hxxps://megadb[.]net/download

Analysis

user interaction
yes
max time kernel
87s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://megadb.net/download
Sample260422-2t6ldadv9v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3796_1874830536\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213720183782573"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{38E1128F-474F-411B-8BA3-F913AB61B71A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2760	3796	msedge.exe	85
PID 3796 wrote to memory of 3812	3796	msedge.exe	87
PID 3796 wrote to memory of 2348	3796	msedge.exe	86
PID 3796 wrote to memory of 3812	3796	msedge.exe	87
PID 3796 wrote to memory of 3812	3796	msedge.exe	87
PID 3796 wrote to memory of 3800	3796	msedge.exe	88
PID 3796 wrote to memory of 3800	3796	msedge.exe	88
PID 3796 wrote to memory of 404	3796	msedge.exe	90
PID 3796 wrote to memory of 4684	3796	msedge.exe	91
PID 3796 wrote to memory of 404	3796	msedge.exe	90
PID 3796 wrote to memory of 404	3796	msedge.exe	90
PID 3796 wrote to memory of 4684	3796	msedge.exe	91
PID 3796 wrote to memory of 4684	3796	msedge.exe	91
PID 3796 wrote to memory of 3536	3796	msedge.exe	92
PID 3796 wrote to memory of 4112	3796	msedge.exe	93
PID 3796 wrote to memory of 3536	3796	msedge.exe	92
PID 3796 wrote to memory of 3536	3796	msedge.exe	92
PID 3796 wrote to memory of 4112	3796	msedge.exe	93
PID 3796 wrote to memory of 4112	3796	msedge.exe	93
PID 3796 wrote to memory of 2024	3796	msedge.exe	97
PID 3796 wrote to memory of 2024	3796	msedge.exe	97
PID 3796 wrote to memory of 1940	3796	msedge.exe	98
PID 3796 wrote to memory of 4584	3796	msedge.exe	99
PID 3796 wrote to memory of 1940	3796	msedge.exe	98
PID 3796 wrote to memory of 4584	3796	msedge.exe	99
PID 3796 wrote to memory of 3676	3796	msedge.exe	100
PID 3796 wrote to memory of 3676	3796	msedge.exe	100
PID 3796 wrote to memory of 1380	3796	msedge.exe	102
PID 3796 wrote to memory of 1152	3796	msedge.exe	103
PID 3796 wrote to memory of 1152	3796	msedge.exe	103
PID 3796 wrote to memory of 1344	3796	msedge.exe	104
PID 3796 wrote to memory of 1344	3796	msedge.exe	104
PID 3796 wrote to memory of 2652	3796	msedge.exe	105
PID 3796 wrote to memory of 2652	3796	msedge.exe	105
PID 3796 wrote to memory of 2436	3796	msedge.exe	106
PID 3796 wrote to memory of 2436	3796	msedge.exe	106
PID 3796 wrote to memory of 2824	3796	msedge.exe	107
PID 3796 wrote to memory of 2824	3796	msedge.exe	107
PID 3796 wrote to memory of 4736	3796	msedge.exe	112
PID 3796 wrote to memory of 4736	3796	msedge.exe	112
PID 3796 wrote to memory of 4736	3796	msedge.exe	112
PID 3796 wrote to memory of 1848	3796	msedge.exe	114
PID 3796 wrote to memory of 1848	3796	msedge.exe	114
PID 3796 wrote to memory of 1764	3796	msedge.exe	115
PID 3796 wrote to memory of 1764	3796	msedge.exe	115
PID 3796 wrote to memory of 1764	3796	msedge.exe	115
PID 3796 wrote to memory of 1344	3796	msedge.exe	118
PID 3796 wrote to memory of 1344	3796	msedge.exe	118
PID 3796 wrote to memory of 1344	3796	msedge.exe	118
PID 3796 wrote to memory of 1068	3796	msedge.exe	119
PID 3796 wrote to memory of 1068	3796	msedge.exe	119
PID 3796 wrote to memory of 1068	3796	msedge.exe	119
