Overview

overview

8

Static

static

1

AssetRipper.html

windows11-21h2-x64

8

Resubmissions

18/07/2026, 04:49

260718-ff33fabz916

18/07/2026, 04:44

260718-fcw5qabz2y6

18/07/2026, 04:37

260718-e8x68abx618

Analysis

  • user interaction
    yes
  • max time kernel
    368s
  • max time network
    371s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    18/07/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AssetRipper.html
  • Size 283KB
  • Sample260718-e8x68abx61
  • SHA256 01a754158a6dcf32e407890c16458e0a5f8ba14c1217cfcad91228b2fbe309d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\AssetRipper.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff8a575c188,0x7ff8a575c194,0x7ff8a575c1a0
      2⤵
        PID:2580
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,17703388691054607520,2004317234403713727,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
        2⤵
        • System Time Discovery
        PID:2964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,3745816827065348602,770309148475506847,262144 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        2⤵
          PID:3504
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,4064296341671865833,4031872406803327026,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
          2⤵
            PID:4100
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4269373545571092928,12168613396376790795,2097152 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
            2⤵
              PID:4820
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,22286872464698163,10371983179378344517,2097152 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
              2⤵
                PID:1348
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15250340950521564761,9546976421111657638,2097152 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
                2⤵
                  PID:4192
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,5622636126666306490,13288284648139679835,2097152 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
                  2⤵
                    PID:760
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4308,i,1174610597824218006,4185793655090936695,2097152 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                    2⤵
                      PID:376
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4344,i,5022381692514831,18094175856947455179,2097152 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
                      2⤵
                        PID:4080
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,17248860137211193429,14465021374704326967,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
                        2⤵
                          PID:5044
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,2035881012790885798,10303792851903418761,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                          2⤵
                            PID:4800
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,15493958546173683388,14388368267018456751,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4404
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                              cookie_exporter.exe --cookie-json=1128
                              3⤵
                                PID:4696
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,4157491797296331921,3317640694678235826,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                              2⤵
                                PID:4864
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,4157491797296331921,3317640694678235826,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                2⤵
                                  PID:3384
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,2746165299810096409,17260626139059903847,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
                                  2⤵
                                    PID:4712
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,3840007031176227072,10162434934261755632,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
                                    2⤵
                                      PID:1288
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,4486958217137386168,11895820965287974786,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
                                      2⤵
                                        PID:4996
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,5608313727824802373,10361380713033927626,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
                                        2⤵
                                          PID:1860
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6524,i,11901881741659777044,1137555219338044251,262144 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:10
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4980
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,439442352461479953,8301373026535283315,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
                                          2⤵
                                            PID:3176
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,14432158605863558556,13792439648352030923,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
                                            2⤵
                                              PID:5040
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,13794569280286483822,8584150983966694920,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
                                              2⤵
                                                PID:3960
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,4289653814548642451,14297373711223832831,524288 --field-trial-handle=2252,i,5428213575871804443,2747971546962012264,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
                                                2⤵
                                                  PID:1216
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                1⤵
                                                  PID:4984
                                                • C:\Windows\system32\sihost.exe
                                                  sihost.exe
                                                  1⤵
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2004
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe /LOADSAVEDWINDOWS
                                                    2⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3884
                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                  1⤵
                                                  • Enumerates system info in registry
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:936
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4384

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      991f12fc-6b7d-4461-9547-991e8eb68694.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\991f12fc-6b7d-4461-9547-991e8eb68694.tmp
                                                      • Size 8KB
                                                      • SHA256 bf5d6129cd68be077f286de234940f75db9d537fd5807a99155d999e373d8a54
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      blocklist
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                      • Size 105KB
                                                      • SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      LOG.old
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                      • Size 6KB
                                                      • SHA256 6fb9a1fc2e8933deb67ef6d4dd6a2d778abc30201239ace3c02e500e6e7a1adc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      LOG.old
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                      • Size 6KB
                                                      • SHA256 9a5c0454d209b264f826433e8d4c6990e73bc7b5691af6afd9fb6e8f1e37a20e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      BookmarkMergedSurfaceOrdering
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                      • Size 6B
                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 3KB
                                                      • SHA256 c4a9885f79201456a1855d4043b301feaac799c38ddbb6729fcde5fb3ad84aae
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      the-real-index~RFe589a66.TMP
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a66.TMP
                                                      • Size 3KB
                                                      • SHA256 d1a6e7d473f568f3dfaeaf265d36ed689abc2395c1a90970705548041c843892
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      SiteList-Enterprise.json
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                      • Size 2B
                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Edge Profile.ico
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                      • Size 70KB
                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                      • Size 1KB
                                                      • SHA256 4c3def12068e570fe48ebe2843f68eb160660061e5f32509e20b4af02eba536f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                      • Size 1KB
                                                      • SHA256 255ca56d571d72108cccfa0668e8711c237be3a27d829f2a40bf48e9a64b729b
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                      • Size 111B
                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                      • Size 111B
                                                      • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      d00a9d60-4201-4ea4-bb70-79a8c950d50a.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d00a9d60-4201-4ea4-bb70-79a8c950d50a.tmp
                                                      • Size 2B
                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      • Size 13KB
                                                      • SHA256 f34945b5ad0e4d41f446bdb158e92f0dcf47bd122483dfd79650bd9650c11e38
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Secure Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                      • Size 31KB
                                                      • SHA256 bd33b71193f531686d002fe128c8fcf427933d49424ce72e4c07fa50e9feb098
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
                                                      • Size 1KB
                                                      • SHA256 a009397bd174b832e0bc93c6c5173ce3877223ac3803e256a5c6b52fde555d1f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      the-real-index~RFe5ce1eb.TMP
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index~RFe5ce1eb.TMP
                                                      • Size 1KB
                                                      • SHA256 a01a0a7ee9422048cae25bb9544fdd425537bab0f0dfdc467f02982282ae8675
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      index.txt
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                      • Size 371B
                                                      • SHA256 b876ba158bc05b0d2121314df0daacff2a600e39cb6cb917deb8d9a52fdd8f20
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      sync_diagnostic.log
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                      • Size 4KB
                                                      • SHA256 2f25beec719b7fe2e151402d9ca42239e06069f5439a1d7f547dd56588f0686e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      c9f99e4a-b90b-4323-a896-50577ac09ab4.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9f99e4a-b90b-4323-a896-50577ac09ab4.tmp
                                                      • Size 12KB
                                                      • SHA256 a589206316ce28af0c4788c0c653790880d618d20162d7d0302313729ee24705
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      503de728-befa-4ebf-94e4-fd621da54552.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\503de728-befa-4ebf-94e4-fd621da54552.tmp
                                                      • Size 22KB
                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 19KB
                                                      • SHA256 35eeacbbea4cb642ca081dad6edde08c613c335d0d15035a29eeb6e38a653a01
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 22KB
                                                      • SHA256 a47fa3ab41687f7482f73dc469ba51c934c25b28f60f69b555665b32fc833ad5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 22KB
                                                      • SHA256 3272f2bb93d4570076d58dc3cae8eeefd3e9baf01765a01579ce0ea5dadcc3a2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 19KB
                                                      • SHA256 33a115f43de901743ed5b82940bdd9737c5245f09d0c7a8c38745f67d4831a32
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 8KB
                                                      • SHA256 75de0cae542f4685e4a589290d43934dad294e495d268d4f82a80dd4380fc468
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      b4c30de4-b4ce-40b6-a17a-cb8d6b12dacf.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b4c30de4-b4ce-40b6-a17a-cb8d6b12dacf.tmp
                                                      • Size 13B
                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      www.bing[2].xml
                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2KEI6GG0\www.bing[2].xml
                                                      • Size 9KB
                                                      • SHA256 fbf87485846f6cbffd91cdb724b7f03804411f77443aaba992ba5c0c5ba4ecf2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      memory/936-515-0x0000018E37550000-0x0000018E37650000-memory.dmp
                                                      Download

                                                      memory/936-500-0x0000018E34900000-0x0000018E34A00000-memory.dmp
                                                      Download

                                                      memory/936-530-0x0000018E37550000-0x0000018E37650000-memory.dmp
                                                      Download

                                                      memory/936-529-0x0000018E37670000-0x0000018E37770000-memory.dmp
                                                      Download

                                                      memory/936-547-0x0000018E37450000-0x0000018E37550000-memory.dmp
                                                      Download

                                                      memory/936-464-0x0000018E36430000-0x0000018E36450000-memory.dmp
                                                      Download

                                                      memory/936-463-0x0000018E36080000-0x0000018E360A0000-memory.dmp
                                                      Download

                                                      memory/936-402-0x0000018E023E0000-0x0000018E024E0000-memory.dmp
                                                      Download

                                                      memory/936-404-0x0000018E023E0000-0x0000018E024E0000-memory.dmp
                                                      Download