hxxps://mega[.]nz/file/wuVAzSYS#R_fA__V8U2drf6ZlK5ea8oOui-koSKPBwWG9NfRwMas

Analysis

user interaction
yes
max time kernel
208s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/wuVAzSYS#R_fA__V8U2drf6ZlK5ea8oOui-koSKPBwWG9NfRwMas
Sample260724-c1ptrseb96

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4276	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293339861538691"	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{563FAE71-5BEE-4134-A8C6-14563ED91BE6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5336	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5336	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2832	OpenWith.exe
3668	OpenWith.exe
5144	OpenWith.exe
5144	OpenWith.exe
5144	OpenWith.exe
5144	OpenWith.exe
5144	OpenWith.exe
5144	OpenWith.exe
5144	OpenWith.exe
5336	vlc.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1752	4088	msedge.exe	86
PID 4088 wrote to memory of 4276	4088	msedge.exe	87
PID 4088 wrote to memory of 1844	4088	msedge.exe	88
PID 4088 wrote to memory of 3768	4088	msedge.exe	89
PID 4088 wrote to memory of 1844	4088	msedge.exe	88
PID 4088 wrote to memory of 1844	4088	msedge.exe	88
PID 4088 wrote to memory of 3768	4088	msedge.exe	89
PID 4088 wrote to memory of 4344	4088	msedge.exe	91
PID 4088 wrote to memory of 4200	4088	msedge.exe	92
PID 4088 wrote to memory of 4344	4088	msedge.exe	91
PID 4088 wrote to memory of 4344	4088	msedge.exe	91
PID 4088 wrote to memory of 4200	4088	msedge.exe	92
PID 4088 wrote to memory of 4200	4088	msedge.exe	92
PID 4088 wrote to memory of 3060	4088	msedge.exe	93
PID 4088 wrote to memory of 3060	4088	msedge.exe	93
PID 4088 wrote to memory of 3060	4088	msedge.exe	93
PID 4088 wrote to memory of 3716	4088	msedge.exe	94
PID 4088 wrote to memory of 3716	4088	msedge.exe	94
PID 4088 wrote to memory of 3716	4088	msedge.exe	94
PID 4088 wrote to memory of 3776	4088	msedge.exe	97
PID 4088 wrote to memory of 1224	4088	msedge.exe	98
PID 4088 wrote to memory of 3776	4088	msedge.exe	97
PID 4088 wrote to memory of 1224	4088	msedge.exe	98
PID 4088 wrote to memory of 3416	4088	msedge.exe	100
PID 4088 wrote to memory of 972	4088	msedge.exe	101
PID 4088 wrote to memory of 972	4088	msedge.exe	101
PID 4088 wrote to memory of 892	4088	msedge.exe	102
PID 4088 wrote to memory of 892	4088	msedge.exe	102
PID 4088 wrote to memory of 892	4088	msedge.exe	102
PID 4088 wrote to memory of 852	4088	msedge.exe	105
PID 4088 wrote to memory of 852	4088	msedge.exe	105
PID 4088 wrote to memory of 3496	4088	msedge.exe	108
PID 4088 wrote to memory of 3496	4088	msedge.exe	108
PID 4088 wrote to memory of 4964	4088	msedge.exe	110
PID 4088 wrote to memory of 3916	4088	msedge.exe	111
PID 4088 wrote to memory of 516	4088	msedge.exe	112
PID 4088 wrote to memory of 5616	4088	msedge.exe	117
PID 4088 wrote to memory of 5616	4088	msedge.exe	117
PID 4088 wrote to memory of 5976	4088	msedge.exe	119
PID 4088 wrote to memory of 3468	4088	msedge.exe	120
PID 4088 wrote to memory of 3468	4088	msedge.exe	120
PID 4088 wrote to memory of 3468	4088	msedge.exe	120
PID 4088 wrote to memory of 516	4088	msedge.exe	121
PID 5144 wrote to memory of 5336	5144	OpenWith.exe	125
PID 4088 wrote to memory of 5848	4088	msedge.exe	128
PID 4088 wrote to memory of 5848	4088	msedge.exe	128
PID 4088 wrote to memory of 5924	4088	msedge.exe	129
PID 4088 wrote to memory of 5924	4088	msedge.exe	129
PID 4088 wrote to memory of 4052	4088	msedge.exe	130
PID 4088 wrote to memory of 4052	4088	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/wuVAzSYS#R_fA__V8U2drf6ZlK5ea8oOui-koSKPBwWG9NfRwMas
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdf873c188,0x7ffdf873c194,0x7ffdf873c1a0
