hxxps://github[.]com/endermanch/malwaredatabase

Analysis

user interaction
yes
max time kernel
144s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/endermanch/malwaredatabase
Sample260822-ff33faeb85

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2700	[email protected]
6468	[email protected]

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
89	raw.githubusercontent.com
90	raw.githubusercontent.com
92	raw.githubusercontent.com
99	raw.githubusercontent.com

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\File Cache\IFEO.exe	[email protected]
File opened for modification	C:\Windows\File Cache\Driver.sys	[email protected]
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6296_1093345487\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6296_1093345487\protocols.json	msedge.exe
File created	C:\Windows\File Cache\DLL.dll	[email protected]
File created	C:\Windows\File Cache\IFEO.exe	[email protected]
File created	C:\Windows\File Cache\Driver.sys	[email protected]
File opened for modification	C:\Windows\File Cache\DLL.dll	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5912	2700	WerFault.exe	114
6924	6468	WerFault.exe	139

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1816	msedge.exe
1164	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318478019853548"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{F72D8AE5-8FF6-4956-A901-87FCEDC4A0FF}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{BF4FB1AA-2E08-49B7-9195-72934312B477}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2700	[email protected]
2700	[email protected]
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	1844	7zG.exe
Token: 35	1844	7zG.exe
Token: SeSecurityPrivilege	1844	7zG.exe
Token: SeSecurityPrivilege	1844	7zG.exe
Token: SeDebugPrivilege	2700	[email protected]
Token: SeDebugPrivilege	6000	taskmgr.exe
Token: SeSystemProfilePrivilege	6000	taskmgr.exe
Token: SeCreateGlobalPrivilege	6000	taskmgr.exe
Token: SeDebugPrivilege	6468	[email protected]
Token: 33	6000	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6000	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
1844	7zG.exe
6232	msedge.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6232	msedge.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe
6000	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6000	taskmgr.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 6232 wrote to memory of 2976	6232	msedge.exe	90
PID 6232 wrote to memory of 1816	6232	msedge.exe	91
PID 6232 wrote to memory of 2412	6232	msedge.exe	92
PID 6232 wrote to memory of 2412	6232	msedge.exe	92
PID 6232 wrote to memory of 2412	6232	msedge.exe	92
PID 6232 wrote to memory of 2560	6232	msedge.exe	93
PID 6232 wrote to memory of 2560	6232	msedge.exe	93
PID 6232 wrote to memory of 6600	6232	msedge.exe	95
PID 6232 wrote to memory of 4296	6232	msedge.exe	96
PID 6232 wrote to memory of 6600	6232	msedge.exe	95
PID 6232 wrote to memory of 6600	6232	msedge.exe	95
PID 6232 wrote to memory of 4296	6232	msedge.exe	96
PID 6232 wrote to memory of 4296	6232	msedge.exe	96
PID 6232 wrote to memory of 4116	6232	msedge.exe	97
PID 6232 wrote to memory of 1084	6232	msedge.exe	98
PID 6232 wrote to memory of 4116	6232	msedge.exe	97
PID 6232 wrote to memory of 1084	6232	msedge.exe	98
PID 6232 wrote to memory of 6020	6232	msedge.exe	100
PID 6232 wrote to memory of 1996	6232	msedge.exe	103
PID 6232 wrote to memory of 1996	6232	msedge.exe	103
PID 6232 wrote to memory of 1804	6232	msedge.exe	104
PID 6232 wrote to memory of 1804	6232	msedge.exe	104
PID 6232 wrote to memory of 1804	6232	msedge.exe	104
PID 6232 wrote to memory of 6992	6232	msedge.exe	105
PID 6232 wrote to memory of 7024	6232	msedge.exe	107
PID 6232 wrote to memory of 4264	6232	msedge.exe	108
PID 6232 wrote to memory of 5684	6232	msedge.exe	109
PID 6232 wrote to memory of 5412	6232	msedge.exe	112
PID 6232 wrote to memory of 5412	6232	msedge.exe	112
PID 6232 wrote to memory of 6336	6232	msedge.exe	115
PID 6232 wrote to memory of 6336	6232	msedge.exe	115
PID 6232 wrote to memory of 6296	6232	msedge.exe	120
PID 6296 wrote to memory of 6324	6296	msedge.exe	121
PID 6296 wrote to memory of 1164	6296	msedge.exe	123
PID 6296 wrote to memory of 2252	6296	msedge.exe	125
PID 6296 wrote to memory of 2252	6296	msedge.exe	125
PID 6296 wrote to memory of 1448	6296	msedge.exe	124
PID 6296 wrote to memory of 1448	6296	msedge.exe	124
PID 6296 wrote to memory of 1448	6296	msedge.exe	124
PID 6296 wrote to memory of 6032	6296	msedge.exe	127
PID 6296 wrote to memory of 3040	6296	msedge.exe	128
PID 6296 wrote to memory of 3040	6296	msedge.exe	128
PID 6296 wrote to memory of 3336	6296	msedge.exe	129
PID 6296 wrote to memory of 3336	6296	msedge.exe	129
PID 6296 wrote to memory of 3276	6296	msedge.exe	130
PID 6296 wrote to memory of 3276	6296	msedge.exe	130
PID 6296 wrote to memory of 4352	6296	msedge.exe	131
PID 6296 wrote to memory of 4352	6296	msedge.exe	131
PID 6296 wrote to memory of 4312	6296	msedge.exe	132
PID 6296 wrote to memory of 4312	6296	msedge.exe	132
PID 6296 wrote to memory of 1288	6296	msedge.exe	133
PID 6296 wrote to memory of 1288	6296	msedge.exe	133
PID 6296 wrote to memory of 6976	6296	msedge.exe	134
PID 6296 wrote to memory of 6976	6296	msedge.exe	134
PID 6296 wrote to memory of 4440	6296	msedge.exe	136
PID 6296 wrote to memory of 5020	6296	msedge.exe	137
PID 6296 wrote to memory of 3408	6296	msedge.exe	138
PID 6296 wrote to memory of 2776	6296	msedge.exe	143
PID 6296 wrote to memory of 2776	6296	msedge.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/endermanch/malwaredatabase
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffb28c5c188,0x7ffb28c5c194,0x7ffb28c5c1a0
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14597890255910454336,18143889520920557387,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,15923783107865149426,12740719811817107979,262144 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,14538560157526259014,7302142623445002197,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:13
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,2849852298993800444,16046830127142064401,2097152 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14438407733823327432,17729789781130772680,2097152 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,16247152026344429347,7789628660034423746,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,1879265839840722620,228642919437631428,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5775380469831042116,7925608721905646184,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5775380469831042116,7925608721905646184,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,16794432794977954520,17161950064634304062,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6524,i,14619868665129053916,1404078986916283272,2097152 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8918875055684645720,9515719980105864834,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:6992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4758293027766783694,12270727533086761946,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:7024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,4749487906858450141,5600642717492789236,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,6369009100195247748,5379804993048789363,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3224,i,18108854354502357085,8792925308625478776,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,8688286092994576032,6886043784736091853,524288 --field-trial-handle=2684,i,1806196413506378994,2254480818971860838,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
  2⤵
  PID:6336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb28c5c188,0x7ffb28c5c194,0x7ffb28c5c1a0
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,11331830503856986837,1089234327888615870,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,15188415823296838525,352488860649686804,262144 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,8783573303657223089,7836979559233692136,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:13
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,17050293906402876648,1313198587062934857,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,17050293906402876648,1313198587062934857,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,18364590145435910795,12589550755981587679,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2800431142003728479,6888703101935331661,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,17756885461630654884,582729779946395742,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,7919217427540459491,10721527705099163284,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16528124288851483786,13913999336228688483,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,15006467044905758968,5314334300409691682,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,10649849045785240652,7700790787401313249,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
    3⤵
    PID:6976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,745799653865186745,556544956833395397,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=1376 /prefetch:14
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,6401595165887436107,18372861444347209131,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,5307878740325588606,10110207271962597369,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,12890143035835281155,8552269049153184219,524288 --field-trial-handle=2572,i,10912599462705782629,14984153889814125296,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2616

