54f7d896f84ee005a6ab1726a02ce1de80c9aea590738cb3baa07c933d8cabbf094720d97dd9fe2
TLSH
T179E02610ECCCC7BFD11A30AB0174CB48DED6380FEA982F4E1F04CD54B541689B6AE2A1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c896.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c896.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 e9fd52834b413d31d50b2e92574ab93a345ceead68274269a9798991be55f121
MD5 a5c75f7fc57d409940c89331882ea0c0
SHA1 3e7cea1f38b95fb5e9efb97ff7d672d6a1fc7968
SHA512 af4a102475ff25ebadb131ff44e16184388ad55851fed959be8ad2b424218e431ac81e454c2c7259bc2a0de2f08dae2e1c00a8e9f9f6b01b875d34c44467e2bc
SSDEEP 3:MsEllllkEthXllkl2zEoliUWKX:/M/xT02zDXX
TLSH
T1C64404057FC31C05CD0110314D31C3F003F0F5540D11D747345345135CC55500C44044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9c59831ebe286adad45a0fbc2375b0ba9f6f22772b71439440149bd7ff883414
MD5 3a5754bb5499369176e8220cc5c56282
SHA1 6fd339500ad395e8c29adbc175ff279fa5036bfd
SHA512 1d0f962660c511ae1f9e5e5e2432397523f27a4e9f03c79ad62dc0e91fcd2e5d6ebc048d37c8de5d08d2d5179aa09425bc74b9f6bfc40a4b59eebb239d21c408
SSDEEP 3:MsEllllkEthXllkl2zEolZyPKX:/M/xT02zDtX
TLSH
T1464404057FC11405CD4010304C31C37013F1D5540D115753F45104135DCD5400C4C045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 df809b8cf12a7f618c65832f3876f67b4b497aae149189db414393405907ed3f
MD5 f8fdcfa8a66979a04317ef28024ee73e
SHA1 045f385445df048d40d377c5206aaecce4f71c2c
SHA512 3820dd1c80976dd9b4fb9a80b566dc5de2b6414e208c1a32c83264d8ac5ba0347254221066e8e589c990070c1f9cf20cf3202c3cec2b781209514645ec7c1c99
SSDEEP 768:qj+9g3QIcPfcOsfDXfDU1V5R4HTytYYqgHvPw6/+0evd:J9g3AfwfjfgWTwJv/6vd
TLSH
T12AF2AE32ED799CA75DA1C2C57502368B6EF84263D2C42A54D9EC6E0D098FAEE1347C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4b5d667a1b2c9da590116f124dd6427681f8322a1c0558f75e6b7896b58888b2
MD5 7641c2c10da1701bacda56d4f4e417d2
SHA1 af393d44b1e5f5678a39480bcef3fa294515b1d4
SHA512 b1228921382882039b8905bf7e94a6ccd074849c2aa6f01e03427a8d06d905191144e99dabc780ff8a3dca978053cbd5348ed2f9173579302ee099267e00ca9e
SSDEEP 768:8F1j+9D3awgBIcPfcOsfDXfDUoV5R4HTytYYqgHvPw6/+0evd:x9D3ifwfjf1WTwJv/6vd
TLSH
T1A803BF73DCA8C9BB9DE58BC5B6063687AEF40273D1C06A94DADC5E0C058B6DD1347C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 78caa8d730e9737c2edc634c28fc8f19e629b10088d57cf8f661a5f64c9b0898
MD5 da495e404a1ff2f3460beb3cdd1b8d6e
SHA1 fa17ebbb04bd4f9e7e56f997c97b7965b24010bf
SHA512 1c69c2801f3eb686c6bfb75d2016eaf0f2828d2fcbcd488ea13f2f43ba7809993aa144a8f56f5193937d68e5131315f6295b41ff427b11e4f8f6696772c39930
SSDEEP 768:jj+9g3RUcPfcOsfDXfDU1V5R4HTytYYqgHvPw6/+0evd:m9g3NfwfjfgWTwJv/6vd
TLSH
T13FF2AE72ED799CA75DE1C2C57502368B6EF84263D2C42A54D9EC6E0D09CFAEE1347C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0d0c81b1b536ce9a6d8051a637ac586de79b8922305a3f9c0950722c7574630e
MD5 e8a961f0469cff1c64b1e4bda79440d1
SHA1 cef371c561d033c0ae67ad39ea05a5465c5f510f
SHA512 186254b0a20451e2dc4de345f5c8a56a85cdfcc5f33611f230683db82f8ea2ea6e1c506385fba4645743c6d228d70e92c2c7348f1b5cb764f427ed2a09d7540d
SSDEEP 768:8FKj+9D3jwgBEcPfcOsfDXfDUUV5R4HTytYYqgHvPwNjXag/+0evd:W9D37fwfjfJWTwJGTag/6vd
TLSH
T171139C3ACCA48C7F4DADBB88620E26666DB40237D1F455A8E7D81B0C817B99CF347D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ddfbbc4bc718e4ab1752ea53e7c1068f6ac393b3125c3ac94dcbcc3d557ca863
MD5 1a411df5363b63a7ccfb29c6335160bf
SHA1 1aa8b9bc534c41bdd3300d35cc7a0ca042dd9e5d
SHA512 99ea8c53f0fe6448edbd9b2a1dd7045ea01a01b277e36ae994410bef515ca87cbaed89831d08224bb674e95f04e05ec91b42a7cc10adf21527bf7d51d9d0549c
SSDEEP 768:EjaeqD4MlshiLdMma3C4PfcOsfDUV5R4HTytYYqgHvPgOyjWtxjTo:EqcjhIdMh3pfwf2WTwJ3yj2y
TLSH
T19703CF76ECB85CB78CB2D684770277976EB842A7C3C12A64D9DC5A0D059BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fd87340971762f53bae5114fbf45a343199bd0218c8596c013ba1594b10aab16
MD5 8182591ef8a5deafe633c5c83e22b3ba
SHA1 4418b6351bb399ee42cb78456a14e574933473ff
SHA512 730ee4bb802620d5b6df92a7903d96984ad1b20c314dd745c29e936925030e36059687da58f63818e50c62667d590372810d6510dcfd32659f741e0191dcdc05
SSDEEP 3:MsEllllkEthXllkl2zEolMZKlt:/M/xT02zDMZq
TLSH
T1BF4404057FD01C05CD0010304C33C3701370D5544D1157C334510513DCC75405D4C04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