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,12290225433941769254,11368792742503184508,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6318165866261025137,10919504735289856640,262144 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,2667970957463393547,11443558718045464311,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8792870879617884078,8287028595754125572,2097152 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,2305842703643240271,14083223175872985180,2097152 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,82390954962923433,8170113793450349052,2097152 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,368302834945231323,12471863701352908188,2097152 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,151666849654504502,16901343234182523781,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,6195581912503565306,164082468349262840,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,3966061823751382235,7669578653328074286,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,3966061823751382235,7669578653328074286,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,2136109913277590968,7755154848738535030,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5936,i,4828600838625013815,11243530919038358151,2097152 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,10180524344127552698,4773676058077335203,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,16345649244794577941,10740513694461362288,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,11132311679198768271,12467546733240725810,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,4036381915778246113,17831704068933360927,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,9638429726877870261,6429681377454922278,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,13672241537525776373,9274337666353752852,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5280,i,18439108184497250623,8051831496073051180,262144 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5236,i,3753790675708915137,2772193338944238857,2097152 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,856083386872105907,4461536605571246139,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,10659525166965983126,7945288383282841402,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,3630242349667635969,9401770570662146845,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,16346108811285699762,5450791586090036602,524288 --field-trial-handle=2376,i,5840756550674385485,12580458307263606560,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VSTPlugins.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4393a3f8269b6988085869bc012ff2753e87a59c45f2aa11e4e8f27e95744a18
MD5 e8bedb388f8c627e7c124ea3ffce475c
SHA1 8eaa087108478fbd77143a691990f6c165b0099c
SHA512 cd979f0506fa8b0705cf906be6c3c0ea8303ee3780ac762fe19d8fdcbba41c591b45f207f3a94ee45c9e76071ebbbf00557157e6558f55fc987b85f89e70e6d1
SSDEEP 96:D9XRCkue0i9iFfXJS7Ei2bvGmXL8p2NnB2k:D90khcXJS7v4uML8cN4k
TLSH
T1EBA17F114396159EFB209772E2F32E78B5E882D52B6F4A523BA0917D793A7D20C40538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe597d25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597d25.TMP
Size 3KB
SHA256 91b0b69d7d4b83835b32f93a4fc976f238ea04d97178453556f86ede694728be
MD5 824f86af1b254411c0eae4628d4d5a15
SHA1 c30ee6d40401d962727651c0dacbb996e80a1d38
SHA512 33d80b91b9b9602265a14a7f77ff7cacffd2a1d601484bdfb493980deeddb89154c64e3dbbd9d20555da455d61e35ba737fc3e14e66e175707b2a91477ade97e
TLSH
T15161F8250302065CF3719372E6F35E65F9FC85D51B6F8E46B096297E7639B63481143C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\00\00000000
Size 2.6MB
SHA256 69844fff4946e3eee7ed5af9bb3e3a17459de05bfdfeb62805e312ce5249dc72
MD5 503434ffd38e370b773da87ba6059b67
SHA1 87a3cc99527388a7046af59403e0882b1870545c