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Spark\" -spe -an -ai#7zMap27564:72:7zEvent29273
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1844

C:\Users\Admin\Downloads\Spark\[email protected]
"C:\Users\Admin\Downloads\Spark\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1160
  2⤵
  - Program crash
  PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2700 -ip 2700
1⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2236

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6000

C:\Users\Admin\Downloads\Spark\[email protected]
"C:\Users\Admin\Downloads\Spark\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 1132
  2⤵
  - Program crash
  PID:6924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 6468 -ip 6468
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1406ba2385dd70dcfab4dffcbdefda21c043cc3a33253d34ddccfda208388a7d
MD5 29706ba246ce9431c208a78895b845f2
SHA1 8bcf27de06d7d760d2fc4eef778a5b06d5f7d7c5
SHA512 17a4c294306160e19883790469237c218915462a0de0e242e424a98203e46b8fed6931b0ff2ab94e0f895403f8d6aaa2ab8aea293df48b43d1ce993b5bd2a924
TLSH
T1A5D02320FE6CF8D1F012053881218600354E0563A5A37203E920404C5C366B322D58E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2a91674aa9d4767e93406d788ae72de6a030dc48d2860aa41c242ca0fe751081
MD5 5fd9bd20e939c30d1141c963a6f8bfda
SHA1 f7446932aefa92084e237df7c925e68bcf8530fb
SHA512 fb9d25180ad999b180fab9c0649ef79582c7cde767b6abd5d1ac6ab8f6ec7f8a9d360553bd4e173ccbdab8e8b1a7923c4a4ef834305c988c2710482d2645d80b
TLSH
T194D02372FB6DBC45E1470535D021DA063A4F5553A473A107D560424D583B6B172D9457
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7b9dfcb4d3de4dbbd0c78f0549059cf0c9e16628e8b0e4c02c06981201986769
MD5 42fb9a8221f4b347780e9d52760cac21
SHA1 f14e91f234de04d674dc4dc2821d4595a1a3cc25
SHA512 7f6176049b9afe9203df1d5f6152c27efa2f36b4ce729c82a0cec3a3ee12aa8f7f9b922e5eb399bf899e036c8e7e8f9c167d5c3a4ec96f958ed613e7918d05de
TLSH
T143E02BA6C920FC2719FC1B2860644647EB45135B3B41880F3F3C826C4FB56374287C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0fd11bd840a25ef7434ef964338855a319b67f536bb07db45aa0d6b58d0912ef
MD5 4b74a5f6c9b95d55b12a81adcaa7d6de
SHA1 e3c970bef57da7b983969cadc1fa046161c127c4
SHA512 e785be367203ac20041063993201520380c98436407e16940c5e1c56f72a2a12d61af122ae1b4b9f71890b411e0c71e434f3d3a1366fe4a0d52ca5681829bb00
SSDEEP 384:NkjlVf9zAqoAjYp/MTse5P86/EZWzht+mgYs0jf:NkZVlkU0pkbX8ZWzzj
TLSH
T18C133CBEB6756C46E6E600BDC71B4A3137B1F639C0B5141B8F33355592A4FA268CE093
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 cf00d481357ddab30a0cf34dcb274538863e6bb6a9e31c5e577f75106f99063c
MD5 f290066dceefc3512ad301fa09cff372
SHA1 c2784c360f11b8b6c8348f9a8e72676da6acaf7e
SHA512 68de0be000184f70a8813aa2e398cf1253da3a56c809c935ed7ad9b1205a69f412c4d94098f37fb1fd49afeff932cd72e9fbd7f976d8fbac88caa96ee618fb6b
SSDEEP 3072:ML/EL/TR8yFy6a+L/kL/GL/iUFX9kMy5O2:ML/EL/py6a+L/kL/GL/i+a
TLSH
T115444EF30510604ECFA826F6D6463A7DD237410DECD1EDDDDA7A0C81A825F32A2E9E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 5242bc13b0d9f0db7de53add6c8c6ddad008a294f7dfaebdf2f720387ca956ce
MD5 0623e25bc121e42cfecf9c43cf838ab1
SHA1 04cadbec3d681e82e851b189259358db5d19ee33
SHA512 77fba95bbf8489d46559efb84dec62ab6dd9cf773b89cf70d5d78c537dfe4322e7ee42b0938e00e7c2ec926f01c40cb6e604c7a8a4d9d373929fa67d0c04e1b3
SSDEEP 6144:NQqDEvCzcEuW9XAGXz/zmoK4nbWGSmXXSs2:NQStzYMQyrz9bWESH
TLSH
T128256BEEC7682C42CE6B8670B4E0E9073E712183F64DD0D3A944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 196c33da9d35e8330383cf006ae59062b7f652ad6667d66113ea120f5c8646c5
MD5 ef82d17d5bb1911eac20a25d5aad4b7a
SHA1 918d77a705e097a77156a1e82cba988c09e08292
SHA512 27a1fe3b00abb1f6008cfbde97c996ede7f15138244888d4a1c0d921b135a235c95ba373084f798c886c68ec2af89c037bd84d184025a06eda27aa1d123e2d72
