hxxps://www[.]mediafire[.]com/file/g8mdubryzmb9ux9/luna-src[.]zip/file

Analysis

max time kernel
899s
max time network
894s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/g8mdubryzmb9ux9/luna-src.zip/file
Sample260720-tkpx9sht8x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290372602264446"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{076DD58E-B688-4EA3-8C62-937A0213695A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3756	4656	msedge.exe	85
PID 4656 wrote to memory of 2980	4656	msedge.exe	86
PID 4656 wrote to memory of 4304	4656	msedge.exe	87
PID 4656 wrote to memory of 4304	4656	msedge.exe	87
PID 4656 wrote to memory of 4304	4656	msedge.exe	87
PID 4656 wrote to memory of 4972	4656	msedge.exe	88
PID 4656 wrote to memory of 4972	4656	msedge.exe	88
PID 4656 wrote to memory of 5444	4656	msedge.exe	89
PID 4656 wrote to memory of 5444	4656	msedge.exe	89
PID 4656 wrote to memory of 5444	4656	msedge.exe	89
PID 4656 wrote to memory of 2340	4656	msedge.exe	90
PID 4656 wrote to memory of 2340	4656	msedge.exe	90
PID 4656 wrote to memory of 2340	4656	msedge.exe	90
PID 4656 wrote to memory of 1136	4656	msedge.exe	94
PID 4656 wrote to memory of 1136	4656	msedge.exe	94
PID 4656 wrote to memory of 1136	4656	msedge.exe	94
PID 4656 wrote to memory of 3200	4656	msedge.exe	95
PID 4656 wrote to memory of 3200	4656	msedge.exe	95
PID 4656 wrote to memory of 3200	4656	msedge.exe	95
PID 4656 wrote to memory of 3512	4656	msedge.exe	96
PID 4656 wrote to memory of 3512	4656	msedge.exe	96
PID 4656 wrote to memory of 3512	4656	msedge.exe	96
PID 4656 wrote to memory of 4160	4656	msedge.exe	99
PID 4656 wrote to memory of 5904	4656	msedge.exe	98
PID 4656 wrote to memory of 4160	4656	msedge.exe	99
PID 4656 wrote to memory of 5904	4656	msedge.exe	98
PID 4656 wrote to memory of 4552	4656	msedge.exe	101
PID 4656 wrote to memory of 2704	4656	msedge.exe	112
PID 4656 wrote to memory of 888	4656	msedge.exe	113
PID 4656 wrote to memory of 1272	4656	msedge.exe	114
PID 4656 wrote to memory of 6020	4656	msedge.exe	120
PID 4656 wrote to memory of 6020	4656	msedge.exe	120
PID 4656 wrote to memory of 5092	4656	msedge.exe	122
PID 4656 wrote to memory of 4984	4656	msedge.exe	123
PID 4656 wrote to memory of 4984	4656	msedge.exe	123
PID 4656 wrote to memory of 1316	4656	msedge.exe	124
PID 4656 wrote to memory of 1316	4656	msedge.exe	124
PID 4656 wrote to memory of 5384	4656	msedge.exe	125
PID 4656 wrote to memory of 5384	4656	msedge.exe	125
PID 4656 wrote to memory of 5472	4656	msedge.exe	126
PID 4656 wrote to memory of 5472	4656	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/g8mdubryzmb9ux9/luna-src.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fffcecac188,0x7fffcecac194,0x7fffcecac1a0
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,15447716837177195138,10361439905574642383,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12188320551573202812,4879928903314066722,262144 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,9362401358904462849,2784207251680036365,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16225543214182594655,4080381484478496090,2097152 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9727107113634306653,11250234044228703210,2097152 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5072,i,5488404968486666074,8599803643105879348,2097152 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5136,i,10236630603775678095,7781006232755660686,2097152 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5820,i,4766824115163405433,15159166033462906275,2097152 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,13660235257766513181,8750068136392817040,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,1126642253249932736,7502457526150760748,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,7160238761546930832,12030944006988793237,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,7160238761546930832,12030944006988793237,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17348319112751711409,12118468598070300062,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,5974033637584374195,17240863137338364959,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,12347438793432241806,2344871400557037459,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1087106089555529827,11049846808238498537,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,2892796401798488632,11281724077145317282,262144 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,7437158043198798179,15996658090524697390,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8918697620225928855,1636619842135594615,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,14029426276292887379,15176749955405058228,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,7714715799150136083,16125779062108949143,524288 --field-trial-handle=2276,i,4854256787875404413,11994751108116892993,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2a14279a-997a-4e2e-920c-9875c0f3e996.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a14279a-997a-4e2e-920c-9875c0f3e996.tmp
Size 28KB
SHA256 860e7bce2701e7e59b2144186299de97acc791b3831423f5c7d33b63949299e7
MD5 b863ec8f8518d576d7231c6384a7f61b
SHA1 656e15271b21d573b63603668ed6b1b2b0b07cfb
SHA512 0025df78cd5f777b9600338ae0d0705185c883ec95392df05738f8d98f1e6c8538aea24fe2470682e37cc9769a7a84a5a198ea343ccb42315b94e95aa5ecc605
SSDEEP 384:njiF1tNn/s3n9SG3sNW8TUNTUlI43QckCrStGphifGGJf4KqPL7WuG29OObjI9Gv:OF1j+9H3jwgik34FGPqPnWuGQ29Mj
TLSH
T10ED24A36D858CEA7ECE74FD9B75A3607EEE4426386DC5AC8DAC85E4D00C75AC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

06815e8b-367e-4c8f-a573-d78daf3caa38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\06815e8b-367e-4c8f-a573-d78daf3caa38.tmp
Size 14KB
SHA256 8ced06f895854197f3b916a7c31378f1d62027500e475cc75947f853b63651a0
MD5 c9bce67710988d23206bc7dcb4c0c503
SHA1 43649eda4528b010bca9c91b44e87d670aa5546f
SHA512 734df34d60195fa3bc4a9aaffccad1a2da847ff3afd5d2dff33c78403acc3f7029f010ba90b6b88079c7d18ebc290679961cb7a156bd6dec127b43e17b04dff0
SSDEEP 192:sxZ29RTyMqZjK1Ml8MkVU/f1OssTIZFaZd3azodpuaHW6+WNmR1/YvtC+UMjaIgL:sxZS4MC/fEssTIZFazxNHb6/qJ2j3
TLSH
T1CC62E8166A34997BCDDBD219F645BF53D6F90123E2944E449AFC8A0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 72c09a481a33bd3818951831b511471f157a3c544893bf9000eea33370f6c9e2
MD5 7d09889014831612113d2b0779b574ab
SHA1 ee5a6a29de1e475bdf316caa50c3fad4c34f797c
SHA512 8e0faf8f5a4734429197b1b356af4bdb8f32471b58404c7ca69dc22d0e9570f6f150d338aa8de473e19c5ff15bca05d766dfc330ae164cf8c379c6198bc478b2
SSDEEP 192:EjGGbccc11KKbbbooxtOO/UttCTToxxxv+++ZA7h:EjGGbccc11KKbbbooxtOO/UttCTToxx5
TLSH
T190F1480A87D5C79ACF0990CB49A4A25C85713B0BEBDCD508078D9FEE304ED9BE5B16E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 476a7812dcef5994ac1f35f1bee4f216f21b3b7e7fce978a1d4080a2378e7a3b
MD5 b88eddbc3b9b206d1168cde99373c43c
SHA1 23acc617c81da6b8e3b8ba536f2be41199cc566e
SHA512 25e09c94c421808a1226bcdd1cf990a873650e9be7ea34e3c6518007b46c5a0cb98eef364f0800bcfdaa4416fd23e5a6e9afd1eddb918601e2d9d2444ca78e9d
TLSH
T18FE026C934CCC26FD288A44742A8534CC391368E93C96D2A9B0A88DCB003140A3F2591
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a21b6ff74a491132e4a0d38e97280ebc7b5d03144225b87e1a9b6a684a7ffa37
MD5 c91e75425f93fb40b271daad4045a2e4
SHA1 f37a21abfce63fb4ea4f83b584b6b466022c3fa5
SHA512 caf1a2e00831069d609f32859a1859757498c520e76a1ebfb8b5d49b349d38b5b4249dca7546559fc653d54ca7470a5a8e07757a51db0b2471be26960bc7d317
TLSH
T14AE026E575C8C22FD24DA44B42AC734CC3C0368E92C86D5AA70984AC3003640A7E2698
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ef448f6acc99d6d641148180c0bad4942d1691244bb6b46a3d23ed1373704ba2
MD5 5696c582c92c2d9d574a4602acdd880c
SHA1 30272149591fb1e3ebc4ef7246c10074a744f94e
SHA512 811e965d6c64918f191223697c46d36196aaf0ea84432b5cf42136879b9844eb315dcc2ae89a96af11353a335b778d96d10f733dd32824ec00835a7a46804ed4
TLSH
T1A0E022AACC22EC2708FD0759A04D874AEB0513273A81894F3B3C830C8FB462A46C585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 48af693416944af4566f277361d4f395e9eeff5a172161107b16e8fe452e7740
MD5 d90426196ba60e353e0d0e28b8c4167f
SHA1 ee202c116a1939f6b75ce7aac3e6c38818a20499
SHA512 8b7a5742b293cc32850cdccd9d7de11ec0538c222a2f1635edffb46445bf344af008787c662f03ec42c7660b7f102934b222f5ac954f6b32901bb29f3af92f18
TLSH
T1A361C735D34524AFE7110630ECEF366576B464E4F5172ED08407883BA5EA7B3E45DD08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d3e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d3e5.TMP
Size 2KB
SHA256 168a9f3391adf4d864fccd26dd9abc4f1e07f0cfd68869d9725150264ea8ea39
MD5 06da621a476c6ca93a32a5741ccafa16
SHA1 fb11a20c2664ccd6168a8e7ce891f111f39fcae5
SHA512 39e0d15b0e14d3b3177f61dd37096e3fc252b3c1dbab6cb5bedfbd5d3bbcf9a290fdd44c6bb3b209f8622fb93082f4d6610b12b5eeb064b3abc5abf82525d3ae
TLSH
T16251F536C30909AFE31146308CDF3169B060B1D8FA075DD08967883AA6F87B3CAADD18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9213b1597548a0c575c990c42a8eb6e73fca9fbc31022b175030e820962eda45
MD5 7276a15f26533205ba15a7e7c71ebc6c
SHA1 614c326e3085e210eda05ba40fa2cece31a9467e
SHA512 551b3fab24c127a21dfaf82a37ec85ee6e8447ab428303587d70d65a2148526e73a4fd5fbb420be99b2372d45c791a594c96411858f4a131bcefa23a5e849746
SSDEEP 192:D1j82dSekGf/7btDBfeOZxwaaij6b1yrkYm4IrYKhs6Y+LCi9xo7fmsWQhJRUfOV:D1j7dSekGf/7btDBfeOZxwaaiGb1yrkw
TLSH
T1251266F753A2D65E8A115BF49604AE1BCF1C0625832C3C6589D1EE87E3A3033E16E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 e4d59e823beb089897889d77427fa6669fd92442b9403efa36de93773c965e7e
MD5 61c5e3f1fdeea257dc98dd47f14cd1d1
SHA1 baedf11abef3f2f1e4db58da9baea8c75af26eab
