045e8a56e0aa269d862a5794d7f2bea1663be470dbd49c4f016a5481757714ba

Analysis

user interaction
yes
max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FBI Setup.exe
Size 356KB
Sample260801-yaerrswvdt
SHA256 045e8a56e0aa269d862a5794d7f2bea1663be470dbd49c4f016a5481757714ba
MD5 c84a161e31cca406c8ad1a59cce8f2f0
SHA1 ef8cf7c0f8430d775895e444cadc580dabfd5ce2
SHA512 cf719aa69b735b9f4e7a6542cd5f2be00c24044436fc78238265c31e4393d7d1504a2a38e38bbc1d8d0766e645e983ee40323180d25e16b293b61079b7d4c287
SSDEEP 6144:IYe1CgGOYx2wYWK50NDl5mBLeughuOviCmhRPJyXK7swpe:IbLJYYWK50tvqHovih8Y4
TLSH
T1BB747D56F7A404F8E0A79239CD660906F772BC4A43609BCF23E046662F277E19D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1216	cmd.exe
4180	cmd.exe
5160	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2044	msedge.exe
2076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300864929540997"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{C64474CF-B5BF-4529-ACD3-34E08A2C305D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
6096	msedge.exe
6096	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6100	WMIC.exe
Token: SeSecurityPrivilege	6100	WMIC.exe
Token: SeTakeOwnershipPrivilege	6100	WMIC.exe
Token: SeLoadDriverPrivilege	6100	WMIC.exe
Token: SeSystemProfilePrivilege	6100	WMIC.exe
Token: SeSystemtimePrivilege	6100	WMIC.exe
Token: SeProfSingleProcessPrivilege	6100	WMIC.exe
Token: SeIncBasePriorityPrivilege	6100	WMIC.exe
Token: SeCreatePagefilePrivilege	6100	WMIC.exe
Token: SeBackupPrivilege	6100	WMIC.exe
Token: SeRestorePrivilege	6100	WMIC.exe
Token: SeShutdownPrivilege	6100	WMIC.exe
Token: SeDebugPrivilege	6100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6100	WMIC.exe
Token: SeRemoteShutdownPrivilege	6100	WMIC.exe
Token: SeUndockPrivilege	6100	WMIC.exe
Token: SeManageVolumePrivilege	6100	WMIC.exe
Token: 33	6100	WMIC.exe
Token: 34	6100	WMIC.exe
Token: 35	6100	WMIC.exe
Token: 36	6100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6100	WMIC.exe
Token: SeSecurityPrivilege	6100	WMIC.exe
Token: SeTakeOwnershipPrivilege	6100	WMIC.exe
Token: SeLoadDriverPrivilege	6100	WMIC.exe
Token: SeSystemProfilePrivilege	6100	WMIC.exe
Token: SeSystemtimePrivilege	6100	WMIC.exe
Token: SeProfSingleProcessPrivilege	6100	WMIC.exe
Token: SeIncBasePriorityPrivilege	6100	WMIC.exe
Token: SeCreatePagefilePrivilege	6100	WMIC.exe
Token: SeBackupPrivilege	6100	WMIC.exe
Token: SeRestorePrivilege	6100	WMIC.exe
Token: SeShutdownPrivilege	6100	WMIC.exe
Token: SeDebugPrivilege	6100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6100	WMIC.exe
Token: SeRemoteShutdownPrivilege	6100	WMIC.exe
Token: SeUndockPrivilege	6100	WMIC.exe
Token: SeManageVolumePrivilege	6100	WMIC.exe
Token: 33	6100	WMIC.exe
Token: 34	6100	WMIC.exe
Token: 35	6100	WMIC.exe
Token: 36	6100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6108	WMIC.exe
Token: SeSecurityPrivilege	6108	WMIC.exe
Token: SeTakeOwnershipPrivilege	6108	WMIC.exe