PID 3796 wrote to memory of 4668	3796	msedge.exe	120
PID 3796 wrote to memory of 4668	3796	msedge.exe	120
PID 3796 wrote to memory of 4668	3796	msedge.exe	120
PID 3796 wrote to memory of 6036	3796	msedge.exe	121
PID 3796 wrote to memory of 6036	3796	msedge.exe	121
PID 3796 wrote to memory of 6036	3796	msedge.exe	121
PID 3796 wrote to memory of 6092	3796	msedge.exe	122
PID 3796 wrote to memory of 6092	3796	msedge.exe	122
PID 3796 wrote to memory of 6092	3796	msedge.exe	122
PID 3796 wrote to memory of 780	3796	msedge.exe	123
PID 3796 wrote to memory of 780	3796	msedge.exe	123
PID 3796 wrote to memory of 780	3796	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://megadb.net/download
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbc9bec188,0x7ffbc9bec194,0x7ffbc9bec1a0
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,7529255673175464445,8612606071298232793,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,13544055612915292377,13666780802707225215,262144 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:2
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,3145539100532685353,6997968879562927262,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,10019935923931685732,16179904735441069096,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,11521307775115858953,12284449931748490165,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1457149301381982551,4111966345457513542,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10186132269511402151,885867790893373784,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,11729956951553030828,14613350209139077033,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,2961759382760416071,8183613051943350326,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12109060010841398957,12732954888640483173,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,9240473782712912104,11003688151203840693,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,4508501825293535437,6486134131989758609,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,4508501825293535437,6486134131989758609,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16844932328061074682,1387706282788759907,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,10914682301767575987,16569171650525340464,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,6535940207884438673,7790291357036211931,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,18399083103253446276,13375432896681447500,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,17932428199966160285,10018514725224734070,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6380,i,5496476057200076757,1744142519297142123,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,5758737307632764174,1466442655570020501,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7116,i,3038138076787146185,15800591756906062012,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6448,i,7329373704397078767,5212646721381914888,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6200,i,3511006192990691062,3303037828343767844,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7336,i,9349997464371368709,14889315973528077864,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7664,i,628227477645827560,17204695704490392709,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7184,i,3995924317843155504,15715363651927090898,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7224,i,8697261263680857567,2490091602070818108,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7232,i,4515008579746487156,14192897940249128231,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,123901216229653760,17774075090018148084,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11469683677206484677,17783279258003688916,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,17778850964774927026,231590050288629560,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7200,i,3671075449114112478,16910471355441586546,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8168,i,8968722721279135624,4975993304560850177,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7792,i,7402995373871625790,1149390024798766156,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8484,i,10625423027720483016,5312096213679477663,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8840,i,13982236611988899753,2851332168542592455,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=8868 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8908,i,13311648527772241130,15832366456823459839,524288 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8944,i,11156662035842827404,2587011692862579110,2097152 --field-trial-handle=2740,i,1807483202138176269,7090520196391092058,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
  2⤵
  PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3796_1874830536\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
TLSH
T1C55302D5B8E93222BDA947C28B442085CC6F367CF53F3DD8DE31AD2AA5909DC41847C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 68KB
SHA256 0274a299b3a81687a5192c4ff424872941d24a0b986035abacbbcda16ca5210b
MD5 d67f112773e898f90e775e65ebeb6385
SHA1 86b3728d490c3c6a6a97809f6b2eb7c2eb19cdf3
SHA512 f6e93b614653bc993daf4e0391000efe6286f78a9cc7d15a5836501d3016f5801c7cde8e8f875f2f1d6981dedc0946dfc87b83133cbecc5af92de3b122999823
SSDEEP 1536:fInxmnkHNVx/Uur0YtX30S30zT9HQG4TGnzmC4:rktPRbn4zTezG6/
TLSH
T13963011299EB3F1CBD0EFA80BEAD35EA0325C995A652A3F5073453E72425B60C025D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 75KB
SHA256 f0b2216568bb538a00ee14c13ad49ea15b1653044a219a698889610edcf9bf05
MD5 13b147a683af38608f9c22ee9d66a832
SHA1 f9291cd3a214674a186f4be85cdc655a6b3a31fa
SHA512 1c4deb1cf689906dd026c6fe7383cfac8f1beabac05dc65309a35f60cb70ebed45d265351b8b6d35382c5136815e0809772a48e242608e309becb9b7078cab17
SSDEEP 768:986uWt+5MaZ+sefChTFh7g58k0D5ChKt/w976PZM+dfWXNWfGh22m9oCcQhS9Chx:W6uWy/fW8k0kcPySW9mFbiIZ
TLSH
T18773D89CB2D3F02143D3F175842F2506F2BA6965608EC451F239D9D6BC9894AE237BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 37KB
SHA256 7285081bec1a1e6958b28c4664dcf5bb7812f886d08867a468eb204976ee7ea7
MD5 bfc53a3db7175d91f2331d4836ea93e7
SHA1 672a93f961b54efb9cf8d4d571db5f6991b6e744
SHA512 b0e78a43ff2ab012bd5b914a688c3379bf3625a8bcc53d660c196d39f6daeca3e88053ef8190f0dc150c6f70ca73bf1f8598f4c638cb8a98814730854d22876e