SHA512 c0f902bb028a70ecdf44cd19fa5cf9958dd7b2698dd59ead19ca23fac75ecbbde92909105612e4d72fabd3b866ae7dfcefc81e437cd5e187445fc9d33a4d4173
SSDEEP 49152:uwK5o/hVLpiPBB+xy9GtMnAik57pQnXeGq1bnucB/+TchC438w:uwd/hVF6BBwhMnAtQXednRZpQw
TLSH
T1A3D53360D8E9323F8AB71AB556ABAC3C04536C7FA0C31189BD593D7C26C5819C9EC7E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log
Size 8KB
SHA256 90b7722478b87e9d089a83dd3d6e027ef45604508b3ae3c6fa771843781f5490
MD5 ce23b0bb8a12d80cb811377e2bc5ba3f
SHA1 60daaccd50c74ab3fb75efef668c2835ae214ed0
SHA512 00f0e637146253fb60bd920444be8f3011aca8ba726810648c0376ad75020db1d57714ec4e02ff1a88b5c78fe8b5372953e4fb596c89065573dd7cae188cbd78
SSDEEP 192:OTNFGX/h10CX/D1YX/oX/t1DCX/AX/v1QX/xX/k1wX/WyX/W1gX/TX/ID1NX/OXp:NX/TTX/BYX/oX/vGX/AX/9QX/xX/4wXn
TLSH
T1C412BFFB36844E13E4294A7927675F905339DD84B844603BF0C5B6FEC1BE652CBE02A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 be21399586e0341a78ee79c6e4e56d449b009a9a8959ab696ecb7edc2c32d650
MD5 b0a3f99a481bcd1ed30965997d183c34
SHA1 5059152081c79d57b441aa92ba9168ca382e046a
SHA512 19fdc2984ccb4aeca2c9f5530b0df1d3ce38759dc1358d5f3e4cf7da106dcd7ee58ed5abf970fa711661e88ffa4b693134e578a0072a5b21775057f9a2bc2fa5
TLSH
T180E0D8A444CDC21F61A564D34674BB8CA6A3366EE78DBE913B14C878B485850F67F190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 378B
SHA256 669697be7d57bc3345259529d295088da5d12119d9d91bdcd3b02953d864427f
MD5 64187347e698401eabd256cb0fab9b4c
SHA1 eb601e01fa8651fe45544f33b4988892989ca114
SHA512 a67b02f3da3b8bfbcb438817b232d9d1e855e02323ba9b2358bd0dfd2784e0aae2f21ab2a649248746d78488939a626f63ba5abccdecc78cff016932937a721f
TLSH
T112E061A094CDC15F601555D346247BC8D3B7768ED78DBD459B05C4B8B482440F27E1D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 2aaa3bc1612be6681f65f241590c93cdd7ed768e769e160dc76629ce46485878
MD5 2bddca26c884e55debdf475add09ee80
SHA1 2a55a120c6ee1059eb055dda181a409c92ab98b4
SHA512 874f48fc690e9a4569b6bf8afe69423ddc598831d1be0fbcd2e0b53f1f80a7a9587fec5dce0f3634cfa628be9e083ae6107bf2a9150ccaa25ae16c5202d3361a
TLSH
T18BE0686040CDC25F603524D34575BB8996A3364ED7CCBE856F06C8A8B481840F27E290
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 13cde115e1c36c99bb8bb1dbd3b76d732199987cbe6c3bc47473c07e921305a9
MD5 3d8f7c1e279b645188f3f7586e5fcf6f
SHA1 39cd06fb19157747cd97f892769bb2b1d0bf329a
SHA512 1419728f45a4b8bc4b1bff86211a744ef1132837759e7ea487bd02f5286b87c18bb9c028a045e976cdac80161d210078c8a56be23c5092caaa6f0aa179fcb4b4
TLSH
T12DE02B5865CDC11F7425649345B57B4C92D3365EE7C8BD411B45CC68B481840E2AA190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 5205f78d58728ab004255775b3f8fda250d86b05e4423111cf1c86dc2191cd82
MD5 d9ee05b1d12eaa9e592a1f755a42aecd
SHA1 9623a94ae85214d57d7a2e4f4afbb54989b5b7c0
SHA512 fc4881803f53ff7b2df2cfb8ba3757b5b886e5cf5d96c3dae550ffe20a0dc8e66713fd637f07bd1c2d31eb19b44b3e71a5a87f02201956aa0fe06759cc8a7e07
TLSH
T19FE0615081CDC11F603514D386747B4D9293365EE788BD515B04D824B4C3980F67E190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 dbdc46341fbe0379624c4b34fdb74d864d001461e811773a7a736a78b1eb2494
MD5 1f790b7aae980198d6d649d496acd15d
SHA1 9399107d3e2976a0733876a13c3d51d96d340f35
SHA512 6563380b663ed5372333a0df06eb2f80f9853c220650112889494c5e2ac49f75d60da1b870c62e23748260f298a40375633466f1076c8511f76d0302494ddfcf
TLSH
T1BCE0686871DDC21F602535D346B4BB88A2AB364ED78ABE812B45C828B481C40FB7E190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 e58932e3fb3c718a405ec3f6c23de102754711512b2a63bcf3962cdfcd677a7b
MD5 126b7dcf62e8562b9d1b8d1c2b183294
SHA1 278e6b49e5931c9f75591af9f759642793faec70
SHA512 cf29f7052ac73d612f1156e9d0c0bcf92738eb23916221e660abd1fdcc36ccb76214b1e58b31ba4bb3a7777baf955c4b96de94c6e33fc4e8c9f8a61960fbf310
TLSH
T13EE068A844DDC21F6025A4D347B4BB8896A3365ED788BE816F55CC68B481840F3FE190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 378B