375e7a48-e3f3-4e1b-8bb0-078ea21df054.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\375e7a48-e3f3-4e1b-8bb0-078ea21df054.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

807d5a7b-3d76-4205-83b4-14c5ea579726.tmp

Path C:\Users\Admin\AppData\Local\Temp\807d5a7b-3d76-4205-83b4-14c5ea579726.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 aa5a3129eceef0dedf5cf50aa895783686d9896bb39d6606b3803274c70ed02b
MD5 d7ffd3fd454f92643220f4058a5e5c97
SHA1 738c72fe9a0a4ba0a8ebff35752732a059a9dec0
SHA512 796284fb36225b75645aa3ec2d4a5421580b3797c681ea04781b414c2db62ab0eba6a2570f3be6cf5515041d9b7be784fcd6127ceaddea88096e73f3c0223ee0
TLSH
T1832126A03527733F67830BC8A1364CD82750F185432B669CEE564834EE0CEA1672EBC9
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4944_1902248138\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5308-220-0x00007FF8D2430000-0x00007FF8D244B000-memory.dmp

Download

memory/5308-221-0x00007FF8E6440000-0x00007FF8E644D000-memory.dmp

Download

memory/5308-223-0x00007FF8E88B0000-0x00007FF8E88F8000-memory.dmp

Download

memory/5308-222-0x00007FF8E8050000-0x00007FF8E8082000-memory.dmp

Download

memory/5308-219-0x00007FF8D2450000-0x00007FF8D245C000-memory.dmp

Download

memory/5308-218-0x00007FF8D23A0000-0x00007FF8D242D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads