f2f858fe13e11fa01833d35be82bc036a81b3bf02ea8715bce009397946b6b1e

Analysis

max time kernel
149s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Risk of Rain Returns/Risk of Rain Returns.exe
Size 32.4MB
Sample260703-rskx6sf14p
SHA256 f2f858fe13e11fa01833d35be82bc036a81b3bf02ea8715bce009397946b6b1e
MD5 59070de32c96d771f0eb8f1cfa3248b4
SHA1 c910a6658c10df31a56e095f24fcda386a65752f
SHA512 762cfbdf0735e917323f61382f15b3cd977dcb0e70ef0f032fb9866407d6fd4e137982bfc7e0fdf186192206c234e13fa3a7d12a3b7fb632cacaa361c263374a
SSDEEP 393216:MK4zQTe64cBjs4nhO5YeT1ElW7W5tr5bo3Q2uXJ5e6Fus3:0Yjs48qXneAuo
TLSH
T17B774B24395ADA9DD076C47CCA22DA53E6203CE8C7394AFBC5B036170FFE6E09535A16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	discord.com
53	discord.com
63	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4620	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275639153963353"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{0F009542-E6D7-4F47-9A58-54CB25689A2A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4792	Risk of Rain Returns.exe
4792	Risk of Rain Returns.exe
4792	Risk of Rain Returns.exe
4792	Risk of Rain Returns.exe
3040	msedge.exe
3040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5916	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4792	Risk of Rain Returns.exe
4792	Risk of Rain Returns.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 5916	4792	Risk of Rain Returns.exe	88
PID 5916 wrote to memory of 6200	5916	msedge.exe	89
PID 5916 wrote to memory of 4220	5916	msedge.exe	90
PID 5916 wrote to memory of 4620	5916	msedge.exe	91
PID 5916 wrote to memory of 4220	5916	msedge.exe	90
PID 5916 wrote to memory of 4220	5916	msedge.exe	90
PID 5916 wrote to memory of 5596	5916	msedge.exe	92
PID 5916 wrote to memory of 5596	5916	msedge.exe	92
PID 5916 wrote to memory of 6584	5916	msedge.exe	94
PID 5916 wrote to memory of 6584	5916	msedge.exe	94
PID 5916 wrote to memory of 2780	5916	msedge.exe	95
PID 5916 wrote to memory of 6584	5916	msedge.exe	94
PID 5916 wrote to memory of 2780	5916	msedge.exe	95
PID 5916 wrote to memory of 2780	5916	msedge.exe	95
PID 5916 wrote to memory of 4932	5916	msedge.exe	96
PID 5916 wrote to memory of 4932	5916	msedge.exe	96
PID 5916 wrote to memory of 4932	5916	msedge.exe	96
PID 5916 wrote to memory of 3124	5916	msedge.exe	97
PID 5916 wrote to memory of 3124	5916	msedge.exe	97
PID 5916 wrote to memory of 3124	5916	msedge.exe	97
PID 5916 wrote to memory of 3268	5916	msedge.exe	98
PID 5916 wrote to memory of 3268	5916	msedge.exe	98
PID 5916 wrote to memory of 3268	5916	msedge.exe	98
PID 5916 wrote to memory of 1464	5916	msedge.exe	99
PID 5916 wrote to memory of 1464	5916	msedge.exe	99
PID 5916 wrote to memory of 1464	5916	msedge.exe	99
PID 5916 wrote to memory of 3416	5916	msedge.exe	100
PID 5916 wrote to memory of 3416	5916	msedge.exe	100
PID 5916 wrote to memory of 6472	5916	msedge.exe	101
PID 5916 wrote to memory of 6472	5916	msedge.exe	101
PID 5916 wrote to memory of 6220	5916	msedge.exe	102
PID 5916 wrote to memory of 6220	5916	msedge.exe	102
PID 5916 wrote to memory of 2696	5916	msedge.exe	104
