c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23

Analysis

max time kernel
148s
max time network
191s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ultimate.Ragdoll.Game/PCGAMESTORRENTS.COM.url
Size 202B
Sample260819-e53brswgqd
SHA256 c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23
MD5 420715a04de8367bb8d37d57ce1d6d41
SHA1 710369a636391e43be7149416d8e9b390863babb
SHA512 8737cec4730f412c18e508076d9fb7af2ab10b4b1637c70c2f76c1c6ca7bca27021cbe56dc3305a4ea7704f7ac2c6e005d02c605a4e7f9b0a709bb94cfc7f457
TLSH
T1C1D0221D8705C2E5EA43A5473270FC48A84F7D5819D6C4689748CE8E0CD47C0C85CBE2
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2444	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_886649904\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_886649904\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_886649904\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_28701083\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_28701083\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_551809536\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_551809536\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_2111992820\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_2111992820\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_886649904\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5104	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315882946453379"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{1B55BAE7-CB5C-49F9-9CE7-68AC9502EC04}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2444	2404	rundll32.exe	88
PID 2444 wrote to memory of 860	2444	msedge.exe	89
PID 2444 wrote to memory of 2084	2444	msedge.exe	91
PID 2444 wrote to memory of 5104	2444	msedge.exe	92
PID 2444 wrote to memory of 2084	2444	msedge.exe	91
PID 2444 wrote to memory of 2084	2444	msedge.exe	91
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 3792	2444	msedge.exe	94
PID 2444 wrote to memory of 3792	2444	msedge.exe	94
PID 2444 wrote to memory of 3792	2444	msedge.exe	94
PID 2444 wrote to memory of 3500	2444	msedge.exe	95
PID 2444 wrote to memory of 3500	2444	msedge.exe	95
PID 2444 wrote to memory of 3500	2444	msedge.exe	95
PID 2444 wrote to memory of 5024	2444	msedge.exe	96
PID 2444 wrote to memory of 5024	2444	msedge.exe	96
PID 2444 wrote to memory of 5024	2444	msedge.exe	96
PID 2444 wrote to memory of 800	2444	msedge.exe	97
PID 2444 wrote to memory of 800	2444	msedge.exe	97
PID 2444 wrote to memory of 800	2444	msedge.exe	97
PID 2444 wrote to memory of 5420	2444	msedge.exe	98
PID 2444 wrote to memory of 5420	2444	msedge.exe	98
PID 2444 wrote to memory of 6492	2444	msedge.exe	99
PID 2444 wrote to memory of 6492	2444	msedge.exe	99
PID 2444 wrote to memory of 5508	2444	msedge.exe	101
PID 2444 wrote to memory of 5776	2444	msedge.exe	106
PID 2444 wrote to memory of 4264	2444	msedge.exe	107
PID 2444 wrote to memory of 5892	2444	msedge.exe	108
PID 2444 wrote to memory of 5148	2444	msedge.exe	109
PID 2444 wrote to memory of 5148	2444	msedge.exe	109
PID 2444 wrote to memory of 6304	2444	msedge.exe	112
PID 2444 wrote to memory of 6304	2444	msedge.exe	112
PID 2444 wrote to memory of 5556	2444	msedge.exe	113
PID 2444 wrote to memory of 5556	2444	msedge.exe	113
PID 2444 wrote to memory of 3540	2444	msedge.exe	114
PID 2444 wrote to memory of 3540	2444	msedge.exe	114
PID 2444 wrote to memory of 1276	2444	msedge.exe	115
PID 2444 wrote to memory of 6128	2444	msedge.exe	116
PID 2444 wrote to memory of 6128	2444	msedge.exe	116

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Ultimate.Ragdoll.Game\PCGAMESTORRENTS.COM.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pcgamestorrents.com/
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffc2171c188,0x7ffc2171c194,0x7ffc2171c1a0
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,5624606811686554917,11719235238404909577,262144 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,13291359260732536420,12976676518687079465,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,3193718865179539557,2900936089594058840,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,5437810485766651159,11471306805888975291,2097152 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,15738649570808113297,12682085622203266940,2097152 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5096,i,7146371907252767341,5893716162255162317,2097152 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5112,i,7306628776372157147,4897612868817195485,2097152 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,15311874129250913221,1641146230941649337,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,16061527320005643555,11568957242245601960,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:6492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,4180950105406369706,6701861998328619322,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,4180950105406369706,6701861998328619322,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,9657265589434156873,15945222276017840517,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,429965552605008299,8557815556656552014,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,7683037782673457761,4429625052254789082,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,5807761872122321305,15909895360715051329,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,13358630951521532195,3333865360698093043,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,5211751616396977728,17394969090644313088,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,13799687013916162485,18103387436113709499,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6760,i,11168666199005459588,8162519640622376219,262144 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3342208022889796526,3161952641147925289,524288 --field-trial-handle=2420,i,13159744789957804271,2534964952489962988,262144 --variations-seed-version --mojo-platform-channel-handle=1452 /prefetch:14
    3⤵
    PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

718f81de-ee47-4340-8067-754eb94e8a51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\718f81de-ee47-4340-8067-754eb94e8a51.tmp
Size 16KB
SHA256 b4589299c57ec1f9e7b484f4e17f19317bd76e6c8b0ca76f33716a6569604b7e
MD5 eb32578eb6579e4abbeb14d49c01f43e
SHA1 24da313900f37230382e6797407fb432b377977b
SHA512 2ef12cb670a1b89200528ef4c4e69c72f30b110497512f2b1d654108c9dce07fca2bc729460894a5010dd8de19bd2630a6fb405fc17b6e1a59e3f2777cbae955
SSDEEP 384:sxRN68g/fZsWl9N/RIPC9/5s/PgrnsGQWjs:sh3g/fJfWU/5OPgrnsGQ3
TLSH
T13B72D816AA349D7B8CDBD219FA55BF63D3FD5163A1905E44AAFCCA0C00E66EC210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3919c68a454839245b1b13fef933a0d73550335a77ad77f14a426f6499a53437
MD5 3b282c609181588ded0c77fd73e82cea
SHA1 a3d5f98ed192dca0a3de8f6396e2745e31d7dbf0
SHA512 eac61ba240518f842559437c423c6a16cce2c76ee7b1aefa71f23df5b4a6b1ac042b0db29d5439f381ef110abf1fb0bce9c3848810a1b2e68613897a306a5843
TLSH
T148E022A9CD60BC271EFC5B18A1584687EB40135B3B80894B7B3C81AD8FF463B468AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8dd8ab721edbf26823558235b8200b5bb2036db2e7aa3b4fa796ddaf1fcc3c66
MD5 897c68df85acb74c97950f9b82dff2a7
SHA1 4c8cec4dec3207ee2ac8211ff991968a351b24f0
SHA512 ead58746f42cd69b1a8895fbbdb3cbf0432df46a708592bea8d35e42cc0deb69a3135ba563158cda2a09c02f8c547c442325b67aeeb0de41ca5a4eefc037bb42
TLSH
T18151C97463BA18C1C7209DB254D145D6BEF0A2F9C647FF015CD89E718A2AF94A0E00DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5dd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5dd1.TMP
Size 2KB
SHA256 fb3e6ac9d41745af2c6e603288307e7d132264fd77815287bed8e7b6e471d70a
MD5 704d33d0dc73e5bda9c1446cc298296f
SHA1 100e06e9b429c1f4ddbca53d2f695f64fd024eec
SHA512 a7630add5e36870d3f71f84a76e018da8521fc8ec41e4f4482fb049074b52514df88ffaa1573f158b7db88a35e0e84028acfa2b8837758ed290fbc46df58c4c4
TLSH
T1B051647463BA09C2D7619DB154D105D5BEF0E2F8C257FF0568C89E348A16F94A0E00EF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3a14feeb89df261ad75807791b096e65455ebaf49fd125310943ed201fedca4b
MD5 b0d80a3a9342e4cc6c8b19a370cd0562
SHA1 ecd834056ad3c7e5687baada58d6115cdf924d33
SHA512 2f1a657aacbf690a151e16e9246cb002516ff612186fae4185c22db8f326e5be5c9fbc305f91e839444591fed4213980d9d779b96fa39ea7028c72b79e3ef838
SSDEEP 192:D1xXRqcaVZaij6C1Nr78vSVEDcqD5RMB8C2FdlJTT:D1xXRqcaVZaiGC1Nr78vSVEDce5RMB8T
TLSH
T103D1C9F7C3A48A6DD91265F0AA147E17DE2D0A34536C388AC5E8AF0F63F2460D20575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 af83bede0e8d2f3a2d7ce19a9b865154f2dba1095dea8449ff659542cceb5b83
MD5 291e5bb9253849e0df89a94e60e249f1
SHA1 6e6b7581b3350482d7de3b9add0b9dfabb9e1462
SHA512 dc9576fbe91414fb858255ca266b62d7f4b98dcd040cf34ceca46c512f66a2bcf6a2540e9c2ce20d7bd5517568ad5ce65bb401a9707be8fc85d78ad4d5f5e7e6
SSDEEP 384:sxRN6qfg/fZshljN/RIPC9/5s/PgrasGQW5j:shFfg/fopWU/5OPgrasGQS
TLSH
T15072E716AA349D778CDBE219FA45BF53D3F95163A1905E44AAFCCA1C00E76EC210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 79b61325c40edce613bda42feed2d5ffb60939a7d78b8001ffd6de1db3ec5578
MD5 1aef7b0ccc9b456a3d486041679d0b25
SHA1 6c6001259e3f31394e626fe859f605ebc02b444a
SHA512 12cedee28571f7cb5ec9bfaad10599fe938dc8c74e3b7cce9cd6147716864e6874bec609aa6f25c4e9b890b5acc6d16227be4517f7b4cf510d1f1a9a1de242a7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroO140:Ob4YZnE7yTWg1NfwBu1jakobHwAOq0
TLSH
T13CE2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6db1ba7b8c4018a217fde29c9491d23277e7ca2bc27ffd461feba6b6f3af130e
MD5 494508a98037279f1168365ed6d54571
SHA1 c71c2d0589ecace063e091f7e08c987087ced342
SHA512 8b9cc4d55d37c47d8c8b7dbbb4264345ddd1e57d3631e97b267716f79aa67f2627ccd5acca376b23248695c38f256d3d774f492f2a42db2dd8a32cf8f27b7775
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EExiWESiNG/SOoQBUHMU3eipvIN:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRO
TLSH
T173B25F51713F4680387EB90C91B8982F96C2B4637419E53F7B6802A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e672a4682eeae59b329c511558cb497048aa8a4dc3dc8cff88de27beff8051fc
MD5 e67aa7e379d8ff4f8e2e15c2beb11cb8
SHA1 9f053d4d0f9ec3dcab37e71bda06b966cc96b2cb
SHA512 769a3a3484d26097cd646bfb0e8e771bc3c69b0b522a8928a5fc07ef87cabb339e6e9f38415855bdc507f7d03162c6d5a36ea62d0e07daacc3ff4127f7bea3d0
SSDEEP 384:nNiF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTutREqf+GGECXcMsLaOObjI9G6w7m98M:EF1j+9SXOwgUuMZGEPha29Mm
TLSH
T10CC24A36E865CEB7EDE64FD8B74A7A46EEE0516785DC59C8DAC85E0D00C72AD0303C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d7fbe9169371d1fcfde929072899bc79329e8f63b7bbab8294a04826d90b255d
MD5 7dad2de0407085b8b166e8e82d2c3a0c
SHA1 9221d6daf9794f7f0b49b7f966f77d789e5bf750
SHA512 ae76f53fbd71ee1cfefeef2a1b7a878ebc7a15ac79abaf620e9ea816ef2bd7e7582b6a4c72b7f184a814ee364c291bc737a5a166c32b81c373b985b1304c1d21
SSDEEP 384:nriF1tNn/s3n9Sn8NgS8TUNTUlIRiPvuT/40Eqf+GGECXcMlZA2kFOObjI9G6w7m:GF1j+9SXSwgUu0AGEPpF29Mm
TLSH
T18FC25C36E855CE77ECE74FE8B74A3686EEE051A788DC5AC4DAC85E4D00C719D070781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 ca217ae8c7c57f1e0e79031dcf3d67de152e9590eae238482e7bb905d06b3caa
MD5 2526f3a413ed8d03ccbf31fce1840752
SHA1 555129d2b83a78b4ddc214b1c550414307d1a7b6
SHA512 3ad054cb0460edd2c85f13c86aa006ed04cc8848fa10275467a41f7b32b130e414bbbde0c2db9aa0ebf86c576a400c6ab103870cdf228ccbceff99ad1a30397a
SSDEEP 384:nEiFiZcIt8NLS8TUNTUlIR4PvuTyQg0Eqf+GGECXcMlZATDFQiYsXq328LEEIzsu:fFQtQSwgiuezAGEPxFNYLNBuN
TLSH
T1E4E2A1F198E38977D8AE5B87677D6E419AFCD163B4884984BBC85D0DCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ebb183736312ae77851d196f158cee535d3048a08873aee6236c5a2d886d0ae6
MD5 180847cfe423287ffbec962525c49ad2
SHA1 69eeb1a4485e544f4cf3a034bf1d7d9e8428a6a9
SHA512 0a33a842f72777fab629229b5af4c5d5c0fcad34bd3087862bd49f745874b6d581ef2bb80dd221658e2faa5882a63cfd9d097ba0a221cdf01af3b65fadd5bc85
SSDEEP 384:nPiFiZcIt8NLS8TUNTUlIR4PvuTyQi0Eqf+GGECXcMlZA2nFQiYsXq328LEEIzsu:aFQtQSwgiuetAGEPYFNYLNBuN
TLSH
T18EC25C32ECA5CD77ECFB9B95B64A7242DEE45163899C9AC8DAC85D0D00C72DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 571bfa94de42a0a7f5c0a4bce927814b81cfcd0fe0463b062604d30b0a0b8435
MD5 489d9d022f423ac2642639120bed9ea6
SHA1 19505729a2b11ce1c1149b62a3fa7d5fe8d3c803
SHA512 6ab3992a538884f2cd2fb4c49c5ca7588076d823a6a2633090f07d3be204fe7b2226d329afaefc61f13e7fd93ff020a7634a3f21fb905489c277e9c7f2af7c84
SSDEEP 384:n2iFiZcIt8NLS8TUNTUlIRFPvuTyHi0Eqf+GGECXcMlZA2nFQiYsXq328LEEIzsu:dFQtQSwgHueCAGEPYFNYLNBuN
TLSH
T179C25C32ECA5C977ECFB9B95B64A7242DEE4516389DC9AC8DAC85D0D00C72DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c588967d7a6416eedcbfa0801806f5137d43ab27f0332710af7b137709088910
MD5 6e4314d23ac9bbe9614361c4c2dc5d04
SHA1 3d7404c1699514585b6dcc32e43886e2a93d28ea
SHA512 af0923e802a16a8e4c7cfa65f5b3bd606658c9a17b58f76112dfce332c51c30cbbf0cb82d3a89400a309a27650a73dc340968b7acd8923e05fb0a69e3101d43c
TLSH
T1D04120D04C392AD1D4BD0E3EB45729FC94EC9726F89434386859EA58967E60D355083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 17d7b0dcac2d20112db1f6fe04c4a946828d0ec4a53d1da5ff39d525ca565ec3
MD5 d748eda12748f82e0651fc8a8a940327
SHA1 272fbf2f9036535341f389af7b9d7454af923654
SHA512 438edad34791b701756d6dbe0bf5ee09c309788d5a2e9382f9977fb69ac9f71b1bf0ee4c031f0c7f47a22fa93276e41b9da616c51d87cc7f6991ceca4d03dd58
TLSH
T10D412FE04C392AD1D0FD0E7EB58739FC94ECD726F8A434786898E95855BA21E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download