Token: SeLoadDriverPrivilege	6108	WMIC.exe
Token: SeSystemProfilePrivilege	6108	WMIC.exe
Token: SeSystemtimePrivilege	6108	WMIC.exe
Token: SeProfSingleProcessPrivilege	6108	WMIC.exe
Token: SeIncBasePriorityPrivilege	6108	WMIC.exe
Token: SeCreatePagefilePrivilege	6108	WMIC.exe
Token: SeBackupPrivilege	6108	WMIC.exe
Token: SeRestorePrivilege	6108	WMIC.exe
Token: SeShutdownPrivilege	6108	WMIC.exe
Token: SeDebugPrivilege	6108	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6108	WMIC.exe
Token: SeRemoteShutdownPrivilege	6108	WMIC.exe
Token: SeUndockPrivilege	6108	WMIC.exe
Token: SeManageVolumePrivilege	6108	WMIC.exe
Token: 33	6108	WMIC.exe
Token: 34	6108	WMIC.exe
Token: 35	6108	WMIC.exe
Token: 36	6108	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6108	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6096	msedge.exe
6096	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4180	4592	FBI Setup.exe	86
PID 4180 wrote to memory of 3784	4180	cmd.exe	87
PID 4592 wrote to memory of 5160	4592	FBI Setup.exe	89
PID 3784 wrote to memory of 6096	3784	msedge.exe	90
PID 5160 wrote to memory of 6100	5160	cmd.exe	91
PID 6096 wrote to memory of 2616	6096	msedge.exe	92
PID 4592 wrote to memory of 1216	4592	FBI Setup.exe	93
PID 1216 wrote to memory of 6108	1216	cmd.exe	94
PID 6096 wrote to memory of 2044	6096	msedge.exe	96
PID 6096 wrote to memory of 1840	6096	msedge.exe	97
PID 6096 wrote to memory of 5032	6096	msedge.exe	98
PID 6096 wrote to memory of 1840	6096	msedge.exe	97
PID 6096 wrote to memory of 1840	6096	msedge.exe	97
PID 6096 wrote to memory of 5032	6096	msedge.exe	98
PID 6096 wrote to memory of 3300	6096	msedge.exe	99
PID 6096 wrote to memory of 3300	6096	msedge.exe	99
PID 6096 wrote to memory of 3300	6096	msedge.exe	99
PID 6096 wrote to memory of 5044	6096	msedge.exe	100
PID 6096 wrote to memory of 5044	6096	msedge.exe	100
PID 6096 wrote to memory of 5044	6096	msedge.exe	100
PID 6096 wrote to memory of 1764	6096	msedge.exe	105
PID 1764 wrote to memory of 3808	1764	msedge.exe	106
PID 1764 wrote to memory of 2076	1764	msedge.exe	107
PID 1764 wrote to memory of 2680	1764	msedge.exe	108
PID 1764 wrote to memory of 2680	1764	msedge.exe	108
PID 1764 wrote to memory of 2680	1764	msedge.exe	108
PID 1764 wrote to memory of 5596	1764	msedge.exe	109
PID 1764 wrote to memory of 5596	1764	msedge.exe	109
PID 1764 wrote to memory of 4088	1764	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\FBI Setup.exe
"C:\Users\Admin\AppData\Local\Temp\FBI Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://www.sordum.org/9480/defender-control-v2-1/ 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.sordum.org/9480/defender-control-v2-1/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.sordum.org/9480/defender-control-v2-1/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a8,0x7ffdd6dfc188,0x7ffdd6dfc194,0x7ffdd6dfc1a0
        5⤵
        