PID 5916 wrote to memory of 2552	5916	msedge.exe	108
PID 5916 wrote to memory of 2640	5916	msedge.exe	109
PID 5916 wrote to memory of 3712	5916	msedge.exe	110
PID 5916 wrote to memory of 7160	5916	msedge.exe	111
PID 5916 wrote to memory of 7160	5916	msedge.exe	111
PID 5916 wrote to memory of 3040	5916	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\Risk of Rain Returns\Risk of Rain Returns.exe
"C:\Users\Admin\AppData\Local\Temp\Risk of Rain Returns\Risk of Rain Returns.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7ffe062fc188,0x7ffe062fc194,0x7ffe062fc1a0
    3⤵
    PID:6200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,16665370885017046912,14684163948816046104,262144 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,11186541513857996875,9667885416795664080,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,11278544429431219717,13861988116702088326,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,15069702224488392193,10020362098194565987,2097152 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:6584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,2413987899246580150,17533692767658915972,2097152 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5144,i,10823973547361258981,15063361627083001910,2097152 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5184,i,10697931663195841786,12605041868438731906,2097152 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5440,i,14848195696714509700,10537528457830667301,2097152 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5724,i,3417727598992584064,17410372823195111721,2097152 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12056531001232096625,8918005835248953642,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,8621780224233909950,3415615290748858473,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:6472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,16466566705191067892,5649044424577011928,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,12290526445587288165,5848199200489382170,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,12290526445587288165,5848199200489382170,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,16362856027693455318,6620458680961424119,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,11465318164912550781,16171955614359502076,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,6539592110941019891,7631453091220138804,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7967491092026685126,8842448144378041500,524288 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
    3⤵
    PID:7160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7064,i,6338697564641413877,14843126646478133701,262144 --field-trial-handle=2136,i,15047677766104922490,16481578101274690467,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 86f6385519d93b0172fe1d772ba3ac05dd66efe6658721852ce1f753899ccd9f
MD5 c2613ecf13aeeef10f9127675f365926
SHA1 eb4e36336818f149f94af0e6969695715835e5f7
SHA512 f8c7aaf3a3bc497899f960d4edf34f9dce901f2469355bc5bb8a7067c2381d040305931e549578d61158cbbe37338dec5fb8222ec2cc7e56691c5876fc9e5363
TLSH