SSDEEP 49152:A8tVHLm8ISFEoXuUZoDpbksxjw9t2Eld7E:A6HL0Seo61rBw9t2Eld7E
TLSH
T142869DDDDA345882CF638930B0E0EE973D7013E3F994C4D68864C599459B7C6BBAA21F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 254f89c909b7921c02b2d679b0e617c37946a4bb8fdf8f31dd100ceb15891ce4
MD5 67cbb34dd3dd77fdb6c8eec425dd2024
SHA1 74781be87b45565a32072e5a3180c9948884fa4b
SHA512 352b910e748f0d27b9412ca2bfbc0c1bbc670653e21bf1887eaf7066aaaad827794268be11976c9703a2b53126d4fca1d581e4a02057fe9f10599bb68001ae92
SSDEEP 96:82ECWFMm1LjVfZ7gFdjCkUNuWF1OEHZRHGztXoj6:/E9FV1X9Vg/CkUkmJZRzj6
TLSH
T17AE13B085F3A0AA1F7518AF9C3E5B14937F9B56A046BCE802D475E38259BFD531C20BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3440.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3440.TMP
Size 3KB
SHA256 9bbc50ded746187071d0f4f461284c97b8e01018f6b7df34358cf577757f66fd
MD5 2084bf00900c777ad2da7f88b5f4fcb1
SHA1 331114720eca187264b6b021b89086caf71d123d
SHA512 9e9d26bbd1b7b0e9aa13321ecff73420bd65a12292d3a88af3e86da634d44d8c0a8e42e163bea8b129e817b57a0fb3a4daae1638a24d35a46d5ca9ccaf09d412
TLSH
T15451070E0B271AE1E3A087F1C2A111993BF4B8BF028F8AD02E046D3C05EDF2522C54DB
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7d850bc64666ed1bad9c6f52b776bc01e3437819ca19dc16ed13bbb6c22a8718
MD5 b8d727922f6313495cb06131fa3910de
SHA1 1f81cc2048c2c34dbd8b018a927000fe9bd90d60
SHA512 30c17472c97f01c49bf544a438eb82f4d9a91fd5f1a69d0474111cdaf8f125e6c9e65d2a8d1805cefded04921554253a3c7c3ee2c2a684b1eaf46e3e5c2b1d77
SSDEEP 3:MsEllllkEthXllkl2zE/lkAK:/M/xT02z/
TLSH
T1854404457FC00C07C503753040D1C350D770F4100F5357433CD504335CC57401C41000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 fe47166ca5d1a047d541ea5aa6cc25588fe842ce290b4bdd8e9e466ee930ca0b
MD5 1fde2b1e7c168912dab53fdafa7cdaca
SHA1 22d8bf41e82d233735ba9ae477e5f5e791eb51bb
SHA512 70a879a19721eab803f2705ae02943d493755805874df475e6cac575360a8939b7709d65732940586fa55bbc15a8d4e7472ef6e9dec5f54bf43a8dfee1c25985
TLSH
T1DDE092A568C6C11E592234879138EB0891D17443EAC5AD073744C888B646152F285547
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 1aff0857eef4105713d23d6bba01abffcb21d92f4c887ef5a3b02c41e6baa7b2
MD5 e361a6a1e7078c22af70f6ae0668e48b
SHA1 60c976d2d68f7e3cfb4ea065c3350bd56eac8919
SHA512 8641be23bc2ef5a7fe7608bafd7888781c0c5700971603d8205490dba0434b26edfdbd474f859136d773311fc93b90c027d76f387fdbfb432ffdf17f9383a910
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjxHaW5LdR+FtI6JNVqYp6E:TtD4jJ/0UC+lf5VaWxb+FO0VTp7
TLSH
T1F9E2C28C3F21F511C8ED733DA0D2C6E09EBC686C464DB571923CA8768D53562F49E11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 a825231fbc6e73e046fbb0a767b017a11535296c3ba680a3a2f699a922dc8986
MD5 e68dee0226fa1eab8250ca57c0e30808
SHA1 40344deffff9c6b467c95603b7f74012e84e46a4
SHA512 f36a7d1a7f091aa8accec4dffd1f26ff73ef1e30ae8d516ea01ddf4e64862d98f35e525461459164098d05cefcc8f40459992fbb07ac04b9d2c086fab512fd0b
TLSH
T147E0201409C9C17AE618649B46A6470CD3E17547B3C43D451B098844624114673CDDC4
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 21d46df0455c399cccff4c74047dec4db2cbc49d8876d5f1d7b1353967b0a5dd
MD5 cdada9df16d27754a11688159e5cc14e
SHA1 389fbc0d4397704e2b3cc4d97f319bc81bec5e5d
SHA512 d509ce56bdf6ba84e8130347d0752da77b22bc61091f21973ea63552580fc3ef0bd061e4634040ef2773a406421acee4050bfe35e693f1111b41ee716e54f2a7
SSDEEP 96:UBCxrzR4ysqOJsUYlTCiad2bybsq1pW4EM0j:GarOysqtUoTChIIhEM0j
TLSH
T1C5B2F9E7AE303406CF052EBF11496DB68E37E15CEFE0EC5575348022A8B85566075AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 7e8d7af4c9228e7f48037f9c822a442099bc5fbd0eaac3ef57290fe7fec4c4c3
MD5 f8262eaea8353fd2d4a5f98dfb3570e9
SHA1 5801fb7ce22a1dcd1f2a628d4ea76e45fbf02cba