        PID:2616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,4399263257654490124,2922983875978105705,524288 --field-trial-handle=2316,i,11789718470662012885,4403614310363304807,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,10045512280157629031,12994499519463616894,262144 --field-trial-handle=2316,i,11789718470662012885,4403614310363304807,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:1840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,2881969475353833195,1618193938008712906,524288 --field-trial-handle=2316,i,11789718470662012885,4403614310363304807,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,14330012784563613253,9338720488228154408,2097152 --field-trial-handle=2316,i,11789718470662012885,4403614310363304807,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        5⤵
        
        PID:3300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16273650331255112999,1686163409292492864,2097152 --field-trial-handle=2316,i,11789718470662012885,4403614310363304807,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:5044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffdd6dfc188,0x7ffdd6dfc194,0x7ffdd6dfc1a0
        6⤵
        
        PID:3808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,10023216975838836650,8849201286380876306,524288 --field-trial-handle=2860,i,12975445105952204009,12814451260893500939,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,2028393029731042538,16937427408612829297,262144 --field-trial-handle=2860,i,12975445105952204009,12814451260893500939,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
        6⤵
        
        PID:2680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,5604947803404128165,2033421772646221361,524288 --field-trial-handle=2860,i,12975445105952204009,12814451260893500939,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
        6⤵
        
        PID:5596
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8503992543592900637,9060652981247968703,524288 --field-trial-handle=2860,i,12975445105952204009,12814451260893500939,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
        6⤵
        
        PID:1260
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8503992543592900637,9060652981247968703,524288 --field-trial-handle=2860,i,12975445105952204009,12814451260893500939,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
        6⤵
        
        PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC CPU Get VirtualizationFirmwareEnabled
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU Get VirtualizationFirmwareEnabled
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e3dda413deb0056300d64212636a6785cc542fbbae4383b4383d4cf0ebbc4
MD5 fb1e85b1485d88ba9cec2cd1f023e621
SHA1 aa0fc9167f42bc9470e917c18515afaaad960620
SHA512 94193e242c6de1dd160dfed5c111ba549c783ae9bd7ef959f60c690664d2f3279ec6a50445fb7fe4b959e2c95eeb27fa56c5920a84e5d00761487e4265cb997b
TLSH