T13281D8151A5D2A91DB65B67503F921C4FF78808AAC4FAE018C4FF878C886794F0DECD2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58da8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58da8c.TMP
Size 3KB
SHA256 2cc66551c30c96648a5cbd5bcda3522265540b8c3eabe75236748cd1591c65a7
MD5 2288e2f0c873d51251ee9781a056ee00
SHA1 c2789f8e01a7b4f8c18daf83589fad9b412b954d
SHA512 9b5ce3f7d2eef7b360b9568ac9c8db59f11e9d5e98f848e779ec5bba2902fc0006ccc127e36520047cdc2ba11902cd44852df27d9543554c0007ba11b627d300
TLSH
T1FB611B191A1D2E51D765397503FA01C8FF7480868D8FAE118C5FB0B8C8D63A4F0ADCD1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 233dfb51d9fa6b150d62af1ab0e355bef67886d7ca2a9c47d8582b3fc674afef
MD5 60c027020df8344cb75e443e41d055c4
SHA1 49e1f396ae737459762146f404db83d9c62053ec
SHA512 8423ce4add44f8379b9d4a3a18ed7cab939f2802fc3100fbba5180fa461b2b6f96f4ee01de8bee4d5a6440765dac5f3aaf223c6c298bb42f3ffd5117ea6df661
TLSH
T12C41C0F783F4856DDA1195F0BA186E2BCE2D0914432C7D5AC9E0AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 d5eb9b39f748346439d6c651847025c651ce19494e26a39aa4cf54737d07cc23
MD5 7b669c2ce7bc5ac35b09e1fa206a0094
SHA1 2a89c5e89ace3e9f3660932dbac7217b7d978bad
SHA512 22f54060a87cb28562c729ee361ecbc81ef73f73cdb74ab88d75e7886a1ea45d0192337fd6d37ca02bdb8278f0bf0de4cf9637acb2b50b89ef18b047dfce5f6d
SSDEEP 192:D1g+U8GjNVv7UqRvStixjhnZij6+1lrntJuZSGUqs7Zs74jYILeuqQnDXW:D1g+U8GhVv7UqRvStix5ZiG+1lrntJu1
TLSH
T117126FF7C2E8C66ED82255F8A714AE1BDD5D052943283D1689D4DFCBE3E34B1E201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d3ecc004f1372879cc9e645d0665e47f684b0402d44228c23b0f28a2bc0b50b3
MD5 a7df311e0ab82deaca45e2f011456a69
SHA1 66f1a9ebf302f72cbabdc3afb6c22c9005ff49af
SHA512 21f9e0dffc3508f749f823bd121d6cf9008f4d318e3b9a87db02c982624143d34d30e40311b490a7882b1c8bc1a4e57b3d831af8e87929a427118f844bc7b1c6
SSDEEP 384:sxRkWC0P/fBsU82BaSRiMF89V/5G/b9sXZ91S:sg70P/fX82EDW8D/5cb9sXZm
TLSH
T14F72D816A538593B8CCBC619F685BB67D3F91563A1905E48AAFC8B0C01E76EC6103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 de80d680ea3fc6fbe13ea6f097e9e6409b3e5284f1ca876056395d5563bc7f13
MD5 db64723d4982af3ad613b826ba35d211
SHA1 a315609fbebc427ea5b0f9091a7f495cf33bb28f
SHA512 48bf0019ac5e0638af5e8aa62a5d585c6642f70f148c28bfb71edf5754639a82b380662dae659680dd75e54e16896d1aef96a6802d735e26d2840a8212670995
SSDEEP 384:sxRkWqD0P/fBsU8VBaSRiMF89V/5G/9sXZ9TD:sg5D0P/fX8VEDW8D/5c9sXZF
TLSH
T1B872E716A538593B8CCBD619F685BB67D3F91573A1905E48AAFC8B0C01E76EC6103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 52c8b31a1d5de79a6c4fcac4bf8ce53e3f7266f5416dee125c0f03cf4c019341
MD5 7ed24cdad4f571e156d937306f1ceea6
SHA1 271a8eff5639c0bee687a368963eed5653152864
SHA512 064c57d100727bf4eedef80e5478ac7efeeadd49abcbb4f65a3572d8e83ee8da207a0506b25d69cb1de6a5bf9a5d5ffc9edea50de8de1f1a4368cf8e5af411e7
SSDEEP 384:sxR4uC0P/fBsXW82BaSRiMF89V/5G/b9sXZljS:sEj0P/fx82EDW8D/5cb9sXZI
TLSH
T18372E816A538593B8CCBD619F985BB67D2F91523A1905E48AAFC8B0C01E76EC6103C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 479b8630fa21f8a5abe26d34690b52803b946a31f8e5bd7c165f8986c6d45556
MD5 5d89cffa9b270221fda378480f9dad1d
SHA1 4abbe2133b5dfc79c6495899de1b8fa996336fef