SHA256 dab8cf0ce9f5b30f6c1a0db2eedd0cbdbe9d8b4f0fca4e4b56590eb1622d7bce
MD5 52b9b13f5846beddb5753f5ccee45797
SHA1 f0ef1a0c352013a3244fa87796f9889a0bf6ad57
SHA512 f599a207707e54cb5d8718ac4c295831edc9e924905fd43cfd0af00be9cf43d2ed5a9348428ee270afc505398de29995e8ccc04de4a14d1edae44c7ea15e2689
TLSH
T192E061D050DEC39F6476549346247B48E293B7CFE789BD415F44C474B881094F27E590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 7f4c1042ff7c73893d6f065f80743cb87316bbce7e43bf8e6e88df12f9670af4
MD5 991099b2db802894a8ee2abef5a0fb9c
SHA1 eab132d0c4d3e023d03fb8c62863ba366364e22c
SHA512 1f08bca562deaf9f284e441577b23d0b74b7f0d766e445eef296f32d7f0b224485a74e281801b4929b4668f2fc7c92afe2fa06cfa36a15bac19728f0a47474de
TLSH
T1ABE0226840CDC21F60A6249345F5BF889BA7374FF788FE852B44C838B482840EB6A191
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 1dea9174d027731c3829036113aa9e2eeb8ed6f81d3c8ee7fdbbf6c5da4f9aef
MD5 d1a38d0068090c1f1127aae38a9da4f7
SHA1 2f10e909c160fba535cbab8362286e68e1f824b0
SHA512 2d0a5923aaa1ca90739dede0c7033e0a75fdd7e15f58022322b926afb80faf3a87b6b461fe8301fb778c077ad1d5ac97ebf1a44ba4b260972db00d6963f7f629
TLSH
T16EE0D19494CDC11F613615D387747B489693375ED789FD413B14C464B482854F67E1D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 335B
SHA256 4cf684ddd5d33d14bdc00abb2e0876404041f237b0d1c098479c88deb0e2e198
MD5 90f81d2012d91788a973274747cc589a
SHA1 be91dcd3b47b6e544283bc04970ee3260834eff4
SHA512 3786d396ef6beff6c998fde24100560fe3eac0b90caf75f29b4a44ca0c9aaa3318e638e261fa0adce0b8a304f359c2c6ee9993355817d1247e672b24e3297353
TLSH
T188E0C01480C9C26F112210E34830BB4CD5D7354FE788BE410F88D8287483484E23E190
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 9dcda9bfcee22a714eaa95b537cf52a85c96f9585edbb6e594ad54812085c60a
MD5 96354856a976bce840048da216c2f5f6
SHA1 29a738281879607f33a408a162a6b22038cc6e08
SHA512 f67116181b0efba84b561fb9cd9784de685075996988a7a6eb068582686db9a3d0edd8aaf83bdcac7f886045c66cf7c6dd317b1a09e7c1637aad1cc9f733c4fc
SSDEEP 768:JuCxVAPayaYao4oWcJscFNDkMbMszi33Aul:LAMcKcXWAul
TLSH
T1A8D27952B5F9120AF2BB9EBBA5B61BA15C7BBE462D04D81D5860620D4C31F40CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 68b884e2552c3d8e8ed530720d1c31edfb206bacbb8ee7dc2a7960504ef387d6
MD5 1179c0037f5b4c563e75caa2dbd794d2
SHA1 1e1bdec3ea7afbc4f3fdb16d4470d2f71a57ed2d
SHA512 16fa1e41ba05eb9d7279194c63d38af4ed49e129d6e15e7a9589f8c654d8d30ef679cb6fbb7a5e40de6a8f744d9a857d86c844f2244af0c65c0c23362086910b
TLSH
T11DE0D87D84C9C11B512455E70935BF0A96AB270E9788AE454F5DCC547182444F97D191
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 293a756d10b8862a8ea042ce37e679084408f02db5799030775c64217015ed6c
MD5 1b0a2233cb89f3818c2a2e4b2d5275c3
SHA1 de17bb1f0a82685e56518d326a686a8dc88676f6
SHA512 0368d0ecf7ecd3d5dfda92d881c52694d0279a4fc82d3bbd85984a2f0ea3e726d2854df926ba7abc5d44677df60857ff20036feffd2ced9220381f9dacc16b9e
TLSH
T12E81CFF7C3A2456DDE1195F0AE04AF1BCF18045243AC3D4A89E4AF4B93B24B1E112B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0cc134ae51c0ca50e71234778f73734712f5926e8bd0735d3eb5b4e5fab778eb
MD5 4e865140048bbd7aeb23373022ab3ff4
SHA1 f9ebe043b5627df9408c639bbb6211738734f4d9
SHA512 992c19960e904910374a2c12d8f13db799357f6c8ed69e76e8cda96348bca0fc59d26c86d267a3372b70ba2408271b8d03d35cbfd3fa86b6c029f4d82c3a6ece
TLSH
T10071AEF7C3B2456DDE1195F0AE04AF1BCF59045243AC395A89E4AF47A3B24B1E112B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 504fe865091881d2bea7d36c367aa3e0731605c43bc8b8fb8010f289154b883e
MD5 ca1309f1fc23e5687e8a3735edf6c41a
SHA1 1c34378b3be69dfb00c902354b1d43e53ed5d5c9
SHA512 cc220b48569b242b46683853719942bfdd41c9018e36adfc4946735f771c55ecf5932553f7ed423072355a09811e200d4508d0ef798204ca0a9a8643022485c2
SSDEEP 192:sxZhKqRK9yM/jK1Ml8M9aE/f6Bs8acRRIdpLYHW6+WNQjD/YHOhobIgrJ:sxZhKqUx1aE/f6BsJcRa8HbQ/K9
TLSH
T1BC52D8166A349977CCDBD209FA55BF53D6F94972E2940D44A9FCCA0C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 badc7f39db363808b510639d6e2ecdc931f650c03b5de8afbc6628155e7d81a3
MD5 d684ee7a030de6925b21a643822e90e1
SHA1 7d7aa23bf959a7228ac5b26bad422597dd7f4102
SHA512 9d46027b38ffbc9566d017d68a052f3aa5e2a1d739fcf5c2add8f02a79e02114d05e5f140ead6e60f3e6fe90263fce688ccdc73f000891c552dc9463e00a7325
SSDEEP 192:sxZhKqRK9yM/jK1Ml8UQv9aE/f6Bsoa/RXWbaIdp4o2HW6+WNQ964gG/YH6cSbIj:sxZhKqUxqlaE/f6Bsl/RhomHbTC/v6
TLSH
T1AE72E707A9245977CCD7D219B905BF57E6F944B3E6904E88A9FCCA0C04F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bace03cb3e3534c02bf0ddec94f23d4c1fc195eec44c587d52774bd540a71f52
MD5 d08445bbb2f3b01ca1d1cf27ef07d3ac
SHA1 1c26e9f44600e98ec9e377de6be7de983e947f29
SHA512 44ec2540fdcde65849cdffbadc147b0eaf017facf545f4bfcc28e2e542765b4fed870966d2deccc539a515e10fcf8138169f0745b0b8a24b08ecabc596f573db
SSDEEP 768:NwUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RyroV30D:NwUZYTMWvg0Pou1ja7eLZmRpyD
TLSH
T1BAD20A2F280CCB7E4F844E5DEC2A6F963ED801CB5A984D5447EA894C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 d8617e4f8995de3c779a53611bf263c311bff19fc0ed2a678e00bd47ae299b3e
MD5 861f2b769177d09dbf165c6e10540061
SHA1 4d5221459fd5808c5576878accf519d74d913958
SHA512 c9ad41f5278867d4ac91e30c4208f4fe692c3cea0840badc2d39a952c3fde321f4b11d7ca668901af1cadfeb743b1397fbfbd3c3f1f31e8b706a41aeeef244b6
TLSH
T151A0026052804882C503AAB125963256F2124C141243228546F500D8CF505459B411BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5987f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index~RFe5987f3.TMP
Size 72B
SHA256 03839f2a9f1825f5b4ffb26935023c0644524b16fd65961bbc4128b0decad125
MD5 10fcf9ee72be68e1983e7afd8a1bf03d
SHA1 cbdae1e07e522e598528316f3038cdf87d993bd6
SHA512 78a375e4d348409f8de63c57edf5519f758f22afcf1da9fc38df167af6c9c8a0f5a6f3e602eebd0e2c6ea5fd501221bdd35c8a007ac958bde6b7da647002e8e0
TLSH
T19DA0021023800409E8171AB569675E812700DB241100974B41911044CC925C14D8134C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 06f3d503616add3980d9ddd4d4df2f9ec811f98274857e3471c30a52bca394d2
MD5 42b4f96a23245cfd3208c6ce40bd9835
SHA1 c00a7ec16d2281d4ccaa70a9879e30f6d0f7f5b4
SHA512 c3a82ee9c2c0152367931ee4dd4d5b12bbad45b378d153ac1dd2c44c1569cd1498afda8fe360c2bc7751d5f5bf5a7fcb22c8c7f5e822882c8f0f5780b0e32407
TLSH
T13851A70E0C472A17DDAC12B338BB58C43BB5A4DE56488A07E4DCA174ECC762D3C69629
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe591b00.TMP
Size 2KB
SHA256 f0fb489bf66981fd73dc4c78569e67635a44403be317dd59cde4b40fd05ee51e
MD5 275485073cb9b7dab751a815382f4e1b
SHA1 54326278e164c428f165e08d74b1435c5035b721
SHA512 13091303e06f403d0883506dd833b4312d62af3fb6a1bfdc4a67fb0670200f044dfc97673e4ddb27af19fa19c2db423a172d48ca9c136b78b6408e5bf9cb54c9
TLSH
T1F851849A5D824639E894417709E3A8B4373929008619BF5374FC9632AC927AE3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bd80467a-f4e1-4337-8cad-f72f375bd4c6\index-dir\the-real-index
Size 72B
SHA256 f5d32876d5ecdf2ef7251d0deda989096e28e8e3b2747c58d70a37077c63c751
MD5 1aea8a769ff516c2d3159d5bc187b85a
SHA1 27803c3bc1162abfa905928d618fa718bdd13da9
SHA512 02bd738eadd82aea597974b4e455d51924d7e34327dcfd3d2fd75b342b9a860b72efe075534f5074683f39ec7c527d92c1bdc513d0b1cfca5f23d0fc6b9020e0
TLSH
T1FEA002316274905AC0434B7918CBC1E4761258541345260682F4F8F5DE54146670B244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59334b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bd80467a-f4e1-4337-8cad-f72f375bd4c6\index-dir\the-real-index~RFe59334b.TMP
Size 48B
SHA256 62e7114e8974b37f58452b88ac89658f9ede96ee4e9824b4a0702323204d72d5
MD5 e9a04c75851be5a02a2fffcdfe770b2a
SHA1 72065ca768ca840cc5e55adc41ccf57b62c622ef
SHA512 dcb7d983b45ed0de647a265bd4816fd2a51df83ffcd71c7c92f37c487481538daf5e3ee29d994ba3e98f6aee1e6012e5b1ee53ea1afcbb80ea947d623ffdf1e6
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8b22c76-83d5-4ba5-a263-0cc9da1f9e0e\4f2277ea2139c475_0
Size 62KB
SHA256 03e1d38f860b312cb5d18d6eff68c8fe9f85bff86f99718e0b74c0df7ca8afbf
MD5 0b464035f3e9a02962541432b51b88cd
SHA1 0e8388e873eb7c35620201c99bc7c2cdd3923b8a
SHA512 7c293e269f7b89d8fd435468576ae95b8d2b4cc0cb65883028a8b30ac31fffc00647676e7ab22b27711235e4c51f60c016e655fc94b3dd44c1501226acb27361
SSDEEP 1536:cFwfyXTUuBHKut3JWWOQ7DtO/Ydsllqtyhh94xnm90RHPwqpzGY/a:cp4ukgMgDtyYdIYCU7/a
TLSH
T10A532AA7A262613587AC21D194977F00F12B17561544C9ECF0BD7A923F08E8B67B3BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8b22c76-83d5-4ba5-a263-0cc9da1f9e0e\index-dir\the-real-index
Size 72B
SHA256 dd96a65a59a8d1aa2a00476d3c9d3a2cfcd87773fbe8178280f44614dbc5e731
MD5 2b88b527af6e00fb0016b812061f3af2
SHA1 4a9d0fc4e0af920e2b6edd0692678f9f00baabb0
SHA512 c374c13f91b9db90b743c8348d64891d2e61688c853ce01c5349f049b962c3f516c3a064c1bd9fcb7d4784ee9a65cc5d06ff10ce890973270bf3aa92eb36aa17
TLSH
T186A0023022DF8172C00626BD51428168B314DC591549435748A14D958ED91698941278
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 6f513603027aba75814b7bde26f6694682399bb32333308229f58b71a54b8c53
MD5 88cc755a71d773a555f78754bdc98005
SHA1 4966c628121869d38e687d2bede8a1224877a60f
SHA512 43e54191242d8af13898e50439829c1be8af46a26f5d2d1df994b9f354fbbf0553d8216927d4a2bed338db1f487470f444958c3719f4531d5d64412785e0cf33
TLSH
T140F097F3BFFB1811BEAFC3CB50B1A0A105053CA4C609AD8F012BB26780B2315140DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 9e7085613afd4bcf3e9e552074f39bd3fa30118f9634a7035a2a05c9a111f196
MD5 0e1f556783e2b442a23c4b33c316c60f
SHA1 bc05dffac97782e622f3e630b5aba94c2fe6979c
SHA512 c805ed737a5283622660d46d220d23122438dc16f745283a189c9a1ca78bcb8bb44ac6d247a7cf1186573272ee97c19a47303bbd06c35a7c888d938ab7ee495e
TLSH
T1E4F027F3BFFB1924BDABC3DA5071A06115057DA8C169ED8F0566B26740B2319284DC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 4744e3551394f0d61056418d0bb527ec5680cc925de3f1b6f58444c83e0814db
MD5 3e5ce2bf65c1d7adebb0244dd2296cf9
SHA1 9f723b7f23c65e261df66530d4df2cffa15ccf88
SHA512 7531c31f1a724e16fac263ab4a292ac8548dd7b5149e4aef741a6b90435bebd79b022d632981d0a2ae86825398255190130a1779b77eccd2070202c9480605e3
TLSH
T1EAB0220CCC20C083E0280338B2F300EC322C8CFC0F2E302080BC003088BA30882EB0AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59164d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59164d.TMP
Size 72B
SHA256 d433123f9207688c9f0e8b14caba2c9167d5f91d2954cda6f69c24c9fbaa9a96
MD5 9fc3fb4b4dae354e878d4c5ed84d863b
SHA1 a1edc761f13daf4e971c122251872a38dea6285e
SHA512 a94078766cab6beec4e9d744a5546e1c619f7726c67ba2c5ecae2e2183a4df6fdc6a48b17f8d47d97a5d0784f8cd2c99760e2ecee69cf765f109aae0be43891c
TLSH
T160A00213C3CA140CD40006F1901722A093A08C59074016034495E0E9EC920D0956194A
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 33b7f69c4ed79102958dc8fb658afe2307eed3967b186c7ea9620cf1e2a26a9e
MD5 e9578d4a03f437cd2e387cc795dd0c40
SHA1 4af7067033565da3784f4f0431a8ee1f23a77e18
SHA512 03a420c9a3c54f33f6f34c80656b9ff26c9a3b5a0258fb19efed34a3c9992762a64f5f0935e7989b9f0dfb0081d7943e0321745d56e5f09dedfc0d0e134f1e4f
SSDEEP 96:KA1eK2AkWcKjCGm7mKM47iQKDKq25mKy46:EGbdzHFD
TLSH
T112D13C5230B7D2123C3D1B0896D59766DE81F1A3701CA4AB7BAD11B58E2BE209DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 76d55d2209fac64a604c767c441c2f58eaa605e1968f6710fc257ca833575d17
MD5 f8f2954e41c8141e26f1fd6cfc68a571
SHA1 7b07e244e6796fd71696a95b73e0dbdc720012c0
SHA512 d20e89ada25c61ba285a336182dc047f87fcb8ef9d5d744366fbcc319e6448faf80ed94209132c4a534c4070bd4fab400febec035f7d0aae871b3c0ef81b5059
SSDEEP 384:7sNBH5SLuiNVzX5od+ndiV+DtJrlI10e3:7iZgtOOYChlm02
TLSH
T128422A366C346C774EE6E545F44B35135FB885A7DB893F8492FC9B0C01DA6AC131B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 da80d3e3d61a0a27fc3dc54864f4f8a248068799bbe68c14af9eab2f735ab9c0
MD5 a4ae4ac9cbffe9debfdcb971dd99be5b
SHA1 4724a56a927bbafc8b36cb147bdba9dac83bef5d
SHA512 d43bd2861310e7baa284ea6b75116a7259141ebfe3b6be76955e5670711157d28885d83a8a36a071a13d0297d67c910f523ff1b0d275681dfbe94cd491eb55c1
SSDEEP 192:yONR61VWQmiUyclgGX5Obd+jA+Fdg3ao+j/aG3jsU6:yONR6W/gGX5od+ndiV+mGsU6
TLSH
T19A02D83569687CB7CEF2BE4AF48737135F951067EA952F84D6EC1B1C009769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2705ffca890cdfa971690a6f41518156e7b3652ad1360ff40e7b9b362f0c1250
MD5 2696f18296ff4a7533125d8b8dc08bdd
SHA1 839cb3937357eeaff47978d782972c08714bd8b2
SHA512 e394861693d405b6f68ccccc8e8a30358851361d0042538d9a12d61a1869c7d6402342a3289f85ea3ece020a527dc63bef0e2fcd14995fd83bc14153aea26435
SSDEEP 192:HONE61CWQmiUyOlnGX5Obd+jA+Fdg3ao+d1ySJrxjJUq21U6:HONE6fznGX5od+ndiV+DtJrzI1U6
TLSH
T1DF12FA366868AC6B8ED2B445F48731535FE95167EB897FC4D2FC1B1C01EB6AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a2387e3add5c874a92f23eb5c8867d24978511535c54d2940b5d68b05898735e
MD5 0224daa46ac4b4ac8e8b29e3a54ee748
SHA1 917da6cb6a2d89037a2e22c4d671c7d021dad92b
SHA512 3dc5c0da45249aee5036d1ec4b96f086e344fe736e50bd6dfed422381e44445ec57c1bef1da6293d20e8e5bf4cdf73cb80edaa434755016a75840433520f560d
SSDEEP 384:RiFiZcIMzsNT8TUNTUlIlgTnSLuMT+2zX5od+ndiV+DtJrJI10hGF:4FQwGwgiZw+qOOYChJm0m
TLSH
T1B9B2E9F258D75836D9AE9B47A77D3D024EBCC0A3F6856A84B3D89A0CCC561BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2c007a9c52a6e8e460d7a7880265d42cc1ef83d9cf7377bcbe91b4994d660b40
MD5 537ebdd02a5b997a89391ab403741f86
SHA1 f74e0342ae6e00fe47e30eba7d8637316b7bb110
SHA512 58c1662de6cb653fa84bb2aa14cf725a02d79ed1959b675e90a42a3dc6c278667527e9d52c6d562ffb4669c0843daf07427a19ed36fae24b1bd2aeba736bec29
SSDEEP 384:+ZcIhsNBgTnSLuMW+2zX5od+ndiV+DtJrlI10hGF:8hLZx+qOOYChlm0m
TLSH
T13A725C366C346C769DF6F546F44A36135FF890A3E7C96F8491FCEB0D01AA5A8031B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b418dd19848ec12460dd0cce538ea4600bc33cdc1437e12f0f3e63d6b9dea2dd
MD5 068732eb42232f0dea7d83bb8bc4619b
SHA1 36dc5788c935f44c8f5fbecd1a2d86ec5bdb282a
SHA512 1a7f9832ec7709a942950bff37abbbcd13355426d4df1b5c2336a28c7d5d2cf04189778250a888711d15c193defdeef2b8604851bd97d4a65f8df2f2f8544552
SSDEEP 384:RiFPZcIMjsNg8TUNTUlIl8TnSLNT+2zX5od+ndiV+DtJrAI10hGF:4FHErwgSi+qOOYChAm0m
TLSH
T10EB2E8F658D75836D9AE9B47A77D3D124EBCC0A3F6846A80B3D89A0CCC561BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1d4bdbfda48e3962e4303e4ee086c6ba413cb2388ed0cf24001a0b220cbf4f27
MD5 fb7f52718bf6d72eda029f120521c012
SHA1 1162166b349b353d7b05f0248017b45df967a56c
SHA512 554b67703f71157e352145de4d5ff3ffa32e1c2ef829547dcc643b9308ff6832a1f4a6a3d35449f1f8c76394d05ab5520542a002a4749bb40cfa3b6bd81a5354
SSDEEP 384:RiF+ZcIMjsNg8TUNTUlIl8TnSL1T+2zX5od+ndiV+DtJrdI10hGF:4F8ErwgSm+qOOYChdm0m
TLSH
T10FB2F9F258D75836D9AE9B47A77D3D024EBCC0A3F6846A84B3D89A0CCC561BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2f13203-c3d7-4536-baaf-5816d2fb4055.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f2f13203-c3d7-4536-baaf-5816d2fb4055.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6898ea92eeaed682983267223df2500d640627b89826a9d44973b0b30a798b6d
MD5 61a9836054164d3fe0d874fdac9cf3ff
SHA1 4fd79d086b11f03fffa8b919261404cda2e0c497
SHA512 97d98b65f106260649ac24a3f2c19175bafb07b44b4fa83317db4bb4facdd0c2091ee5f75c9626a5b92418976e36f20b8460d9f116a5fde1e293ee4ef37fe4f5
TLSH
T17841F758A6FA1148F3B76E56ABF6686E487FB8372E46D49E00010E4F4632B41CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5336-1732-0x00007FFDE9600000-0x00007FFDE9845000-memory.dmp

Download

memory/5336-1719-0x00007FFE0DB10000-0x00007FFE0DB28000-memory.dmp

Download

memory/5336-1713-0x00007FFDF8B80000-0x00007FFDF8C52000-memory.dmp

Download

memory/5336-1716-0x00007FFDF54A0000-0x00007FFDF5583000-memory.dmp

Download

memory/5336-1724-0x00007FFE04C90000-0x00007FFE04CA1000-memory.dmp

Download

memory/5336-1705-0x00007FFDF5C40000-0x00007FFDF5EF6000-memory.dmp

Download

memory/5336-1731-0x00007FFE00930000-0x00007FFE00942000-memory.dmp

Download

memory/5336-1730-0x00007FFE04BC0000-0x00007FFE04BDB000-memory.dmp

Download

memory/5336-1729-0x00007FFDF52E0000-0x00007FFDF538B000-memory.dmp

Download

memory/5336-1728-0x00007FFE047D0000-0x00007FFE047F5000-memory.dmp

Download

memory/5336-1727-0x00007FFDFE940000-0x00007FFDFE98F000-memory.dmp

Download

memory/5336-1726-0x00007FFDF8C80000-0x00007FFDF8D18000-memory.dmp

Download

memory/5336-1725-0x00007FFDF3E80000-0x00007FFDF408B000-memory.dmp

Download

memory/5336-1723-0x00007FFE051F0000-0x00007FFE05201000-memory.dmp

Download

memory/5336-1722-0x00007FFE0DAF0000-0x00007FFE0DB0A000-memory.dmp

Download

memory/5336-1721-0x00007FFE04D70000-0x00007FFE04D9D000-memory.dmp

Download

memory/5336-1720-0x00007FFE04DA0000-0x00007FFE04DC6000-memory.dmp

Download

memory/5336-1709-0x00007FFE04F70000-0x00007FFE04F9B000-memory.dmp

Download

memory/5336-1718-0x00007FFE0DB30000-0x00007FFE0DB5F000-memory.dmp

Download

memory/5336-1717-0x00007FFE0DB60000-0x00007FFE0DBA1000-memory.dmp

Download

memory/5336-1715-0x00007FFDF64B0000-0x00007FFDF6598000-memory.dmp

Download

memory/5336-1714-0x00007FFDF87B0000-0x00007FFDF8A46000-memory.dmp

Download

memory/5336-1712-0x00007FFE0DBB0000-0x00007FFE0DBC1000-memory.dmp

Download

memory/5336-1711-0x00007FFE0DBD0000-0x00007FFE0DBE4000-memory.dmp

Download

memory/5336-1708-0x00007FFE04FA0000-0x00007FFE04FC2000-memory.dmp

Download

memory/5336-1707-0x00007FFE0D540000-0x00007FFE0D559000-memory.dmp

Download

memory/5336-1706-0x00007FFE0DA70000-0x00007FFE0DA81000-memory.dmp

Download

memory/5336-1710-0x00007FFDF58B0000-0x00007FFDF5C40000-memory.dmp

Download

memory/5336-1704-0x00007FFE0DAB0000-0x00007FFE0DAE4000-memory.dmp

Download

memory/5336-1780-0x00007FFE0DAB0000-0x00007FFE0DAE4000-memory.dmp

Download

memory/5336-1779-0x00007FF6DBE40000-0x00007FF6DBF38000-memory.dmp

Download

memory/5336-1781-0x00007FFDF5C40000-0x00007FFDF5EF6000-memory.dmp

Download

memory/5336-1703-0x00007FF6DBE40000-0x00007FF6DBF38000-memory.dmp

Download