SSDEEP 768:GhnGemEkcTXZOsvrOACJI/EGb530WTsaARfZkt6ltIFuJffdJ:GhndBTXnTcm530WTERRkcfIFU3X
TLSH
T1DF03E17A7B2B391619F5B37638E5F4ED186B1BB72064B15AD35EC3023B0500D867814D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015c
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 b55f6acb15b3399eff2c9d0d1ed5062efdcb7dfd0c37c6fb8139a0ee54ee47e9
MD5 156e9a9cc3d449c9ad122a61a82b8974
SHA1 bdd76af8bb7db9db978c4fef35cf277bc53f8793
SHA512 8119803c5679309031fee001b5ac0c69a09287df9996983eecdf84e4dce4b09919aaac61a22942886dabb9377619c5ed981ca72ebc4f39353b86292b849e51d2
SSDEEP 96:VREl5iiOs7yAdEcoTxPg09yd9Ekgdu0pF7l/0UIxjbrX+kvTLykt3Mbg4C4py17B:gccbLo1fQcduaFBspHTakygkpyZFbB9
TLSH
T136122D619DEEC4A1FBD401B16DD73871FA31438990435F1AB0F2083E1886FB62DA8866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595a3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595a3c.TMP
Size 3KB
SHA256 757b444f05e56d3e354cebda480ff5373049ed2ebd85d84c76e9a4a8b92b4ab7
MD5 70a3122f2db878aac689ac7fb8f0d2c6
SHA1 d38f071f827929abf2d52ee3d2760f66b05063a9
SHA512 11505a431aecf8dd28e88f4c55b738a16c141aa509a58e0208627f9e93d552fc1ca7b2b1392cafdea4f4a78c45cf0d1405fbce529816c4ed5e5a4076a062f1ba
TLSH
T1EE713DB0DDBEA8A9E7E000F67EE72495BA7207580047DF15F5F0003F1A91F7568A8517
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 409e3f5c9d820f45d85ae4b537a36840b3d029bb23fc1647c1b7f113e2beacac
MD5 de8329963c75988cd4a2e4b5b757f0c8
SHA1 aaace0c345010e35ef781e8fe1d7efb0c25376be
SHA512 2f2b8b44f167fafffd1b45b316a1e95657f6452e5d0f022c7489f68a17adb7490ad03f4ce3cdddcae07253c1440762ee23ba549400773fb0adbf58550249effe
SSDEEP 384:DXLPtCLkxv5vakw+oSyIeJW6dawtJeBJakG3iHvf2mRoCnlfnUzOknK75TA4aGtK:MtY6b9
TLSH
T1F482ACF787E8962DDD2152F0AA146F1FCE190965436C3D6AC9DC9F0B93E1831E202B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 53cac86b4bef4eaf0e71792e13f0989a922fcc6e9995885b29cc1caada491412
MD5 607cff2c387de0ff48bcbbf60c51aa25
SHA1 e49bbbd7c844218246c3ff66363901ee1249afa0
SHA512 7e99c8139296e1643da5f7b57b956d59857053ede1cbeb0a9959c76dd08be5f64c2a8b00a510789b844c4ca6540522feae6c0deec4b15431acc87b364ecb3036
TLSH
T14AD023E31B0571B8B66C2E815155AD4EC775505004C2DDDA11F074D9293145D0717584
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe589594.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe589594.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c8340f5a41464a027b04ecb9f3b83bf873b9854a5b7df6229ec80071f96ee050
MD5 1d9ff1411b7bc3a6d97a65b1ae633a16
SHA1 0d2717a9da0a119b5e6496fb6cc054d986f4825d
SHA512 c3ab090731f721dbc392fc4d806eb3d0cc966329199c0dfc06f0353d42b9d2a3587ea41456a601db201286563d2d72fec4dcec19292410155f56de893f3fa819
SSDEEP 192:sxZlIRCyM//K1Ml8MWOw/f6s2ZWB+ocSGDWb3rdpm77HW6+WNly2qjA/PgByJDl8:sxZlIwuOw/f6s2AmpDoHiHb91/xSuc
TLSH
T14B6208166A345A77DDD7D219F944BB53D6F90473D6A00E48AAFCCA0C04E6AED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 e45607260cba45fa2743daa66daf78ba528b9452ae5d9087050ffaa89e0ca3e5
MD5 e1badaec16327e79fa12b30506762e15
SHA1 03e4d653890da58b738f691be60306c38dc7e6cc
SHA512 f3e20edeb83d886b211752df4d21c5e8c99249706aadd8011e44163523cd6f9939e9ab189c230e632b81b3ca701348dad4331ad4f6eaeff202423423db6ec210
SSDEEP 384:sxZlynSwsm1w/f6smAm4DtoQHHbY1z/bSuSorYA:suSRm1w/fAAm43HHbqWyYA
TLSH
T15992F85665208977DDD7D218F925BF53D6F90462DA904E8CAEFCCA0C04EA6FD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 210fd5a76c87f6610ba63716017c673e3eb909e21b781f801522aa7f5ad7d722
MD5 911cafd39727a80490ad489b3f1d7f66
SHA1 da24a473f5f916e4281d2374be1b9f84ae77f911
SHA512 d2659f405a2875d3a7d8cdbc7aacb2dddaffd7445b1f882fe3f3afbfcbb581d2bf0a7814180767d7cc75ea51d8ddf43ba7f20e03a8d858fe5c5e0f693dc3244e
SSDEEP 384:sxZlynSjsm1w/f6smcmE8FGDImHbY16gvXomGuPA:suSAm1w/fAcmEOMXHbXyK0A
TLSH
T1F492F897652089779CD7D118F925BF63D6F50063DE904E8CAAFCCA0C04EA6ED2612C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e3be03adddc7fce4bea320d17e95b089044a464035b0acf926ae6fb912068078
MD5 f9a3294bebcb34008481c6374c214edd
SHA1 a67de87e59448b13a4e0ba6783ec83a0b1792bc9
SHA512 b101b469acb7c51125233f1804af43a0ae53647a8025b1286e4d51763bc3982034b6d6b564c04c564c2b7c3ae04689b34680b3d96768cf404c60e5650266cab0
SSDEEP 768:W7Qv2427pLuLneqWve+j+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlGnFLllnWhlroQ:W7Qv24WEneqWve+j+u1jaQGnFLfWhexi
TLSH
T18EF20B3B6C0CCB7E4F804E9CEC2ABE8E6DE801CB9698895447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 e6ceccd3ecfeab345b8bc4622f4171f23e6353bd2c04be8f0d8925150a892adf
MD5 34aab328108bd541f53f619e260aec9f
SHA1 f570cedea85c0f244c95a3f8d71a29d4211826a8
SHA512 6cc3fbac486079995a52b0a2e05e6cfe72569b76f6c266c1ad0430c1bc160d011365fc4c28644bae6c4e1df891ea1b7857a0e5fbbde7786b6b0ef6f94c30f6b9
TLSH
T155A0021013800105C01AD9B12D5363451200CD101516220B50914555CE50B405F450ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 a1dd27e3e7e88ab64bb0f0606d7518c1eb863213415b337805a604830f83e0a1
MD5 97dc64ad7eea32965eaebdef5f717955
SHA1 85b79236642b4ab2fd8726753249015258c228b3
SHA512 d96563539d6eb92370b4833b4e2089858408a0d8afe6079c2b29b4e90da4f49a9a8172cfa5f95ff877f6a57e6131f73ba5f1e7ce127fd68744e3838955290177
TLSH
T1C2A0026413814587C04A13F426DF11917334DA210242130783902045CC909564D7510D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\420ee264-03f5-42ed-bf43-63640dfa4b43\index-dir\the-real-index
Size 72B
SHA256 beb65786e81876ad22b806458333bd0b82f7d1f9bd8bef7ce36814ecdf37a1f1
MD5 332698089eca58b614af21a6e621af1c
SHA1 83151771769301c92d20ce4648463708c595548e
SHA512 82040a898f7a298f3eb52c76791d8c55215ed38357d4df46edb8467c0c613304e1f19b145518f1ae77d826fd6f3d4c09279e1054a6ab06f8c3474eaede390634
TLSH
T15DA002BE0E4E5211C230C3B521D21266A25958197153330341EA625E9850395451700D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f7f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\420ee264-03f5-42ed-bf43-63640dfa4b43\index-dir\the-real-index~RFe58f7f7.TMP
Size 48B
SHA256 da5016dff28f72d217dca53d093c652a684a7470dff1a2340dd3bf75aedfaf98
MD5 15ab56e9f390f5c6f3e3a391873b580e
SHA1 ee37c4022acc86f187dd8c19413af0e6056d9dee
SHA512 fe4e4ce73e7a46bb81acd7e28522e90a8e840bc1127bc0bc40bf4320bdfe8dfe56fa6fe1ebe0c821e3871603ad3e3ae59e9a0708748c199891ccd1388ff20741
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\temp-index
Size 2KB
SHA256 de184d2b97cb6d57ad1cf95ed9814142c0ffaa4c425d07c189b5835e34177457