SHA512 a83c742c3d5fa0dda33fc205757cf7f78374d71dc9fa049b91e83c42c818cc8a992bde6cf034ed84c929570c390410464402e5d274df977aa88281a76ea74215
SSDEEP 768:PRbg3u7pLuL75sWgtVf6p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcokUfYHrotzBQ:PRbg3uE75sWgtVf6pu1jaPokoYUtG
TLSH
T1F8E2FC7B680CCB7F4F804E9CEC2ABE9A6DD802CB56D8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 92a56b498acde570c9cb3ee58a98eebf24a28563ea7f0655ae64b93697e9bc4d
MD5 f44a7aa7f15ed8f795ff15d502fa053b
SHA1 77f73412d8bf99f4e171e5ed0328219779550877
SHA512 48bb20d5c4cb253d0652ce87e5dcc42beab47eb539c0859457a1e3596f8d8ff7b55e674fbc0f323ecab04470769c94a6feec7f59f5c6ba9f7b731180b0804681
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/x:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBz
TLSH
T131B28E5171BA2740383E240E93B9841F5A4630A230DEA97B7BA931E56F67F000FFD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 859cbc0de76730a538047e5f6450575a86ee8d47c57315dbdc7670293c54f1bf
MD5 96332c5dffecc02e42c26bd05b58fe77
SHA1 6f093894e78d9eb8aece05c68740128575ec6e23
SHA512 8153a2af7a93c3fd8d14a6a3ab95b05de40b5301e2abe6b4e1a51eb0f1db26ac5d3dfa3cc87b0b6ce1d43e6f36adbe418c7a72d4a5f26b4212fca930c186819f
SSDEEP 384:nxiF9tNn/s3n9SX8NW8TUNTUlIRL0zG631PcfoF1lMF7bx+GXpC+FLymn15wbAj4:YF9j+9aDwgwN1lMFvx+mIeLymn12bfJZ
TLSH
T176C24B36D868CE77ACE78BC9B74A7646EEE001A385C85DD8DAD85D4C00D32DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0d249def8ebdc9e3f035a7428864f32972be6f11cd086316810ac12a4a64de20
MD5 411807caf744465d808ca3b0fe0a0baa
SHA1 86ff3eccb9f11870201a92b7dd967fc9b3d17e31
SHA512 f03dccb64c72bca5657eb5cd7dfba1ecb669c41a77e247b4ca98e962276b6283260dd4a55f95b748722f164fcf12f3655f84a94473e18f3afa7fd6ed4e6e5b70
SSDEEP 384:n8iF1tNn/s3n9Sv8Ny8TUNTUlIRGa0zvnkoPcfoF1lMF7bx+SEmn15wbAjEJP8Lp:nF1j+9SXwg4om1lMFvx+SEmn12bfJ8
TLSH
T1F4C23A36E868CA7BADE78FC9B7497646EEE001A781D859D8DAD85D4C00D32DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3c9f53eb24d4d2de161e3d02bb79e88746e21c551d3c391d6e1a9990f77f946e
MD5 d851122de31d3c7ae29c5ac9dd6abf23
SHA1 bedf5ee9ab8c05f5aa68a6150f1a5bb2e467f2df
SHA512 2a0e6754ac8ecca3e6b48ed6c6b9689904d0f3afa2ba3e64736979cb6a93d262b1e12c75de5373c0ce6430acaf42e7fbc7ef40c0525e80a2061942ece722b5de
SSDEEP 384:nwiF9tNn/s3n9SX8NW8TUNTUlIRek0zG631PcfoF1lMF7bx+GXpC+FLyOObjI9GX:LF9j+9aDwgoHN1lMFvx+mIeLy29M9np
TLSH
T153D24B36DC64CEB7ACE68BD5B75A3656EEF011A785C85EC4DAD95E0C00832ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba7c31015bef1e953c4af9200dc2aa39cac88a85b13395d7794a6e9ceea4b9fa
MD5 2c26e47a19fb9f668e75e2729fbd889c
SHA1 6e81df76389dae627ccec2d7a98837ce33cb25cc
SHA512 048dfac889f7b2974d025dd8dda596be0da2ab531345b7dd996d634f863cf49c3183c237d31d1ff1b5acc6aab622e7ce3e416c85390de9b91ab0fa4272c53f0f
SSDEEP 384:n6iFKtNn/s3n9S98NW8TUNTUlIRek0zC631PcfoF1lMF7bx+GXpC+FLyOObjI9GX:xFKj+90DwgobN1lMFvx+mIeLy29M9np
TLSH
T132D24B36DC64CEB7ACE68BD5B79A3656EEF0116785C85EC4DAD95E0C00832ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4792-1-0x00007FFE06330000-0x00007FFE07566000-memory.dmp

Download

memory/4792-5-0x00007FFE290A0000-0x00007FFE290A1000-memory.dmp

Download