T1CAD0A7B61A1EB490F27D0A32A011C700776D16E32D52A305F32C880CDDBD0D526C66C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4d6cc12d6f728d177659d7db896abe6817138ad18280caa887f70b7c1efecee4
MD5 c79f1f15540c15e4cb21c658a1ba9312
SHA1 4e0fb958aa52f0551a4f70b468b8dd66f83abdc8
SHA512 5fdc2634dd86621eec4536f6648635d765aa4c5dfc0ac0465855389f046fdfbb4661d89dba3bfbfa5860f3b3afeb521ab1e093aae3aa0f2db0b6585f80d8d76a
TLSH
T13BE02B65CD21FC2708FD0B19A059865AEB4113172640499F3B3C910C8FF062645C595C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 4506f9b8516baad86ca4bd0fbd6d9ab01e559b4fc1cee503e35ac25c3a1bd8d5
MD5 40333acb1789f8ab29f35b2ec655e9a9
SHA1 966324fdd28ac5d4484c9dc5f318a6584ae7f6ae
SHA512 efe5e0220c54aa0de1cd0ebdb1574fb0b23fc21666312c80e8317249e236f18ec1906401f755aa9956b23854240acd3f2790345b06c1063bbc41c3038bdc8808
SSDEEP 768:NzzTBiEAq9vL1dVxrJxwTEtUboBNSUvF7:NPTwrqp1dVxt4dIAUv1
TLSH
T1A813803D7EA60D96DACA937D090B4A32A73CC531F7D1030F333AB516165635B8A9EE18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ea2101aee3598738a860668277ac9ae59e57bc272d0b816b18999de384a10ee5
MD5 db9ad1a7e6b1c64d5fca6d71603429ee
SHA1 a2bcfe11df2e818c4fa457b487c603b7f05b5346
SHA512 2c5696d798e8b534a02020d8fd42bb696cd44e8e67e345abd0eb3384fba3a9f6fce77aa81bbaf67ab96be949d3fabeff9da91a116ad7c4808fe447d3cb0e5907
SSDEEP 1536:JUL/cl5L/G1JexlMSGMQhenL/C8L/akbX26L/CIPUXRxgBKkdTrrb08sA0BMX:mL/uL/NxeSSWL/PL/XL/yXRAKkdfrT0
TLSH
T152444DF70951A05BCFA802F5E2033A3DD177055D7DE1E8EAE6784CD12825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 885ea7a8a8f00fa828b2ec27b7e3590f3589f2341761cf4d189e3b7306574bc5
MD5 0bc23d1e8f579c1aff7d76e667a0646d
SHA1 918dbae750ac7e8dc3df4f26f65889a99cbe68f9
SHA512 a0ef39477cc3735dff532a8fc307d3e29318e62fbd59d2f76b6e935e82e4c2a5b7e73133c4f429090475f555b89be08d6fc0079a783f0e62ef3f0ddd7fe97825
SSDEEP 24576:SYIollX+YmkVoA59FRLlPygYWAM9PJhe49JDs6uYYEk0xMuIpOf7w+tROqx37:SY11mkDLlPTY+Py49NsIYEbM67JHz
TLSH
T143867DEDCA6898C3CD639A70B0F0ED477C7413C3F595C1D68898C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b977baa0cab3fdd993e7199a7751efb9cf20fad5d307f93d93c1a29c32edfa79
MD5 dc5d9863fb0f12e7601d9a99979c11c8
SHA1 29d3ba21ecaed5e959f58decea4d4925e4692347
SHA512 fd9ff92e09b48248023f223af2d25acdf84b5572abc63ded7230463ff678b189fa00fc942e51fca3ac5646ee737ab49daf84c37c6b2cf8c5d774c4d379b378d8
TLSH
T19E81C63625524DF9D7B1037A95D01A26F432C6EAFB275FCF2140A0772931723B29B719
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 c26bfc870e4782f952d88a96ee8c625e4c0d44b6c77150f03d94b549cc39030c
MD5 81bb00f30d2d86ff93c2f88c8d68a930
SHA1 ea97085e8f167a9e9effb9b44341cc5ba435c893
SHA512 6821ea87a99d0488b52f653eb9c122b642dd1504262e81ef84e8bdf48da759ff6a5f95490a0d973ba507de2a4068972f5b3be83df1f0489c3bdedcdd054ea02c
TLSH
T1AFE0D8D495C6C21EDD6035C75134AB08D2D83443EA89ED0F5B008CC17746102F297DFA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 f0039d0e26388f98e213e1e09282fb88fac60bbcb6cd3d8367ce8bc7bdeea777
MD5 d1ace995c070df7193b9818024a59db3