MD5 07886f30de4c67dfd5a424583ad66fdb
SHA1 f43751ad75b5627184323345c10df7b1eab3e0a5
SHA512 507d0faf7aed381b30901a47a8437bc15601a3eeded06450e7c983b39251d3b0e07dd94f4f9beda35de0249dfa1aee484e65cc745a3dde45fde13eb908e31045
TLSH
T186510A5D8C4D4F51E9B911B20DB6146033B44CCDAEE80B17DCDC99F0709326A1F4B905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 1KB
SHA256 3c1a5111995c264c3ed7b2c94b62f08c0983bad6294d655c54627b21ae5eb1df
MD5 845486624ea630b5894a15859b63f46b
SHA1 23377711f00dfb25332ba748b2125918aa525602
SHA512 e9fea1ae231418202205cebcc95fd44493ca91d7703372863c6e0c9bbf6cd434707f520cf837312f667ddc52e06f5fd72d4611e4af49fcf12fe01eb85eb9b7bb
TLSH
T1A841866D9CCC8D17DE2941B419F92439337888FF1E45570B6CBC6639AC976A21D9301C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583fc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe583fc3.TMP
Size 1KB
SHA256 81c15f8bc080886bf971c96692324acd0449375fe7a6ed21217b16b5355e7031
MD5 084a5571efb3cf72d178fe628ead5160
SHA1 97e2d4d0c3b43a910880a69cb80fba77bb6b7fb4
SHA512 cfa3f490726e33db952f90cafc4b06e26aada1c098e5f8d1bb6b3a17b6809155309e016b648e26dcec70403c9003d2583a25b8533caab575ebf38eb3d63f4a37
TLSH
T1CE41B79A5C950E03CC6095B195CE7569333DE8960E41AB0F75FC8A33ACE7BB92D93114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c21c84e7-dd31-406b-94ce-ef6d954e92eb\index-dir\the-real-index
Size 72B
SHA256 eba9baf52ca6996228152414e75259b5ad3ca8fea1226d9c9e5fcc9fc476aff9
MD5 3785e4eee17fe4d5b4a41cb9cef07e56
SHA1 2fee87b208039264f4027a12b302e63eb1eabca8
SHA512 b0ef0852fe56b5174ad3fc1f21fca67fcb8f85496f639035318c03404f2a896f287eae8ed4fe6cc002526e04ca103c3984e6d5264fc1a0a38d91e8504e1545c3
TLSH
T17FA0023845948141DA511AF0718202683318DF951193C30B80902465CCAB3D85D02188
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 38ce995a310e1aa25823fcf8a7c1297611eeb686d1d75ea90c4e406a2575f253
MD5 d0dd492a942a38237155d42ff4471bf9
SHA1 4aaee7d7e9ffde83a45bf75a26bf07c4e64522e3
SHA512 e940caf21c06a1619eabdd3497be16dad2e2579567f77cf1a246027198f65be29cda398845952659b0be25e84543cdf5cd4ffa621fcc7e93159a5ee99555b72d
TLSH
T120F027BB3EF71910FD9BD3D2243110A20149BD55C9A1EC4F50ABB1DBA4F2645249DCA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 c9a548c50e93a60d1adc7202ba02fd2b3c16f785144a7f62bd6e80fe98083c32
MD5 bb8859c7f1c42b352c80cca0c0802407
SHA1 a18858da46eade4f5e4a496a17b8d0508cb60b87
SHA512 06b7816937f04f25dcef00b5b3d6399f14140c89b14115c88c9cc371053e92eede5d3c7d7260fbe3d502b4acfd8363de8c10ce9e23e387d3608f4aef8207b7a3
TLSH
T1F9F027BB2EF72510FD9BD3D1243110B20249BD95C9A0EC8F506AB1DB54F26442499CA3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 20c733b2d7cac9e412dff3c5c939ffdbb55f78bfa2b9947dd993b4bc3796c8fb
MD5 ad290581fe150e4e90830c954ab050e2
SHA1 d9cefbe5f4d7fefda793f067aca2180048602ae8
SHA512 dbe4bee48bd5be37794b36fae772a2c62789d4cc687588e8b4f85a8946c24dae0e4c35e91ed60a38e09a989a08cb9b3cf09ca93a614e487b7b7298ee8579f30d
TLSH
T199A0022A8369D255D01022759083519C7311C8540F45231580E40198F87494A4362004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5894e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5894e8.TMP
Size 48B
SHA256 d5b84faf6b552f349022f0ac75ec9e1489ef2cd01242685807d56a954680d0c4
MD5 bffe555a22bd3fd5a342770b527214e1
SHA1 4eff9a3082948bdfc402ba167fd98ea8b16457cd
SHA512 6dbf974a5483c53833bf1efb34b7138b56f1b3e90d25cb6d614183742326dbbf6e0dd676a929467de7e43f8f38dfbbaf5e0f58c6bdd0375dec9fe8d22bb0ebe0
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b9b02afb25fbf16f4a333dc6d958ba086881272c00c7c5ebf7d784f8f46d1e72
MD5 1643f0876ec2f22d0eb18d066cf4e908
SHA1 4e9210e8d0e0ca249fc1c1cae4474d6d1bf57ea2
SHA512 ef2fe1a500dac6defe465e2c0bca8f0ccfba4a7e45dbd43ae37e126117c8b15bb59b5f498708329f40ff2facd006db2e13ca0eaf6aa3d0c912ccd03c4aa999f1
SSDEEP 96:KkE4Kh6CiUQKVunW16KeQZAAKRu2i2EKbKD:SnbyVtPPE
TLSH
T15DE16511717B02B03A7E288E9995B85E43C13A633059E46B3BB944B64F27E31DDFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

29593f3e-c9a5-4f45-8986-dc8ba20335d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\29593f3e-c9a5-4f45-8986-dc8ba20335d4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 4c718bbe1c7929efd45c5c191df1b7421e563fb2fdbb60da304b99364a084057
MD5 ec3340d1623b54af38d42daddbdc72c7
SHA1 9b01079a6f92d3e10142eaed103b7ec9abaae4ba
SHA512 921a225e633da4365bf978d3d6377a19ba3cfb9890efab0561440ebd0bef86e9eb27f4c93fe7c2532802ac2560f81a6da6dce24978b6652021326f16f83c8217
SSDEEP 384:nlHiFJjccCs+Bt0S3IzsNBB8TUNTUlIlJlTppS54cgTDfwpfkm3MRka+L5ALf35:kFJccQUqBwgjS4Bw2mcRka+L5o5
TLSH
T131B21976D8A4DE3BAEF38B85B206B6879FF011A786985ED4DEC94E0C04871DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b76db5a59af1a3926f82f55226eaefd436749ad7e5a710bc145d9849e19b2829
MD5 3c274af46409effb6c90f41a9f962edb
SHA1 a939d81e6fbc4ec99a98be47d5643d77a63ed48d
SHA512 a6c76548e3a0b6842f5883db727a0d248ae188fce0fbe57b7b34baccba7a5fbe69522a4b69bf7e77ba030caf698290bc4ea54f22195d5d6f024ad71c2a71ffa8
SSDEEP 192:fONbO6IT0CQmiUyNtmcgibFt1mxm3M2h1vrq3U6:fONbO6m0gcgifkm3MIkU6
TLSH
T1FB121875B86CA86B9FA3AD55F0877B239FB0216BDB856F98CAD40A1C05C719C1307833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9335a0803e432e903f775bc0b9ddb9ffec0258f360a09fdc4235dd3369e78197
MD5 910314227d25aa417c706196e4aea4dd
SHA1 7dbb778cb61a888b092cea3ffbbc2d2ec2a28560
SHA512 612c71d16510e212caaf9173c517909fab987665e3708072c1f67f475307d6f3a6ede67a84ff34e4f6db2734f37382e372eb79732ee554bdd51dae026e03e74b
SSDEEP 192:ZONk6IT0JZQmiUyKmOgibFt1mxmuFuyzVU6:ZONk6B3yOgifkmfOVU6
TLSH
T11902F975A86C687B8EB3AE45F08B3B275FA5116FDA953F84DAD41B1C00D728C1703932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9b78b77fb315152d5e1ae39b18c583c9971fef68d53384f25a706761dc30c537
MD5 73cf937968a8b4a7eeaa74c7dbe6e33d
SHA1 2cf813a90790a03d5f082d8122e77232ac4ace64
SHA512 a004100575085e93c0fcb8d37419c2992f44faff408f807d99db4fbc7ad18d71ac742aca885657817dd143d3634520a03cc8a4de19bb27e5007ade26683fbfda
SSDEEP 384:n3jccCs+Bt0S3vsNvfWFTppS52d2gDfkm3M+ka+L5ALf35:zccQPUgS2dz4mc+ka+L5o5
TLSH
T1C3826B7168785D7BAAB39E15B04B7B438FB050AB97941FE8DED58B0C05C729C1313932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 40ee1b1e9ce33b77fb34493c96f76650f3aa55d518241b0cf810014046115db0
MD5 ea123566747bdc2651b3ede417105dc4
SHA1 d131acb04494baa21b9560f1794ec0d429591103
SHA512 5b497c6a978341a887c5073fe648e0bc47b291baa67a2fe54c1a0b29204791f041507985e2f25a65cd8b45a9b44e2d01032f2049a1e9ae772b2dff80966099e5
SSDEEP 384:nvjccCs+Bt0S3vsNvfJlTppS5LEgDfkm3M+ka+L5ALf35:7ccQPUZSLJ4mc+ka+L5o5
TLSH
T197827B7168B85D7BAAA39E15B1477B439FB050AB97941FE8DED48B0C05C728C1313932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 412d4da351806e44178621af913dd09f7b3887dac1c69fdad76d2a1ce7bc05af
MD5 9d2f937828a837661d798f018c0fb52f
SHA1 0c31f32788f46d7fd66165197a212299ef4b51a8
SHA512 58104a9562636fc634cd3053b0868435e6d36c84f0055d61b00e870c12b55e97d4e02c0f24fea2baf0c1f452e191a36385ef25bc4ef8e309f970762056191308
TLSH
T116E00103530400FEC038473100832B302BE3D03012B203465E6091A81C273002F34FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ad768cd9ff35982292b070570be0b202ff2db01f15e2f5bbd62afaae9a40a0bf
MD5 e7da90bfb7dd02f5c0416b462afc9bed
SHA1 7d0b8c518bf05f0c4068387c20fae6923b76a5ff
SHA512 6e59a7d42fe749aed1b992f7c63c821370b4d4d7a76fa23e518b86af95ad40ceb6c918baeb064f917ef02184c9add6f459b65362ca34d04cf033f5bb026d8339
TLSH
T107E00902530400BEC038473100932B302BE2D07011B2034B5A6091AD1C673102F24FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fa84f4155b9d28d6448c9559b69752580d0ab96431a64b5dc4f0fde6e0e7c2de
MD5 c6062e007f6e4ea7e3e20ffc34803b52
SHA1 ee74c228c7fc20074a05cc91097fe307fe51bea9
SHA512 dc953dfa4577383a22208bbe5378618d09e2d5fe2604078ca77ab330477dc65c414691b9dc8987a861ea522b8174c513415a4d9ca50370226fe04825c3436f00
TLSH
T149E00402938541FEC028477101A32F302BE3D0A425B203575A6199692CA73102E34F82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58685a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58685a.TMP
Size 392B
SHA256 ff5b23645657f88fb8a6c5f72a766741ae603a334746a9feca930557efda8477
MD5 f512d09e078f3de01385f1629be926c0
SHA1 2a0c4b349d4b0efb6c99d4427f306dd37c27daff
SHA512 c95e808bb43e0acbf654e3a1ea379edfa329cbf7e19cc8c0c8c3b85832681b74c9606fd6c7a9c3aa338ed8d8c37ac583e517b3728d34b90a124fc275e2a5b7e4
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

0d8b223d-0abf-4912-9888-ff128d873799.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d8b223d-0abf-4912-9888-ff128d873799.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a2c52964aa68228dc13db01804513e8cbf6f47714e65d5d729d3ab33950441af
MD5 5ccd128743b3afaa2eff202ec3ddd64f
SHA1 e5928f49bf8c72829f80247597c4131dc610b6d8
SHA512 89d88fae05b1a8ecd1ec4c7a253ef6b5ace4abba2e89ce6ae2520bb4d644cc0e51da4ad530fa04571165a55c036687a2325130f78e7c13ca2bd5b899b89a220e
TLSH
T181414C58A6E90148B3B72E5AABF6B86E487BB9732F46905E00010D4F0637A40D871B33
MD5 SHA1 SHA512 TLSH

Submit Download

09b4ab59-69dc-4cc6-b9c7-2c256f7c5f7e.tmp

Path C:\Users\Admin\AppData\Local\Temp\09b4ab59-69dc-4cc6-b9c7-2c256f7c5f7e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e9de8d4-2bfb-47a1-b1a9-4a1613fff476.tmp

Path C:\Users\Admin\AppData\Local\Temp\8e9de8d4-2bfb-47a1-b1a9-4a1613fff476.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3796_1801188101\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

116f2d1c-1ee4-4e8a-b9cd-a559995cdb28.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3796_2120883410\116f2d1c-1ee4-4e8a-b9cd-a559995cdb28.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads