hxxps://cdn[.]discordapp[.]com/attachments/1518828153387352225/1524203601088745502/SteamGen2[.]exe?ex=6a4ee4b8&is=6a4d9338&hm=554f042c073f71bf8d1b7aa6720770a9ed25bff4bbae4d237a0abba762f38f1c&

Analysis

user interaction
yes
max time kernel
898s
max time network
731s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/07/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1518828153387352225/1524203601088745502/SteamGen2.exe?ex=6a4ee4b8&is=6a4d9338&hm=554f042c073f71bf8d1b7aa6720770a9ed25bff4bbae4d237a0abba762f38f1c&
Sample260708-abp25ag13p

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
50	3948	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279425700841131"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{9D42E669-CBF8-437E-A41C-1AFB21207AB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
524	msedge.exe
524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4140	4044	msedge.exe	83
PID 4044 wrote to memory of 3948	4044	msedge.exe	84
PID 4044 wrote to memory of 3172	4044	msedge.exe	85
PID 4044 wrote to memory of 3172	4044	msedge.exe	85
PID 4044 wrote to memory of 3172	4044	msedge.exe	85
PID 4044 wrote to memory of 1400	4044	msedge.exe	86
PID 4044 wrote to memory of 1400	4044	msedge.exe	86
PID 4044 wrote to memory of 3824	4044	msedge.exe	87
PID 4044 wrote to memory of 3872	4044	msedge.exe	88
PID 4044 wrote to memory of 3824	4044	msedge.exe	87
PID 4044 wrote to memory of 3824	4044	msedge.exe	87
PID 4044 wrote to memory of 3872	4044	msedge.exe	88
PID 4044 wrote to memory of 3872	4044	msedge.exe	88
PID 4044 wrote to memory of 1752	4044	msedge.exe	90
PID 4044 wrote to memory of 1752	4044	msedge.exe	90
PID 4044 wrote to memory of 1752	4044	msedge.exe	90
PID 4044 wrote to memory of 1884	4044	msedge.exe	91
PID 4044 wrote to memory of 1884	4044	msedge.exe	91
PID 4044 wrote to memory of 1884	4044	msedge.exe	91
PID 4044 wrote to memory of 1196	4044	msedge.exe	95
PID 4044 wrote to memory of 836	4044	msedge.exe	96
PID 4044 wrote to memory of 1196	4044	msedge.exe	95
PID 4044 wrote to memory of 836	4044	msedge.exe	96
PID 4044 wrote to memory of 1892	4044	msedge.exe	98
PID 4044 wrote to memory of 4484	4044	msedge.exe	107
PID 4044 wrote to memory of 3884	4044	msedge.exe	108
PID 4044 wrote to memory of 4484	4044	msedge.exe	107
PID 4044 wrote to memory of 3884	4044	msedge.exe	108
PID 4044 wrote to memory of 3884	4044	msedge.exe	108
PID 4044 wrote to memory of 2084	4044	msedge.exe	109
PID 4044 wrote to memory of 4900	4044	msedge.exe	111
PID 4044 wrote to memory of 1508	4044	msedge.exe	112
PID 4044 wrote to memory of 4588	4044	msedge.exe	113
PID 4044 wrote to memory of 2372	4044	msedge.exe	114
PID 4044 wrote to memory of 2372	4044	msedge.exe	114
PID 4044 wrote to memory of 524	4044	msedge.exe	115
PID 4044 wrote to memory of 3900	4044	msedge.exe	116
PID 4044 wrote to memory of 3900	4044	msedge.exe	116
PID 4044 wrote to memory of 4312	4044	msedge.exe	117
PID 4044 wrote to memory of 4312	4044	msedge.exe	117
PID 4044 wrote to memory of 1820	4044	msedge.exe	118
PID 4044 wrote to memory of 1820	4044	msedge.exe	118
PID 4044 wrote to memory of 4724	4044	msedge.exe	119
PID 4044 wrote to memory of 4724	4044	msedge.exe	119
PID 4044 wrote to memory of 3464	4044	msedge.exe	120
PID 4044 wrote to memory of 3464	4044	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1518828153387352225/1524203601088745502/SteamGen2.exe?ex=6a4ee4b8&is=6a4d9338&hm=554f042c073f71bf8d1b7aa6720770a9ed25bff4bbae4d237a0abba762f38f1c&
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff84e4fc188,0x7ff84e4fc194,0x7ff84e4fc1a0
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,2278058722781783892,3268857081992640526,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,7708549317460022023,609940157374803022,262144 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,4183888784117414922,7239077741521449677,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,11848535096924671571,16138488295659921942,2097152 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,1080757798425483880,15956608153386457512,2097152 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14969594031867490074,8000002126274939274,2097152 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11045557958317666368,12032491269112328185,2097152 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10545454566403906634,16590951134217195588,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7779027265104394439,17162113972049001125,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,8624405446147562465,9215180145661554614,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,8624405446147562465,9215180145661554614,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,17951008113648581062,8790145026424832572,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5900,i,10853834950928053133,8501022973419680410,2097152 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,15953438798622467843,6296705745918067831,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,10230162558980221525,11796195519234070707,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,345846451270711986,8907428902819437617,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,15840930879524124536,6438729973687470733,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13831750452728080175,1726295031318438575,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6312,i,5650107687001725179,4563533805737508742,262144 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1048,i,4050890490404688268,8425813435859613504,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9686359538467092615,13265038537986159869,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,1066058454045167542,2185468799678514104,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,7162650341095063378,10757754153023485638,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,14643344285269733649,6908171722146010595,524288 --field-trial-handle=2332,i,12560594223577781517,2236619972234770680,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 3.1MB
SHA256 92ad10257a7e4c133218fae41d97192a680111560d4598f3a0930558a7779f42
MD5 c9d4881959f073efc9b7b6ae4c256468
SHA1 9a5e79c0ddcb3f369c8b3e18a4a6ee1cfff8e38f
SHA512 0bb87548526809c0583662d49c431caad22861b56220e1645f93b0f9f63a02a9ad837cce7b42dac399b9c977a2d5a5be430febd2ca5584f6b97d78eedf3ebb97
SSDEEP 24576:ulEzzM2SK0A0UM3ET3tKBpk75eQr0EZUKZEB3tKBck75TiFCo5:ul0fZ6Ug6nUCiFCo5
TLSH
T1C6E5328AC5A3BAFF02257C77E836B4DD666807D24190FD3B6EFC857E93999A84403350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 11KB
SHA256 57b9bdf380c7ceb06e81e3b15a19a5e4b54425a3d24f4058f32f3cee470ff460
MD5 613ad2554e75f7227aa2187aedf1dcaf
SHA1 fa85620679d6775a02fadbb0af1cb15f774bf04a
SHA512 ad7f3cfceba079a7177150fe7f8fec9409fc4a21252f4be75403ee93f677663fd535396ca1c66161dc3d72ecd37d5de51835df4deb4d1f648ef8d39395faac0f
SSDEEP 192:WtjCYP++++++++++++++++++++R+++++++++++++++++++++jjjjjjjjGLO:EjCYP++++++++++++++++++++R+++++v
TLSH
T14D32C05287E5C35B8B1A108E8D60635E50B13B0EEFDCD508275DCDDD308E49AAAA9FF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 2a6560be4060e149cdb2c7273dfdde65a1fa477f7d9a3565ce17b2a52ae96a58
MD5 bfc55d6a1b9017661360348e83ea8f4c
SHA1 00ca5dcf752f5b552b6bfc2dfd673e61cd666713
SHA512 d68f79e4ed4b6f078adaf89340c70affe37391b9eaa5f0bd2d2050e12199b9be4ed969cc31f0d7a5ae556541fe4a590c75418409b48a0776532afb1ef25bdbe1
SSDEEP 96:9mJjqmJKmJPmJ+mJtmJAmJamJjmJ0mJ0mJOmJOmJOmJjmJjmJjmJjmJjmJJmJ7mE:4jHnuLI5XSdd777SSSSSUKKKFLO
TLSH
T1A2A1414383D5D39B9B05158A8A64A39E80F13B1AFBDCD508178C8DDE304D49AEEA97F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f689e616a6190bb3c6e886151f33f613f0e6f57051892b800ff29f0eeeea4a60
MD5 5a788ad81c905acd8f06e0e7eb326ccc
SHA1 2e89baf1312a7a28feec84fb339599e2736f5a6e
SHA512 11fc1060744e857d0ca7a32094ca13fd422623f0b076a77c7bce8a5444b8a1088976ffe89eb899c72a60db0268c66b60b2bc886f5c12a9d8c7c01b779973670c
TLSH
T1CE710AE37057C46CE7C862F662F0023176F29488B6C34EAFADC274709E2EB2159B1665
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cdea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cdea.TMP
Size 3KB
SHA256 aa3f59fbfc542b41b980ac4ffbcf1e2db6a5abc08f2fbc5601639699b01bcbdd
MD5 462b3ded40070ba907ac03eee1f07c8b
SHA1 99d16e325cef5ce315b60c671764c42bb89ae869
SHA512 c6a92e89e3b917fc6b25c1ce28303a9925ac35cf9bf3281d9bda475a3ab66b93e15ab0ad52d20dc59ebffb4212acc98651401daa04865ef2a3b7b3b78f118a39
TLSH
T142712BE37057C46CE3C862B666F0023076F29488F6C34FAFADC274709E2EB2159B1665
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6940a8a6d32a844c2d4e11cea0329f1d5572109030caefb3567dff7aa612e0a5
MD5 9359fbd276b23383e873d38e1ff24415
SHA1 c456bba0d3844b1128c26a5b5af6436a07686baf
SHA512 5fceeba861b7be145df9ea1024e303deee4120cc84a462b583c37dd0333055240d642b8e37ba6860807c787482008031b8eaec46a51f04223ff6252b544d3747
TLSH
T1A43199F383E6866EC91116F46A146E1BCE1E051443283C1A89E4EF5BD7E3475E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 066fb8ab78af23d327c2908d05fb41f9296526840fccfc92cddfda7e0463e4ea
MD5 ec37790420b04eaa0500a69ec13b9c23
SHA1 e50cd9f1ff02dc0c622942dfe8158d189cf1ae15
SHA512 55211f5f653b21600448002df1fae61c32af9886ee4d4a1adf8b83aa05374ab4d4f1770e6118305177400bf8a9a20dd07cdfd04ba1a8cfb1c2cd6b0ef9d72588
TLSH
T1C9218BF383E1865ED91156F0AA14BE1BCE2D0515432C7C6A89D0EF6BD7E3072F042A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 61a6a7ae9054d1a6d5a30e1fcb06bde181a9f7e38edd896e9568e5a2a1df9bd6
MD5 6ee800c74f64726e3cbfec7ac47c2824
SHA1 9c379a8932671e8e884bf95bda1d8c79160c63e0
SHA512 05549649af2e2d516ba43ce8526efe59e0d99b122a213b7be9d11f77d99194e0e5f83d99cc48d0a07576176bd2dd11f7b3cfee0784929810f519ffcc61f61303
SSDEEP 192:sxZqRWyM/jK1Ml8UQR89n/fqs003BehIdpLHW6+WNGYrxvLZbsR3Ig5bJ:sxZqwqRan/fqsvxzLHbG4vL21j
TLSH
T1AA52D712AA385977CCCBD20DFA557F53D6F95472A2900E44A9FCCA0C05F6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9dd8040af01b93faa02923a3787c0d0e846255ba659ce64be726ad48e7291850
MD5 f90fbdfbd667c91ea932691fe2094e03
SHA1 601c3f6501cb0e510ea45ef5e1db98996a689956
SHA512 902d911aeaafb561c5ed939a641f282e4f2b73882e315f169c9bd09b144061cd7fd2cf19efc3adb316f5daef3697ed1c51277c95e7b7b83dacdf5eefe8ae2d09
SSDEEP 192:sxZqRWyM/jK1Ml8Mkn/fqs13LehIdpJHW6+WNGYrbZksR3IgrJ:sxZqwMn/fqs17zJHbGUf19
TLSH
T1C842E812AB345977CCCBD209FA557F53D6F90572A2900E44A9FCCA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7c92ab05b793e54e06030dc0e86ae5631c45dc5bd37db1b5967f1c52bb5725b5
MD5 7a60148b9c5aa27007d72c1fe7fdcf3f
SHA1 f3d66ebb6e05f11d9a71b049bfbcdc7304ffecd9
SHA512 3fd951aea8c0a39d6a2e8b8764038c7b4a514fe87c9edc180d2e5fd7785d2e0ed67b3abb9137375e6e23cb833ba68a63e1d21a093e9d1599a57d7d34ffb5513a
SSDEEP 192:sxZqRWyMqZjK1Ml8UQR89n/fqs003BehIdpLHW6+WNGYrxvLZysRLWIg5bJ:sxZqFqRan/fqsvxzLHbG4vLhduj
TLSH
T14852D8126A385977CCDBD209FA557F53D6F94572A2900E44AAFCCA0C05E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a415f715e16eb53597fdf0336b884ca5cee9e9648065d8bc81ed2ad90e98a1f2
MD5 4f8678467298e5a49594a73a9eb527d5
SHA1 a410736eabf043f95b2a2143ee5bb17315f133d1
SHA512 0f821d1c0509a35f43e822674afffa7afb26c0f51058fb0b1182cef84b5d69fc849ed37f3fdc3681738eef911a22fbf5d694d5ef78f4f7254f8f89218c405f73
SSDEEP 192:sxZqRWyM/jK1Ml8M9n/fqs003BehIdpJHW6+WNGYr0LZwsR3Ig5bJ:sxZqw1n/fqsvxzJHbGhLn1j
TLSH
T12142E812AA345977CCCBD209FA557F53D6F94572A2900E44A9FCCA0C05E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6f163d40b8521cd9ae88cdcab9a98aaab771e7734d142b5f662d809110198f6c
MD5 2b1132041829d148f820df73e45b7ba1
SHA1 a7c235e4af32e3fa116517f840e78468d6d37c62
SHA512 5d1a3744d2b1946eb4ab514617bf14ddc73d9ff6d97fe07b8c66c8f454f890752fc1afca0057f7e98f801aec16af51b3fb069f7012465830eb6d725b4a70927a
SSDEEP 768:1KgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRaroWZPTtGx:1KgL6XeWviSZqu1jaSJL7+RRWvGx
TLSH
T196D21B3B680CCB7E4F840E5CED26AF976DD801CB9B984D9447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0f328cf458544bb3374057edfd1fdcec80f2f863c131e08aa287d87d507cc4a3
MD5 10c19b3b73173e35a7cbd8a5af9f945e
SHA1 3a7067ddd8a5d8755287a847a70703f565b99f4e
SHA512 39824a42ca68a6a3eaa870ad5143c75e28ba2a412e45343ccd5effe8e6c55f9a68bfcd17f233f573bab0f701429397d09a3ee74c561eb9bd27b1dfbd35fc106c
SSDEEP 96:KwX+KUsq4gKluKHU1gkeCGEWCPvgsEK4hgmEcEkveEZHpD:oGLHU1gkeCG7CPYs4hgmrEkveEZHpD
TLSH
T107915601323A424238BD380C96E6E627DD8271A37518A46F7FBD50A34A67E125EBCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a627e149292d77ee5afa192cdca548a60f2733a799b5b374d1ec1efd72864d01
MD5 dcfaab984f05586de793b7d2dc3f9f38
SHA1 a8c0a11e9f7ad9fcc49287f912558a30f82627d5
SHA512 de3c51b811cb73ac9473f13b97289d267db68a775f923f2222d58d7da956f874499d9ab4da3d4bf6b16ceb894662ba370a29565f894aad5c51a52a3d993b544e
SSDEEP 384:kiF1tNn/s3n9SJzsN/8TUNTUlIlkByGg8/GlNC9uO8EusR+5u+hScjmwKgYM:/F1j+9aGwgGGNMnz1ROVh1j+vM
TLSH
T179A26B379C598867EEA29A89F94A3217DFB44173C9C06E94EBDC6F0D02DB5DC0306E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dd05eddadf91cceb78c472aff61897bcb7e9f52e375dbce5bbb95eb5b345fd71
MD5 061d198f8ba4cde7816ce1ebc0cefcdc
SHA1 ee28e59c6a4f85e8bee51fb445705a5d631d52ad
SHA512 beddb8abffacde6d35ce4815cd735083aca73d7a9b36125a1bc36cd9a0046d29d65edcca37c414c128fbefa37bcf3bb3720785ad251532554f4fa0556f46a75e
SSDEEP 192:uHWLsNlkgQvGubbFCWt8WaKQmiU1vX9N4iSuOCz5Sus6R2+OSulepHKYqLU8:DsNlkgyGg8/GlNC9uO8EusR+5uLhU8
TLSH
T1FA321A7BAC685C22ADA3B944F4473613AFB45127DA843F54DAEC5F0C06DF69C230AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48816619b76f644451405d36b613ee95ae182bc656d42212445786e90e207ae7
MD5 0a36c30e619282ecdf1dd1fd88750da1
SHA1 b3ec79d1c61575450a76155c3bc1e9bd19ed13c9
SHA512 8b7eceb5082b1a6fa1c1f822fe180f586986a0323e07e859f344d173071f50921fc9ac478ff0df4063e08e86d356f4ed9574a29f08580ecbdd67e2b54a446cfe
SSDEEP 192:YONo6LCWtDQmiUyOQILSuOCz5Sus6R2+ksElvU6:YONo6mg1EImuO8EusR+EhU6
TLSH
T13B02E93AAC696C77DEB36E45B4877B276FA41037E9902F44DAE81F0C01DB64C2302D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ffd3a3f56296391557ac12e687c2914c9929ead60c3265dce7191c2fc7bbf8fb
MD5 34270a1289607fdf3d433329c859f3bb
SHA1 a1b2a23846ea2e4f287cf91e1ad15519b1213efc
SHA512 261b152f4534700b31974eedf5d2a923ece08d6b3be76a1368799c9883e00cfbf4247a575f26a1581fcba0bedb0b6d58b116664448ba3bb3b717c9f29425f3b0
SSDEEP 384:DtNn/s3n9SfsNlkByGg8/GlNC9uO8EusR+5uLhScjmwKgYM:Dj+9UDGNMnz1ROih1j+vM
TLSH
T1AE929E379C2A5C23AEA2A949F947361BDFB4503395C02F44DEEC6F0D02DB59C1316E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 428662f3ff233ac2e33197df11ebe8c34a4e76fc5066fec856498c364cbd4d05
MD5 504e0b90a3258e4fb7e093fb61ba50b5
SHA1 28e48cff2d7b75d3d278eca3e950802079384517
SHA512 24aa7245cb1778c8b4309e9211e8b9d74fa104658bcc2058fb5ec5d916ebf87d490d60b97759985e656f5098736fdaf6bdbefc21423e0e89bc6474c424ff2184
SSDEEP 192:fONg6LCWtcQmiUyTbQeLSuOCz5Sus6R2+OSulejI/YqLU6:fONg6mgs4EemuO8EusR+5u5hU6
TLSH
T134121A7B98685823ADA3B944B48735176FB55127EE843F40DAEC2F0C06EF98C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f3fbfff83336b19c0f45f29f549203a98fb23d53709c5f29e8b372d9cc78f255
MD5 665bea2c2e5017925a5ad1faf0866b60
SHA1 f3f2c328055d0b3d0f7a3b6c10973db37b1b6e7b
SHA512 85b91bcf38f2b8c4aade4c1c2a47d97a9942d990909c2087161772a864abdd9c806f44a97f1248ef61cef1afc539264e30bfb67ecacf28d187f51a467f688d56
TLSH
T1E541F768B6E91158B3B37E5A9BF7A86E487FB9772F06945D00110E4E0622E00CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

SteamGen2.exe.crdownload

Path C:\Users\Admin\Downloads\SteamGen2.exe.crdownload
Size 1.0MB
SHA256 e5cdb7814aa133f870d0f834568b78a4db13701680380eaed7769ed00fb45523
MD5 bfc7584f1c8cd9aa01e6d00c3ebecea7
SHA1 69dde4c90416dfd3cee55adde06cbbedd94c6dcc
SHA512 dc59db1402c1af758b10a88ef84aa97087385276ce8fc575f90aa169be2731003db9fc5e7e46f48f120c039461ef5b92fcd2927b28dcb67b0ceea729ce63ac67
SSDEEP 24576:Awt+r62HlvY9wykeqSoqRTeeJfdm1Jx9kF8vLbcQv5BDZZn:AworNHmFoQ41Jx9kF8vLbcQv5BVh
TLSH
T126259E6E67A901E9C1B7D178C6578603EAB274191331DBEF07D086A51F23AE16F3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download