SHA1 0fdb968e385b8e298f801c7a67f5d5e661d95ab0
SHA512 ad6de804969a704969cf07e6041163b41b1f859cce202ae568f53813ca5530026a706dd1747fa3b4c30bc4a7e52e0eab61e7079c510c8a2cc42e5d342dbd5239
TLSH
T196E0260805C8C22AD8646DD393794308C3D03903BA88FD071F089C857201242A3EE7F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 d486cd80cb3ef763cac0f43d254ce5992cfb40200c36ac0a089740ba2033ec8c
MD5 bf7a0dce49e3cf928cf0f57c897df0c6
SHA1 295e56fca6e3c9b82449ae8f793d0443ec4be2a5
SHA512 70e9ddb91ead0004b820682f4e9c46714e356a0d28e6fd8b7b816e83c5d94d84a028c29dd4eb5ef0100def5aa3876d8a829304fe93c3a8f6de5f98bf489ad37f
TLSH
T1E4E0D86545DDC25AA92429C752356B8DC3E03407EB8CAE061F04AC45B102004A7D19F1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 24c1516e79fc4f6da84dca6014be1f70ef4d8dd92f8491738480e8065e8ef065
MD5 ad68eed3c529a738330da42e840f7709
SHA1 cb1e904f8d584fe6b51ef514353569a7ba28f1dd
SHA512 547ef17b81165beb6235b85db444e1f7a7a60e05db8b3b4231c9dd43dbca2481160224aacdb5ececbcb4b002e6bf37f89ea215a8873ea5fe05c960d069c8fec5
SSDEEP 48:T2SLopFMatSaw/auUOt8BY+omJwHmv6rAwH:iSeMatUaAKXJWmIAA
TLSH
T11392410D0F346121C0B02B76EDE189633F7C201C93B37A999E0860F3CDA269BF5450AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5d80d0fd3f882eac91aab54c1dfcd147aa2fdab8d7f1887935a8c9938b46ada4
MD5 3eeaf7155ae64fd435199a7044991ad8
SHA1 cbf867383780647bb60c6813774b8ee2defda622
SHA512 f612e3a8f0355a445b34bba54693f53154c3e9c543c709008dcb9f02caac30bfc83c930a44cc212ab5d354a7db06e0fab6cec339e8d2b86048857d13577e7074
TLSH
T1A931A1F743B4856E9A1196F0AA18BE2FCE2D0511432C7DA985E0AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 4bc7d275e8d5a7dfa21a499c88dd0ab1569e6af237c3ade7c9cc2946f497601c
MD5 2dfce8474861b0faf21ab204f5f743ab
SHA1 d21988b18a1c0ba614966fd89c0f90f4e0068871
SHA512 0da251fa81ce57fd78661b97a7f535fdf67271bcf4dad9a66cb546fc8b2b408f8c32b11b3d33f43a52e2f61b84366a8069134d251e08a9032c0e6815c62df6b1
SSDEEP 48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS1lSA:eIEumQv8m1ccnvSIJsH2hf5nFX05M4g
TLSH
T113F2DDFA07236205D98444B0E4009FCFAF16014B47B6B6EC76D447E3F7A21E2B6B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 31108791b9e2594a1ab35283a4996c8823fe91b924ffd93938bd321aefd3a540
MD5 5e797843eedd9aef4c6e245fc56ccd08
SHA1 1712ac8d1d81a55f84dad2f0dbbc7ab441790872
SHA512 52fe46759b265f0930ae1c3a64956a3777d3df15c2b2b891dee4103865a6665b5e7c73bcba5df7778707662f82bebbb79b23598a11650a2d90a2433620bc3b3f
TLSH
T1CAC0222284BAE8B20074483A2AC2A8806678C076040048A0C9A7C23CA0901B75A0202A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 328e05bdd56533408b0297ee15511cbcc3e41d5a888640dd50482c00ad4357d4
MD5 97efacf20b0c06ff3333960f67ecf423
SHA1 2e351c7e0f672e5a330587163db5e9eae707378a
SHA512 65039f636ed73c3891e6db5669518bc563911d50ed2f2a6cfd7fbf9f0cfaa30df22f0119756bedb18e8b1b86f7229ab8720232f01771ada9b273a30a9f67b336
SSDEEP 192:sxZYRHyMqZjK1Ml85jM/f4ssuWpVnSaZdIaRuvfzodpLHW6+WNGYveN+58IgZHJ:sxZYMoM/f4ssuWvnSazIKY0LHbGI+Zp
TLSH
T1FF7208066A28997B8DD7D21DFA457F93D7F90523A1905E4499FCCA1C01EBAEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4a5af2e8cd80c6d6d6b2a166236117d87b9340370175ad8dcb67117432342e86
MD5 944e3e14322f6e7f74f741c6a4c48d62
SHA1 e8e6514fa77aa4fc65846673d7e2bade326392fe
SHA512 655655390b55c622f4b4b7baf82202bb4717280fa99fa4ac4411f78e38021676fdb96c287143f4ac19e369361e54176948a588e1288b6c93657e3d0f726abf9e
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0ysy10Ll3:eY8Od/HEnFhWvFvmXu1jast10Lm2NuFW
TLSH
T1DBF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 6ba1b6204928929497545b869eabb81dd7c430a794ae9b2e8e4caa919a291316
MD5 1fc1247d7febafbb9ca49b8e82c676f8
SHA1 8fb27607cc12f3f66dc4db6c0c5274f26f2194d0
SHA512 060c4cf41bbc182165bfb708446b8fd42ad1297944057c1015cbccb95f9923d0d7b23faee785249ef9577024cfb17c83bc048a6beb38432078dc20c91d28283b
TLSH
T121E0866419C9C27EF82772870274870892F87427EECCBE162F44DD416242546B6F65F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 ea74e2c7f398ed935ec0f72a089dcfa5d325d96b819f01b238d0b6080395cf10
MD5 c75265f81d85a2113fa1c563fd12f34a
SHA1 0b4592ca3b6bf16479669f95c313b44546e7016c
SHA512 c37242298afa9784457fc698edc1a86cf0c9617ef31b7369fc8e3ceec2b2d26310108f7b7217659d7f91038681bd138ca01f4fc53934c9a3a55bae9193550a0d
TLSH
T151E0D83416C9C72BB55531CB9674E30981F2B413EEC8A9252F08E840730614473935F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0fed329fbd553f6fed2270061ecbf93838bc8d943976438d7f1ed85ea87b2953
MD5 2a715e443c3a20e49ebe0243a3aa9cc5
SHA1 c69d96b3b6a37f0a4936d8d3e9e1701df85925b5
SHA512 14f7f1be7e40ca2ca7f3cfdc79c75ff857712c1261a5cd0800fdaf1512176d06691dcb3a3d6c685a30c4095c9322f2e4e922b0b2784dfc15bb3225877c8934fa
TLSH
T16AE0867855D9C33AA965B6C34278970D82F47817ABC8BA5A5B0C5841A205145F3F6AF0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 f73150bf1714314a0fc6286adde3b2a46c81330b788c855c550cdad8372f0abd
MD5 7f5e7f1c6b48b5abe32d54ca9e6c2096
SHA1 56ab1bfb96ae38f44a2a926d8043d226fecf4e09
SHA512 b38fa9a6cfaa82b9bbcb728e06d91b129e7731d421a6d4328ac64ea5972bc43393e48ef3ccbc308709be224047c1ad215e8140f473d1f2e13b224d7c0fc3daa5
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9JyzGi0wMBwtO6uBmsRCiN0C5WeTI0eY4HU9IM640:0LppY93PBZJPtN53t7t+
TLSH
T14AB29B1A703E0211397E2958B3A696364F4235A37058E4BF7FB810A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 98362236479abaf0b2c67526b6f677ae62a75f17dad817604680e8cb9a2433b6
MD5 78d5bfc4023131aedda58b2d6e97a86c
SHA1 038997d682b0681a57505635962a234a0120802b
SHA512 62fca4c76d5a27d0934bacb5718390067d5fd4fea19d2883f73411c6378f1f30791b7dfc7c3970d555f7481e3084c82f26fbd24c45384fd9a1d92ce55dc6849c
SSDEEP 192:P+xW3X7vNfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxONfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1BA24730A7B747001EDE6D9725CB080771A3CB16ECF22A6D15DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 05c172a6b925c2ee5b1c9872947e7edf319d8d93f01ab4ed4b2ff61df2922833
MD5 f07b4c1c0d6b597563e960fe0c014d23