SHA512 565c2d9bb0272564e8190fa6c5f6d669881610130d9e5fb26ae0208209cc08bffdbb3995eec66be03762a8ef55aa344c8a82cbb32bb18ee6758acffa5e542f56
SSDEEP 192:D1T82RfzHl6oRDnRjae0aJaaij6b2yw4gkYm4vVYKmT6Y+Lq914xojmKsWQhJ/FM:D1T7RfzHl6oRDnRjae0aJaaiGb2yw4g4
TLSH
T12532ACF383E5D52E89111BF4A6146E1BDF1C0619832D3C1688D5FE8BE3E2432E16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 ce23fd0a50a53dff907649da63f0258f6f6d9bf2db0cd717adae15005a0e8672
MD5 f90e41718300db2c2f25a66c652218ac
SHA1 b2e1c4a7d303ce11cd364eda5b4df1077dbbcd66
SHA512 9be31269aba9eeb472e7bf73133e31699187d947d015817a910b8b71b34a59d086111e3ffe9a55898979a8794c9d371fd42051d98dc6211a566728ff0c015096
SSDEEP 192:D1T82RfzHl6oRDnRjae0Caaij6b2yw4gkYm4vVYKmT6Y+Lq914xojmKsWQhJ/rHt:D1T7RfzHl6oRDnRjae0CaaiGb2yw4gkc
TLSH
T15C32ACF383E5D52E89011BF4A6146E1BDF1D0619832D3C1688D5FE8BE3E2432E16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7d7e73e4aff826020e917092e712c4c4afb709dc5d8a43c8269c991f94aa9b2d
MD5 80e10f9792888673f34db3c9e88d5c29
SHA1 09be185164e2fec4a586cd7a13d33dccbc0f1696
SHA512 df5f6f5f66b1551a463e29a8f8173fdbfef3e6dd45b5eaff6dff23bf41922d46957e59e20fe4116ecd18373fc170dd2567c1a8a1e80ee5d238986502dbd93c3d
SSDEEP 192:sxZ29RTyMqZjK1Ml8UQgkVU/f1OsbIZxZd3azodpuaHW6+WNmR1/YvjeYUMjYIgP:sxZS4qzC/fEsbIZxzxNHb6/0JIv3
TLSH
T13262D81A6A349D778CDBD219F645BB53E6F90163E2944E44A9FC8E0C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ada28ac5-45c0-4dd8-b8c3-f9d0d90ad841\index-dir\the-real-index
Size 72B
SHA256 c001cb41ef653d1c1b6383a6b37a8c9a747d0dea6401dcd6a2fe3bc1fb978176
MD5 c4df255909a0e148ebeea3c26a811269
SHA1 f58a5693a432a38d8cbfcd44bb50dcb7e7992bde
SHA512 a9e6a9350bc0963288eb5b90335e001b3a9d041e8e590fee3d8e1ddd7dfc9ad735a24f019a72cbc9c29fd8c73b7eecf80e68134d5e665416c8e80a54084654c5
TLSH
T1A9A0021017B504AAE1149EF1600116762308E91978048AD552D421D7CCE05804706854
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd3f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ada28ac5-45c0-4dd8-b8c3-f9d0d90ad841\index-dir\the-real-index~RFe5cd3f1.TMP
Size 72B
SHA256 504eb78d7c364ff647fbc0ae558e89de3305967d59cd8861bff0bf94d1a91b4d
MD5 8eb4b7f8697c63200655e12c63121cd3
SHA1 99b7c9bed2f76bdc5d9f87f66babd06d19f78c9c
SHA512 2f750d974fa8ccfe31ae81e877f243a9498080694610c25bccb72c5f6288e593f05d9aa8da14a58fd5225c7ee6cf061b636b9c0f411f75979fe4fd709071ed7a
TLSH
T1ECA0023253940859D424457310290AF5A344AC1530144AD352D0508CDDF104147D6507
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 987ac2ad6fde2787a22d3adc6efaa8d8de61d488c349fc6635df568921250ce9
MD5 c3c01fafdc62a2502b0a40735e0c72ce
SHA1 bf932215fa3b34421b80f6eba4e64abb8b8a57e9
SHA512 54040dba151b163ac3fcde70087ee1813260a69479dbcddc25403793399b2e40cc25e06e35810c582c15ed9af6d5692637e49cfe3ca57c1fd24c5208a7d477d4
TLSH
T1D6F05CB33FFB1C64FDABD7D6253018B0454D7954D890AD5F2416F2E751B232C2059CA6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1f81f2a2f4febd0ac1da6f4d6a7e388b1ec51f7e6a221f9c7f34a79d317ba83d
MD5 2a0ef0e1ddb90f65b57fd0558f3e69d9
SHA1 fd320e26c39bf6f338d105b831842ea006704d09
SHA512 db9907b2eea7c79bca11b411245391f7486e54c47dac786cd914a0cc0770e853087c72bbb3f15d1427f82a6204321c8e4b3390aac945f1903171f9028341451c
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGc:05ppxnY753RNBvRJJdt7p5J95Jng
TLSH
T1A0B27C5A713A0212397E2988B39596364F4135A37058F4AF7FB814A14F2BE224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1a57c2e0cd91078d0ec0831cd6eaa83dfbf3d43e1d1b417a0e0705db0d0f7e16
MD5 9d8151165eb4f0660b4733b922a6f16b
SHA1 ad1da6468de5a4e0202d718bb5e7871e52ccda4e
SHA512 3ecd14015ffc2401865464203f2a191407e77bea2bca20369aa761e68c42bb9a9884cca34850bd4dda77843bad2a62f74d60cefadb26b39edf530dad25af27c7
SSDEEP 384:npfiF9CcmyWCs3sNW8TUNTUlI4YQckCr0tGphifGGJf4KqPL7WuG29ity/7Igo:pqFccps3jwghkZ4FGPqPnWuGQW
TLSH
T13CB23A36EC58C9ABECE74F99A75A3503DEE44263C69C9AD4DAD81E0C00DB19D430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7be5ed5055a262a23085a79f42f19a12706995ef635b3ea74a58dece8269ae5b
MD5 0ab5f57dc0e28e4dcb5f1ba774d7c1e9
SHA1 52a0ab9172e0c9c67d275bd41147416416173d98
SHA512 7b29954fea3062b1af7d7d80f294a9d6e4491c646676f0e3d762d5980e3d3a7b46eb2ec356c5753fd25a471e19a1317985f13fa2efdc21cddf750f01b12411d8
SSDEEP 384:nAiF1tNn/s3n9Sqi3sNW8TUNTUlI43QckCrStGphifGGJf4KqPL7W7G29OObjI9m:bF1j+9g3jwgik34FGPqPnW7GQ29Mj
TLSH
T1EAD23A36E858CEA7ECE74FD9B75A3607EEE4426386DC5AC8DAC85E4D00C75AC4307819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1003d2de5c907a218bd5bba1371e7b81c54ac29c7439965942fa5838558e9c66
MD5 6d090c881e1067fe6e98325e95ed6b2d
SHA1 8bd38ae1c9c2169758b228cbff4cd01a3e64dafa
SHA512 b80f6a2acce089ac7fedfbf2ce84134c5f096e79ce060cc3b7a160dbb12f74d13ffe063d79a471b7120af1aef2d1d4477290b090584c17571e239699e33b1cd3
SSDEEP 384:npkiF9CcmyWCs3sNX8TUNTUlIm2QckCr9lqKphifGGJf4Kqhspwe4KV8p0vHdtyN:p/Fccps3WwgbkUgkFGPqhlI8p0vzC
TLSH
T1E8B25B36EC68CEFBECE74F99B74A3A07DEE41227859C99D4DAD85D0D008719C530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 63d1897aad1e47479eda548bf613ebe884389c2a4dce17e876d71a6856098f0e
MD5 e191ab07d03c2cdc6d07ab81c68e3133
SHA1 dd290b574dea326bb453cf43ccd7e241a7f4e997
SHA512 0cf205d833f1ec5d5024c27c3a8562f06ca4513221c785701e72b0ea8906b76fcaa474768223151dcbd05a8ee9777fd9bf07323c61aba5a57be91fd7998b5975
SSDEEP 768:pnFccps3zwgbkUgpFGPqPnWsGQI8p0vzC:9s3dcdPnW+I8p0G
TLSH
T1EDC24B32E858C9ABECE64F99B74A3507DEE45223C6DC9AD4DAD85D0D009B1AC530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3d9c28e735ea56e43c662d7ed60f26c83897063c8639425cd32f730b4cbaa2df
MD5 9f17421d474279c821ba1d9ed3fea10b
SHA1 80a09c1884300c0938754ae0671b63dc4b01b142
SHA512 f006a69d336b02b9149af2538e1f585fac624472a720ff3d6ecf43fb146d2ca27585da6f67300fd654644b2d142d66dc60b5544216ba54508a6473e29046657c
SSDEEP 384:npfiF1tNn/s3n9SG3sNW8TUNTUlI43QckCr0tGphifGGJf4KqPL7WuG29OObjI9m:pqF1j+9H3jwgikZ4FGPqPnWuGQ29Mj
TLSH
T10AD24B36E858CEA7ECE74FD9B75A3607EEE4426386DC5AC8DAC85E4D00C71AC430B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f0d6c87f930049df2a9a8aa99ea76bc7d4983e53848705924ef51a70d5b884ba
MD5 62949aee9ed98e9a4b305f0691eb2406
SHA1 38b90bac5f455e9ea641b85b5194ef3e1d22a135
SHA512 46b7969e59d53da898d720439ebdb2558db0b416d5022643f93b437d8770c3e7d72b1cce8bb5ec2a15499fd0531c0fe63d4f64b9c563a86b6f74a37a6a1808cc
TLSH
T1AB41F659B6F91148B3B77E1AAFF6A86D447A78772F47945D00110E4E0A22F40CD6173B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4552-340-0x0000021F93CE0000-0x0000021F94CE0000-memory.dmp

Download