SHA512 c4fcc5f8ba52e2abd14d3877ca6ed94ce50f2dc7fa5ac58bb947bccc32984da6fc22f4cc647119626534531090bb8b49971cb490b2b9f40fd3e217d9c9b825d3
SSDEEP 192:LaObuqLJvOhH+bF+UI3iWGVoWN3qL/CI8lVVV63:LaOb7vOhIkUI3ijVoWN3qL/CImA
TLSH
T19A24535F6F302711CD7D917A68EB48A75C7DF02FCB5226DA7C325460CEE2642A01D8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 557B
SHA256 949b61136c9e1be29aa271c20dbbfeb25b3944bf098de58df66ddd8a029b01d2
MD5 c44fe6fc8e0ed4eaea452aad2e9cb959
SHA1 39f466cc0baaed3ac0be2832594e72a6be7e7479
SHA512 7212a7bd70cb7912a0ec987720ea8ba24b0819e007af99aad2507df620acd96efd6724861e40b30bb7be09de84c1147825752e0464da5120295bb95c8945932a
TLSH
T149F089F24211D497DF563CF98D996594B732B6AADBC1C7C8C9A3AA4D1D009B412CB442
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 82228053194971389836231de9eefd4562341a4ddc94b6cc43ce23ccece3d25d
MD5 291ca6460c4b30b44f7422a606969963
SHA1 9aff98abebc26d7ef9189eedb70547f95e572b40
SHA512 d034743e69de375fbc51a81a785b5341b59d0e006566b9b8e525652c406f6ee012240bffd608f73c0bb94bda9e9df04f766fa81a5869a383c3a21dd9800c2b98
TLSH
T176E0D8B04ADEC15E6608608F92E66B0CD3B17407E6C8AE421B059C44B045014B7C19C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 e2bd5e212a9d4cb6042decbb93f1e19354c90f9200fbb76d919c3d03df8afe82
MD5 b01d14243f996fcc638a29314ce21647
SHA1 194b56c5d258a0dd2d9df532c337129587c37d97
SHA512 4c61fc34d0dba8be608ba75623d86f152bc310b6d5b5f1ee0377dd0190d95bee1ef104dd2a83c34f44dc0c32ccb2df94a1aab242f7652698ed18bc3fb1c08c29
SSDEEP 48:TUf/LopFMaty423w/a9NUuTn6sAwdHNeYfqNQq0+oAw+Z58Ryin:aDeMatha9jAQffMv58win
TLSH
T1C3B2404D0F303521C1B54B33D9E485622F3C005DC3232A9AAA14F0F2CEB22ABF61B066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ec6bb512818c78f6025c5ae4d509712728dd2ea63f6b2e28b16706bd47fd600e
MD5 26fa13f190e314002207e7d291f40ed4
SHA1 072b3de37902e3444f1093d98a72fd2a9bfd9df8
SHA512 4cefc3df5bb2204dade35535bbb61af11c1a4273ad409339b1bc628a6548168a7379fc00c734a4fb27bb5d7b813644ee7f42a1502cca3d51f26ed122f7c23366
TLSH
T1EB616BF747B1956D9B1195F0AA08AE1FCF2C0520831C78AA89E0BE57D3E3872E041B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 62b7820bb9f90ec02287e8c2cc61a97511ae28a0eef7f297c9c3f7855f0721b8
MD5 948e11954ff93899a75d180095683842
SHA1 1b6c24e7281d9bb2e0136b1e0a20c96b4fbd2e2e
SHA512 124d1de6c57c0fd2f3e64912b0c744133992a6891102cea90f93c001711a04c00c90eb03ef09718f5ebdb4aa3f21c9d9ae08c79af12fdcf31d2a8f5913ada69d
TLSH
T180616BF747B1956D9B1195F0AA08AE1FCF2C0520831C78AA89E0BE57D3E3872E041B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8b9a10a48826be6497c398d63ad24035a6d8d207436d84851a6537b8fcdea518
MD5 aca36b42e0feb7d46a932bf5c7d3925d
SHA1 7f4ec9b11ae58a471ada65cec326c0f145314281
SHA512 499d8808342d809231e6e7be52d0c350c0c8d64879d223657768bf26b80d21a381db84acc83006783753e46cdaef0bc4ea7615f9a6292a4c861da08cb0da6b89
TLSH
T11F41B0F783F4856EDA1195F0AA18BE2FCE1C0515432C7DAAC9E0AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cacfd6ad3d25b2d0243c6bd172920fe83552b9e2c3d4a4baf25460d00d6e6013
MD5 1b380ed5c83fc1c86d85bd193ae4c888
SHA1 2c75b37f481f8bab839ddfb18218f90355162c10
SHA512 b7ed9a64f1e15988a987dd4aebd0176ac8ecb3dc48e7b7f6b5ab4703210e9401694b19e89d3ae49aedaaa863f2e0202940a23ce996cef875a70652cf1e9541e5
TLSH
T12471BDF783F5956DDA0155F0AA18AE1BCE2C0524832C7C6A89E0BE57D3E3871E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5dae14904b7cfe2b8ee24fe0d84d6d9ab56c873360357ecb0cb81b8f53a98661
MD5 aa61d8850798bdb2ca92bbab0d3c10d7
SHA1 930e3183bb3141468e10fe69e8c951b906a622e6
SHA512 5edef4c2f7a6972348ec194859ff0b12133aa5c9df2963632ccf53ac1ea8d6eacc8280b92094c5d71f35abb80f4c676c72cb308c6aad7dfa5ffccb9f54870467
TLSH
T15D21AA979BFAB85B10B918BF0C02F8462879A870A013F4F5DE8691BCE0850F71B22027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d00699a4ce63947cf3b98fc06ff7508c92a7811c9f8847c244c6a75778792b72
MD5 6cc0dc7ee5d0310bab85f712a2abed42
SHA1 03c671cd936faabaf8372079db5912150e5ff1aa
SHA512 2b5e29bf426d3b64809f049990a16d6284390037f5ebcf8523cdb34935cc571a42888763dff5353540f01da418ba7be2b316bce4a6dced0c2598ca32ef5cf725
SSDEEP 384:sxRjmlc/fss42N/XWA/5O/W1OsGQ99tj6:sP6c/fY0X/50W1OsGQ99g
TLSH
T1A972F91669349D3BCDCBD209FA957F93D3FD1123A5945E44AAFC8A0C00EA6ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 86464495b743d9153ebe202254fe3d93a301882c1dee63fb1aeb8ef94b5a37cf
MD5 4f8ad1916dd95109abd3331f1bd44fd4
SHA1 a8d403cc964e975edc61ffd054854d13b7c667ab
SHA512 d624c96118a807f4c642b8c14af352b71b858b7a1ad708c7b1bd54df6e6a07846e8a2ae175190cdbcd722f0588aaba1be631f581bbd3589c4a76f951b894054a
SSDEEP 384:sxRjmuc/fss+WvG8N/nWR/5KX2GmsGQ99nN6:sPnc/feYG2K/502GmsGQ998
TLSH
T14382D815A934597BDDCBD219FA95BF63D3FC1123A1915E449AFC8A1C00EA7ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 b880550fa3d3354dbeb543c30c7b3172080da75935c13876c217cc67371c1b4c
MD5 9109325fa7acdc10b7cf1b4f622dcf5e
SHA1 ed9309f8e36e78e6e63660498e01d3e321c0d4a6
SHA512 d65b39c9da86d0d584d57df0d3e9879a5e0d97e5a96065bbc2b62fa45d4236cb230fa84a2294a09a893e53df9750ad2bf2d4c970197049c64dd77e7e5afcaeaf
TLSH
T14AE026E05ACAC17EB11F724707B6870CE3E5F467E2C83D466F01C885714A509F2D2582
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 caf0e1e4c8a857e4a3d8c7603a915beef07486b68e5c038f78356c4cbab8af2b
MD5 82fde6f4ff176b61c1befd3295c1b3a9
SHA1 0192ef2b2228822b0512742b7bb07c3554a22252
SHA512 19858a401562ba5000888a51eb260805193c5155ee3a75a0c3a2e4a10ce162cfe8b51dfec9fb0bc02bd66501f3c170545f2a3b5dacc6468c109ac35af7b5a749
TLSH
T16EB012503B004267C8C6053506464B809F14E4439041591B4A5EEF694D18E942F82F94
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2e986b1503a24c3ee4e408c8678083cb71b131ba4c50e098f0cf62bb3c521e29
MD5 c9633f549327b11a7b6212c898d960af
SHA1 f4176f71daccdf68735e80f36eed0de753a1c644
SHA512 5de4c25f7cd7bc1e8e5ad7786377973dfc9d0d628aef620bce1ac9a41b0d58b870b8ebbc8b745608f51a8d556a6b73c16f59b1502ada706e6ebb8c975867957b
TLSH
T1BCE0D8301ACAC22B714E30CB926AD70C92A7F407F6C869653B09D584730E1497393541
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 d1e09a8b61fd9ce91a5acc13937d8cdf0ca918eca4b52b95a1f5fcaebf206217
MD5 9608e60f0b806de7e0aff7897ea242c7
SHA1 3b9a3d8621ba893adf3a9e7825614c548c2d7714
SHA512 eb547737edcebad9ac17982a926ddc50c4fc207f4d2d7bb905f8f5c621990be1f6ba2045b9e467a311d50e42abf35b2410d523fc264bf7ff9f0990af0a329b2b
TLSH
T1ABE020704AC5C23B680474CF83A5DB5CD6F1F887A7CD394157089444710511273E9580
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 95119b436b543fe4d8a867dd3c9ed503985cab756816697c2cf71ebb650d54cd
MD5 0895b83dd1bdeecab9105cc823ba2a6c
SHA1 f175aceccf27ef84b1518100ecb888cf47b28598
SHA512 873614fedc07f7d2130b4412f5d7271594dea7ff5918786cfe36109d6aa0cf337960bad507d184665fae4a24cda83db148af6aeba3059c526867355f45446174
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9d5s:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRZ
TLSH
T1BAB25C51713F4680383EA90C91B8981E96C2B4A37459E53F7BAC01B65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 b5c3ce7a232a194fab5a5a0c0daa2f6cc9b432a3ac6c664b63123091f8de45b4
MD5 da49b49eeac19eb58a68f0f43d13f514
SHA1 1601881e800254a31085c3ec1f29de92e9ba9b7f
SHA512 7ede35173b68d7393722c4e3f6e4ac1870fb3cbdc7fe422591f357dca3c1bacffd07c2beb15690067192b94f969510e20326bc2d4b3694fc3147147d45a4ddab
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9d5Ux3:yv+RpPYDDRPbIhJ9d5Ux3
TLSH
T188C25C51757F42803C3EA90C91B9986E92C2B4A37019E53B7BA801B65F67E039DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 ec8b178e42fe93fbd240083ef8524bd967f18ac94c15cf488c1706a7e0a67af4
MD5 f0bfdb72b1ee380e1f447d64784d7b40
SHA1 27c1e7046f45944083d4a5791f16478b94362dcb
SHA512 ccd24ee6d816cee2608d1f24b3c4d72e1a1bae976a521d5bce46e95548648c1388e9503fcc7aeddd2d45173f49a7274617e3b50ddb60e0f379661772f230bdc5
SSDEEP 384:DNrRZyCSDnxTICeVPMEhIKyll7svbFKfk7:xFZJSDniOyI1l7svbF9
TLSH
T1E744740A7B747001EDE6D9725CB080771E3C716D8F22A6915DA264694DF3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 49e6a4e312d62c31dd0becc7444bc71fc0fc0d34828fbb1c9307e0e18e9357ef
MD5 5822aade62f098d21846c545b6429068
SHA1 63ed2f4a16e5e3298b1c11cb533baaae87fe0729
SHA512 8419b70e974abf0a690f19108310c106b9a6ba33bfdefd7d1d961bf4f21f76dbef2ce8006f336bee61c822b3d83df9176cb977deae8e8ffdd91f0cbd7b34a300
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgZ4TcaQh5UgJ9caQdwgUUZaQq3qwahzW:DEtSyGhp22iSDcLjUAcLtUUZLqaw
TLSH
T18F52C2E3FBB41301CED9AABE89C089ECED35B0799DC098239EB5CA01A454254734F35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 238d9b3e2a84d57503e2167b73e3b41482e8ffe4733d562a4439f5630ffc4cae
MD5 0a2c2283d08d5bbf8ebf51e178ea555f
SHA1 276fa594958bd166dbfb2ddf29f3a587d307c936
SHA512 c40f82ad47914bc813faaa256534e4af34ab88ec48057335368d08e7b72c220674d939e2706bc8fa9ffd3f316f52ba5aff65c9288b2f5a12f598b2adc7aed984
SSDEEP 384:5FC7sHD2s34cQwIII3bnMIMeBUPC+Vdb5kv5kZw:KIHjocQRya2Z
TLSH
T18372A49773011733C65F6EB703B68B945BE9EC414562161E3262340F4DF2A6B86C57F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 576c9b9cab3565ff096223fab5283de202e249ba8ac67680fd404a768e5a79b6
MD5 554fe5ba15fa142347ffd1a7e6c29c13
SHA1 9feae19bb0c1c20a68541ceaa18e8fd88f92cbf2
SHA512 f4a5d33ae246313488835db6fcf7728b9474da3fe16ce361d2dd1e5e3465adcd651e6402ba748b17ee05f8e7d49a7a0b91e941d7e5b0ff3cb6b1c19d353f1191
TLSH
T125E07D30AECAC1AFF49D308B11A7470CE382F903FEC929861F01C4CCA145101B7C6D91
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2aa52458d3b457753e38f37416b9c949d69f866161eaff62967838aedf7dd884
MD5 d6bf00cd8b902c465ec6117c55c353f9
SHA1 3f8e8116cc8e63ac065177cd43dd8f8bc855af46
SHA512 2b217bf3cd803a369ccbe54cf2896c119b00582172f049601309f33b82e8e180cd29f79d23577a3e030eb84b93b477e325c4b6c8a15eee1f15ab767ac5ca505a
TLSH
T1BD31DD15F320C14DE54A867E906BAB360738E8568FBCED0F84B920762E71F441E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 f30e222d1c2ac5b424905b35eb0dae4900f12f5131414cfca5c2c01557400f19
MD5 c16993bfec1927dc75f7553b47c8e6a6
SHA1 96c6be956bb6511c4146b7cc0810ea72e7d7b7d6
SHA512 3410f6232012b67252c1a4dbc4416a10ec624b2721506277d94c70675748fc3da9f6fe99b5919fc5ef012edb9884ad9d09d63ffa5fa638799dc2ee31d788f16c
TLSH
T14EE0D830A9C6C15F6115208B11A6C74CEAA2BCC3FED82E411F018858A105142B386541
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 789e017b034165c262e0fc6063438d5a0afe298944456220741feb9544cbfea2
MD5 ed87bb3fb2808b128e771aa0bab870d9
SHA1 13c1f29e2ca4e8c161e0962604eaa9747407c86b
SHA512 efc3cbc6055779fc46ded7127dbf904be23f9f19966b8da34ef00c91dc81aa8d62b9f67dfcff4e1496ec9e6c4c05bd369f36018844b6a12e3e05be9302bc8015
SSDEEP 3:MsEllllkEthXllkl2zEjlkodK/:/M/xT02zEI
TLSH
T10A44044C7FC3440FC5005430D011F3705374D4100D1577473CD10D375CC55401C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6758665fee587028e93d2b2226afed9fa502db92d1bb1ca5e591fa0d28f257f5
MD5 c1fe5971c09231b840973641fa4dd6e0
SHA1 6f43976598f95450b179575a6b9356e94c24934a
SHA512 8a799418a3900dbc3b8ec809e13183f48a16775f5414ca6a73d735adde5529ec86a0f1e3484cd9a7307c19c5d2b41c3a644270ba7c07916befa6f5a986522025
SSDEEP 384:nTiFiZcIi8NLF8TUNTUlIRzPvuTBFYuEqfbGGNcA831yHZ2vOriv1+as8LEEIziK:+FQiQFwgtu3aGaA8lhGritlnK
TLSH
T139C25B72DC64C9BBFCEA8B95A7097606DEF4415389DC9AC4E9C95E1C00DB1EE0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b844ff4aa8c47f6e3c74e20064e50dc8567c73b76b43e6608937fa319ae3dc72
MD5 b7374f1978cd2cf598bbf8883e041cbc
SHA1 ba5ac4aec5794511531db7497a79ce0f3e062493
SHA512 c448916763eb96b4ea24a3226277156d53dbe837a57973886b7e9b6189d00303e0acb395f5bfeb135685444358fb152e756bec842de1034eef40b7e2e800db3a
SSDEEP 384:nSiFmZcIS8NLF8TUNTUlIRHPvuTxFYuEqfbGGNcA831yHZ2vOriv1+as8LEEIziK:ZF0SQFwgtuvaGaA8lhGritlnK
TLSH
T1AAC24B72DCA4C9BBFCEA8B95A7097606DEF4415389DC9AC4DAC95E1C00DB5EE0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3b1da6d5ce98ab3e3d4a2d12c399a646f7c3be0ac5ac76ec3c7755a9b81ad858
MD5 23eacefc360be31738c5f7601fbd4d8d
SHA1 1e043fda258ba382ed19b772df542df23a9e0beb
SHA512 07bc39b23cb2ec8f65b8e546af1badfd8bd70e4cd4838f697cc6f6eec92ef0cf7227e061b8d4589adfbe57bcb76e260065535e7ef83404c414b5b8ccb0ce8b0c
SSDEEP 384:nGiF1ZcIz8NLF8TUNTUlIRHPvuTYWYuEqfbGGNcA831yHZ22qYWYkXUv9CpMCivy:tFNzQFwgtuPaGaA8lh0Iw9gvitlnK
TLSH
T11EE22A7DDC64C97FA8EEBB89660D65169EE80237C4B88898DBD50F0C807659DF703816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ae8d38ac3808e86dc735618f5d5ec13ecddd106cc6c0f3a7da369f4fb5a5c96e
MD5 10937d0c5b85b449da180ad9b8bfe48e
SHA1 5217e34b6339f0b3ff4b921ce179973418c55f17
SHA512 9115b9efaf0f962c7085215a02dd78c12ff78c2974c2e1540bf97a9c619643ee79d5d826caa069c0668c68e2517a20f3a543a9c841824409bb8d230c3de2f171
SSDEEP 384:ngiF1tNn/s3n9Sn8Ngg8TUNTUlIRiPvuTusREqfbGGNcA831yTL7OObjI9G6w7p4:7F1j+9SXgwgUuNqGaA8lY729M2
TLSH
T1F0C24B36EC59CDBBEDE64F99B34E7A56DEE0126384AC59C4EAD95D0C00871ED0703C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5571aeb7a26ff463bd84efb7276a9d1bac6ef37e08ccf2c818bac0877146f750
MD5 1614ec4add8534ddb5315a40bf3cbdf5
SHA1 b4b3dc3d46b1ec5bf528a508a0ed16a9591e21e6
SHA512 a2566bd29513382ee1520976c90c520bb3d86da7d2ee3eeedb889c4f0865ea5a36377a295dbd579d8aa057cedf9480c966bb1d671c4cab57af024eeec9b1a7a6
SSDEEP 384:nviF1tNn/s3n9Sn8NgF8TUNTUlIRiPvuT9RYuEqfbGGNcA831yHZ2vkrOObjI9GK:6F1j+9SXFwgUuvaGaA8lhsr29M2
TLSH
T128D24C32EC55CDBBEDE64FA9B24A7A06DEE0426389DC5AC4EAC95D0C00DB1ED4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 47452194ba638cc3855c01963ea3cfac6cdde28f29f35579196de6ef00b61cc6
MD5 b339129be155ebad3db130c8fb8f4f0c
SHA1 d035a828225dfcef0178917b81cf04abab703c53
SHA512 750082e2366312d4e4f28b274f57f07639678047e2d900b32abbc0cab891f810166ac33493d530b0efd85cf016688f3e12af645b7c5a9e346bd0d25a7ab69c7d
SSDEEP 384:nSiF1ZcIz8NLH8TUNTUlIRHPvuTYZYuEqfbGGNcA831yqqUtRBXrKRo1Yv1+asJ4:ZFNzQHwgtu4aGaA8lvXVKRo1YtlXf
TLSH
T1B1D24A7ADC65CC7BA8EE6B88670D36169EE41173C4EC99D8DBC84F1C00A71DE670781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 98d51e9e47fa58a3bde039ee3acd8573d1f0b72dda2128dcab214862b4bc3a5b
MD5 98653cec13ab843ab419d648090195e3
SHA1 644b7f519dbe48de96bae698a75909ed1a14e9fb
SHA512 ba4e8d838443cac0691dc68e8b2fcf4fbb738853a14f2c44ab093f7336b4a6c9b73a45d6aa796ae91d277fd4b78eae68696b96678a33041da4bb56798c561aaf
TLSH
T13BE00213130100E6C05C0330048716102AE3807002E306495D1045684D123045F20B44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0ce2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0ce2.TMP
Size 392B
SHA256 914b85b6b145937d358c9070f4f96ef9f4c0989d6a85b75faaf4857e57e231bd
MD5 4099f014e7a4a2de73d42ddefd00eb51
SHA1 fa6c42e81f7d1c11e60f9903ca1fc4451d8d8afd
SHA512 e94027e51d5150c05424b23a92aac6948018c892173b3452219872de454b5cee2b11a362aa258d3448f165ea4b690872b0447b0c349acb18f5da0238037af15e
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 52f252def2679b09f2b97de497e2deeebed5f2412bd1f23ccef748a2dd71a7ae
MD5 d1fc50375364c485be5653c507a04b9f
SHA1 548cbd74e78bf9182711a462fc0a4978c698db22
SHA512 2c8ff2f56ea02fdb67bdca42bfa746e04f41f5b917c2a3b7490a5a4a1c227f397aeca6fb57c142bde37cbe1a73c22788fcaf5e559a8d1b0435909fb553343a59
SSDEEP 3:MsEllllkEthXllkl2zEMsjb:/M/xT02zXs
TLSH
T1634404147FC00557CD0010304051C3D00374D4331513574F34D104377CC55701D40100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

057a1bd9-5b51-49da-a91d-8d321ff4f4f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\057a1bd9-5b51-49da-a91d-8d321ff4f4f4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6296_1611211621\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spark.zip

Path C:\Users\Admin\Downloads\Spark.zip
Size 1.6MB
SHA256 1ae2a53c8adc94b1566ea6b3aa63ce7fe2a2b2fcbe4cec3112f9ebe76e2e9bf9
MD5 860168a14356be3e65650b8a3cf6c3a0
SHA1 ea99e29e119d88caf9d38fb6aac04a97e9c5ac63
SHA512 0637e4838beded9c829612f0961d981ee6c049f4390c3115fed9c4e919561ad3d0aa7110e32c1d62468a7e4cdc85d2f2e39a741939efd1aafae551de705aab61
SSDEEP 49152:p0iszfe7OgN0Fw6KDfcqm6YvBK1+bgHXFZn:4CN0FHMcTvu+E3FZn
TLSH
T1738533EEB7A3A85AE87A2305E37FC12651296BC6DD99C0B257708F0D8D1583F607CD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Users\Admin\Downloads\Spark\[email protected]
Size 495KB
SHA256 55bfcb784904477ef62ef7e4994dee42f03d69bfec3591989513cccbba3fc8fe
MD5 181ee63003e5c3ec8c378030286ed7a2
SHA1 6707f3a0906ab6d201edc5b6389f9e66e345f174
SHA512 e9820f60b496d6631e054204c6fc5b525527d40a578faac1d5cdb116abcb4a35aacf4f4354ff092a2b455c5d9c2e0f29a761d737d9c9ad3d59d70b51d0583d92
SSDEEP 12288:ehny10sOqEl5yD4UmxYV1g1bT2kdSOSGL84Umxb:exZ5vYORMOJ/b
TLSH
T1CCB4F141B2C0C074D5FE09748861D5F15779ACA18EA0DAAF3B587E2B7E720C1AF35A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2700-588-0x0000000005610000-0x0000000005BCA000-memory.dmp

Download

memory/2700-587-0x0000000000470000-0x00000000004F0000-memory.dmp

Download

memory/2700-589-0x0000000005230000-0x00000000052C2000-memory.dmp

Download

memory/6000-1136-0x000001E561170000-0x000001E561171000-memory.dmp

Download

memory/6000-1143-0x000001E561170000-0x000001E561171000-memory.dmp

Download

memory/6000-1145-0x000001E561170000-0x000001E561171000-memory.dmp

Download

memory/6000-1144-0x000001E561170000-0x000001E561171000-memory.dmp

Download

memory/6000-1141-0x000001E561170000-0x000001E561171000-memory.dmp

Download

memory/6000-1142-0x000001E561170000-0x000001E561171000-memory.dmp

Download

memory/6000-1140-0x000001E561170000-0x000001E561171000-memory.dmp

Download

memory/6000-1134-0x000001E561170000-0x000001E561171000-memory.dmp

Download