SHA1 4a50526f2a14cff259e8feaeb21d790284ac0d3d
SHA512 d98ba5801ca369ffb001eba301addba0ee12884dabe4f702bbd42bfbd354aa9f4efe17d6aa6756927ecc4f5766ca56ded729599271e2994cd10f698314af3d9f
SSDEEP 96:ua89+uFgxZ9jQgOXOZeDWXWY1lDkseCyAWVBDl9HNDWWVMFP40wl5N:mQOA4AsBDl9HNCsMFP4fl
TLSH
T1A322212CAB01B73BD00D6EB7227A4B5487D2E08342BB676E7564085D1FD262787C82F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 7f279d762ce5944ff6f8dfb0081a1677c05a47cba22c55fef606322ae58c00ec
MD5 3aeeca46351d15211660b25358098a0f
SHA1 a5a62748c7ae6d1c3e9ad8c63d4eadaf890d868b
SHA512 34594d0eb24377bef366e8f831030885db86fb275604731a544b6af0c321ca7aa3198345a031bad907e4a07e02e2dee04513436af2083832f0765d868518cf79
TLSH
T193E02618A9C8C26FE82521CB6234430982D43903FE88ED0A1F00C848A201141B7E65F1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 813943675d1e1a7c0fcf9ccbb89fff24be90fdb5d910cb641ac535c09cde1adf
MD5 c67f8d0b8ab1b78a586f94bdf7d27370
SHA1 e486e919c4b3293a18b13d345f95dbd1ecec9b98
SHA512 7f65e37388f0377007e76125a56ce26774addb71a44b192fb8b52dd19da1316d781748ac33d98aba2b600fc7d88c67265e67f1782cf36c71f44abf3e0eb91ae1
TLSH
T1E3214C15F720D158E18E863AA46BAB251378E8528FBCEC0F847924752D72F044E8B6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 117f19315ba11fa3b0205df8d15bff8841c39cc16c027c93f48c74707ec74e29
MD5 bf8034fa902e196b461368be670415ff
SHA1 db730696e20b5307d00c2fffdbfe875fc71e3472
SHA512 f9dc218f197d6a6109ffb995c99d57b05f8851129147410cdcfc1b4148eac9d10f4b2939a961d90f9bcd72ec2268a0bf14d0e640579a55faa422ebb15927978b
TLSH
T127E04F54A8C9C2AF997523D31178934892D53847FF89EE1A1F08AC4DA605346B3AB6B2
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9502179345e83174ae1fb7c8c884e1c404283f116d7de6054d2753d533953335
MD5 5113a871a26976b9453e1d8e7852a046
SHA1 7ad850004464e21bca422776f19a4381bdd1778b
SHA512 72207f5ea65ab68263e28e9db66c77338a813741caee226f97fbc9642feaa7faa33fdaf95f37e8ea7173e41d5f7427665abf5b3b187a2a550b8d3de918dec050
SSDEEP 3:MsEllllkEthXllkl2zEflIll:/M/xT02zd/
TLSH
T11E4404547FC00405C5005030C051C3513771D550D571574774D304335CC75401C11004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 4fcb758584bd65b091b960b887ff272a50719616e5a02d8c566689399cc83069
MD5 a78a7db3a705ad8a648f456cb59c482b
SHA1 ca19e74e6d8536ccdcc2f18123198670d0e6ef11
SHA512 7912421eb74cc2da7a3038a9582efe321bce4e8a105838f962556c07a8b8150554fffd0dad17168bcbeb78679b244b810efd7d8a38463deadfb7c3d01517c620
SSDEEP 768:pBF/cpsjwgvk/QoGP/sxlR/8WiCK4GHByXY:Ysp7mtljgsXY
TLSH
T1B4E21872E8949DFB98D2CAC9A78AB503ADE05133858C899CD6F82D3C309F1FC5347965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4837b2521bff3779812dbcabb5f74e403ea4cc42816f6c9830deb2b1124b0a3b
MD5 adaaf36e206b357802189b66e744af5f
SHA1 23fba5d2c161eb65a1e2e9faaa8bf3bff6b7c1d4
SHA512 8735867e42be3ff1420083529a8bd7913b99459dbb899ad65731a59cf329233f153f5c44fdcda9ddbc0eb43d6357cda686614857177dd24bc74076df13cea45b
SSDEEP 384:npgiF9CcmyWCs3sNF8TUNTUlIm2QckCr9lWKphiftGP/scZpse4KV8p0+Hrty/7j:p7Fccps3owgbkUokoGP/sc4I8p0oK
TLSH
T103B25C36EC68DDBBEDE34F99B74E3A03DEE05167859C59E4CAD81E1D00931AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a00ae8c8998085a83f1071b20b28fff1d2d0d496cdf96ecfa3241a4588985697
MD5 d0c36e3c90dcdb4ddd53374ecf259004
SHA1 afcf61d18d21058a926fb08134ae67686d39287f
SHA512 52c480197c890d3d87edee75473085cb64817a48cb63f9f7058b7433a4bb73a52d449192747e1bdd098d835fcf4a2411f74b413215fab7ac1de91c9e47e876e2
SSDEEP 384:npKiFPZcISsNP8TUNTUlI4sQckCrGc7uphiftGP/sxXLZFUXLIF7Iz5wx:pBFHSqwgRkyQoGP/sxtmXrc
TLSH
T10BB22932ECA4DD7BECE78B95B7893643CEF0516398CC5A98D9D85E1C00972AD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 9fdae561a78802886b57019a13aa10b184e193a627fe5620c16fd1da642170cc
MD5 5b22f8ea57b3ea2cf68f83a0eaff6363
SHA1 7cc520b1971d2d4e54ea3c6debd8fb02b2b1b776
SHA512 a833a7b6658ef26991d63b340d3f65f0a47503b3d97e409572ea9217d13d67cd8909031b625ec1d08ecace5b7033727658abc4221b89b078a2c9004c6ce8c86b
SSDEEP 768:pBF/cpsjwgvkmQoGP/sxlR/8WiCK4GHByXY:Ysp8mtljgsXY
TLSH
T191E21872E8949DFB98D2CAC9A78AB503ADE05133858C899CD6F82D3C309F1FC5307965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1bd3a8d64dc01d66938b63b22b5df7239b3c44caecdcf26dc89c9d0a2964b342
MD5 0f31e966b2aa923967f487db625f7dc1
SHA1 c5f26ea8ab58263060bf6d5cc2828801e93b6417
SHA512 be091469a919b7d8b46c7625e62e6fb68ea284a0a30dd190fe63fd47eb57c551828a41a8245493b12e6b7034224c68fc46de62edc0577a06c6f6a915e4f8cdd3
SSDEEP 384:npaiF9CcmyWCs3sNu8TUNTUlIm2QckCr9WSfphiftGP/sxXLGy3He4KV8p0+HrtM:pRFccps3zwgbkUfRoGP/sxay3I8p0oK
TLSH
T1D3C25B32EC58DDBBECE34B99B74A3903DEE05163858C5AE4DADC1E5C00971ED530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 340a7970990cb2db32c1d848d8e557e4cd98bd046055028d41b572ebb1522c6c
MD5 e8a927c7ff6ab3274ac63dfd9bbe41f8
SHA1 9c272c62c745a84ec915b8def56232da68109f33
SHA512 00d5ef02da3be93488f13d3afff685fce104a86b783143281a5fe32af31d5169887b55b9014b294536683ac8358b6c6d62bf8ef49692bfeabb8cafcc75c89115
SSDEEP 3:MsEllllkEthXllkl2zEflwmGllll:/M/xT02zBP/
TLSH
T1DE4404147FC01415CD04113051D1C3707371D4D05531577334D107337CC75400C13000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d28fe52737fd5e4b695d525f25c0d081bbe0e37307860790d1d1af347eb37ef4
MD5 6386767f91e107f66d3273f5d8540c63
SHA1 5f134e7b35ebc3bd49ea5ab81c4dd880bfa1ec7d
SHA512 1ea9cf736dfc039631ae94ae52cf3cd5888567f5c276d50f5837394faca236aad07a5a125c29c1b2e57f26d1aaf98d75433cfd891222eefcdee3f06086199e5f
TLSH
T13241185CABFD1148B3B7AE46ABF6646D447E79731E07D59D10010E8E0633A04D8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 3e0b80184705690a4051d94dca1762d3e2ea3b9e1fe5f08b0e81449c7a9887cc
MD5 d77ef22d1c0f3f295275bc86df83565f
SHA1 b86b9db248876c3b0a88acacc5efb7d995da85b2
SHA512 b8e1b77fd88bfc3e1ee327717b2f17492ff6d0211d7ce8de460dac9614bd3c5691cc059a6cc8bca324746a6e656dfe0c2dc31523898af59d6f0fc30683e59794
TLSH
T1CE514B58A6F91158B3B3AE5A9BF6686D497F79273F4A905D10110E4F0A23A00D8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads