hxxps://wetransfer[.]com/downloads/c8b4328a479bc8ac61ae39c226a17c4720260730050854/82eb7892b83576b7bb839b0e5a2035b820260730051014/891894?utm_source=wt_sendgrid&utm_medium=email&utm_campaign=TRN_DL_WTP_01&trk=TRN_DL_WTP_01

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wetransfer.com/downloads/c8b4328a479bc8ac61ae39c226a17c4720260730050854/82eb7892b83576b7bb839b0e5a2035b820260730051014/891894?utm_source=wt_sendgrid&utm_medium=email&utm_campaign=TRN_DL_WTP_01&trk=TRN_DL_WTP_01
Sample260730-jf54kseq9w

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2692	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298706721385733"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{97030633-D80F-4191-8322-CA59818C5DC6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5452	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5268	msedge.exe
5268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
5452	EXCEL.EXE
5452	EXCEL.EXE

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE
5452	EXCEL.EXE

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2876	3008	msedge.exe	86
PID 3008 wrote to memory of 2692	3008	msedge.exe	87
PID 3008 wrote to memory of 3744	3008	msedge.exe	88
PID 3008 wrote to memory of 1736	3008	msedge.exe	89
PID 3008 wrote to memory of 3744	3008	msedge.exe	88
PID 3008 wrote to memory of 3744	3008	msedge.exe	88
PID 3008 wrote to memory of 1736	3008	msedge.exe	89
PID 3008 wrote to memory of 1968	3008	msedge.exe	90
PID 3008 wrote to memory of 4648	3008	msedge.exe	91
PID 3008 wrote to memory of 1968	3008	msedge.exe	90
PID 3008 wrote to memory of 1968	3008	msedge.exe	90
PID 3008 wrote to memory of 4648	3008	msedge.exe	91
PID 3008 wrote to memory of 4648	3008	msedge.exe	91
PID 3008 wrote to memory of 4620	3008	msedge.exe	93
PID 3008 wrote to memory of 4620	3008	msedge.exe	93
PID 3008 wrote to memory of 4620	3008	msedge.exe	93
PID 3008 wrote to memory of 2612	3008	msedge.exe	94
PID 3008 wrote to memory of 2612	3008	msedge.exe	94
PID 3008 wrote to memory of 2612	3008	msedge.exe	94
PID 3008 wrote to memory of 4684	3008	msedge.exe	96
PID 3008 wrote to memory of 4684	3008	msedge.exe	96
PID 3008 wrote to memory of 4684	3008	msedge.exe	96
PID 3008 wrote to memory of 2192	3008	msedge.exe	98
PID 3008 wrote to memory of 2192	3008	msedge.exe	98
PID 3008 wrote to memory of 3176	3008	msedge.exe	99
PID 3008 wrote to memory of 3176	3008	msedge.exe	99
PID 3008 wrote to memory of 4768	3008	msedge.exe	101
PID 3008 wrote to memory of 4140	3008	msedge.exe	107
PID 3008 wrote to memory of 4140	3008	msedge.exe	107
PID 3008 wrote to memory of 4140	3008	msedge.exe	107
PID 3008 wrote to memory of 4648	3008	msedge.exe	108
PID 3008 wrote to memory of 4648	3008	msedge.exe	108
PID 3008 wrote to memory of 4648	3008	msedge.exe	108
PID 3008 wrote to memory of 2496	3008	msedge.exe	109
PID 3008 wrote to memory of 2496	3008	msedge.exe	109
PID 3008 wrote to memory of 2496	3008	msedge.exe	109
PID 3008 wrote to memory of 3928	3008	msedge.exe	110
PID 3008 wrote to memory of 3928	3008	msedge.exe	110
PID 3008 wrote to memory of 3928	3008	msedge.exe	110
PID 3008 wrote to memory of 3836	3008	msedge.exe	111
PID 3008 wrote to memory of 3836	3008	msedge.exe	111
PID 3008 wrote to memory of 3836	3008	msedge.exe	111
PID 3008 wrote to memory of 4176	3008	msedge.exe	115
PID 3008 wrote to memory of 3640	3008	msedge.exe	116
PID 3008 wrote to memory of 4176	3008	msedge.exe	115
PID 3008 wrote to memory of 3640	3008	msedge.exe	116
PID 3008 wrote to memory of 3640	3008	msedge.exe	116
PID 3008 wrote to memory of 2660	3008	msedge.exe	120
PID 3008 wrote to memory of 5452	3008	msedge.exe	124
PID 3008 wrote to memory of 5740	3008	msedge.exe	128
PID 3008 wrote to memory of 5748	3008	msedge.exe	129
PID 3008 wrote to memory of 5756	3008	msedge.exe	130
PID 3008 wrote to memory of 5376	3008	msedge.exe	135
PID 3008 wrote to memory of 5376	3008	msedge.exe	135
PID 3008 wrote to memory of 5544	3008	msedge.exe	136
PID 3008 wrote to memory of 5544	3008	msedge.exe	136
PID 3008 wrote to memory of 5268	3008	msedge.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wetransfer.com/downloads/c8b4328a479bc8ac61ae39c226a17c4720260730050854/82eb7892b83576b7bb839b0e5a2035b820260730051014/891894?utm_source=wt_sendgrid&utm_medium=email&utm_campaign=TRN_DL_WTP_01&trk=TRN_DL_WTP_01
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,10444234884634743499,13010813938520744980,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10136104545756358686,7472312630335745378,262144 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,14710276758175557847,9964301433652511415,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,14890459304468973278,15538023880428576511,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,3786867289347819903,6751283857528077087,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,7266498065869511577,7867798182103363876,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,10516160602692919643,12400493888498580907,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3500,i,2989667646771572312,2596669308413991367,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,1394156951631756480,8381418662175171386,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9161248179398048831,15887782650476124305,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4151041437105853165,15009807689510334576,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4151041437105853165,15009807689510334576,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5060,i,11524245890167974474,15710685750174531894,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6472,i,16510393811305549488,7424393151607877601,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6640,i,16759126370099227252,1724213697579104875,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6752,i,9716199773822603391,17801483197668505521,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6772,i,8110859112240323289,1031058134023212010,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,14474802374082908645,8242242142127746243,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7176,i,7457524534819295607,1395700108966124016,2097152 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,16236545509675857352,2709369743266751818,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\SK问题回复.xlsx"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,8051942586287804252,9388861057976511864,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,5513384519623544555,10677598725351027654,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,15163745549577062487,1283171455136343303,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,6350082259691048065,10440852288734402961,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,17402572181347325072,14547855827212331425,524288 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7732,i,11649480603084897442,1234458199319445947,262144 --field-trial-handle=2340,i,11697110705092906860,6084499407723609701,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 864ace1121b094329f66aa986644b388477e69171dafbfd9220f1c59561115ff
MD5 9feae002eca1fda98ff0cc8f798f95f8
SHA1 b4d376d55e7ddac780bb47f0ad18c644e854c6db
SHA512 84bcf069f8e559839084a8ee3156685c8a331baf6472ad430abb3b30c2a121edc37a06979836b99d6f9b12c095d027df02172923aeef2bb7ec377174d57d9bba
SSDEEP 96:+E4Y6Fc2xx8xuzslX+mvJuybk/BOrgqs19I8JF:+E4Y6qEx8xuzs1NutBOrgqsPI8H
TLSH
T135D1C9BD67919CF1DBF2217048C53A8335B190DAF9C3AE8F01725676E80AF954B5548C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f567.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f567.TMP
Size 3KB
SHA256 c3a3881b9050f118ca119a5dd12e3ccec368bdc153608ab082d0d99c9d02dcdf
MD5 6372a29093dbd16e6eb89c2e66a6ad43
SHA1 2b63740289982f250ea50104fbc71795fbc43974
SHA512 7a0a994d02412813ae246cbff352f862db9f3e6873c118aad8e9468668837ab3885397da837adffee7ac95b8195f51f1d65ab56386b4aa09ae8cfa7ea56b27ce
TLSH
T19461C3BE0582EDF6E3D13A3190C03B8738F190E8F823BD5E01E348B5640AB514A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\000003.log
Size 209KB
SHA256 f5ec8821bdaf2d131939bc1173d72c1aa549d3efbccb4a39efa3d841368878e5
MD5 c54a940913b74bb925b690d4c637df41
SHA1 87dcbdbc15d27c1ea2aa578940532c50a23f6dfa
SHA512 a579c61a6da425927732fa017968dfaf8874305a0b2aa5bb031e8df1cf6ad51445c486edbcb4c17d9f9e07761d01908a228278ef05b999f6e6a156b58207a4ae
SSDEEP 3072:eRxZFpztEjAudicpXkQWQo3vIaI6vHtn2+UpGnYgO9cyCxyOAwZEzJ2iU0aP5rou:KQsL
TLSH
T1F324F67FCC91D837C5BA4536A5F52F85AAB96E117D808C0BA1CE3A089833B633DD590D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 ec92c057cdb74e3198b7b3e7889f9184dcfef1d3bcfba459724c5b1b7fd0cca8
MD5 360bb3f9fdee8131ec2dd32aca4a6167
SHA1 faf5b62173e82d7259e504ff4c8cb69adc005eec
SHA512 04eb3da20de2c219d790e83df5b0c6e62743d85aa4bf10ccd5ae4411308785fe0121a4cd6dd1c8e319e1f2493b7f84765c7257facfe17ecb00cb849ec62a058a
TLSH
T1FCE068BCC4CCC11B510021D31974BF4E85ABA70EA7C8BE4B1F07CC587442188E06E1A2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 7a64076e8bc3cb38bf026eab215578fa1ccf4cfec9291ff235ceb39fafb04958
MD5 b368c38f6570e2f69675f0ceca7b5d94
SHA1 69aa2e62ce56e144c4da6980c8e7837abaee2bca
SHA512 944d5571927ece4c87f08f99c013bb2ceb603f244af15f45e8878922552eb3de2b48993c6cda4729de79d85bd79658ce2e5ca640f8752bf78e242779093f68fe
SSDEEP 192:DDlWY8BJuhNwhJeuUJETj3JNKeEkh8iTfl1xydR69QxalYry7vxLiFBRR0U4Odqx:DDlWY8v4eXeDCFoedh8iTfl1xydU9QxK
TLSH
T1BE22B2E3C3E4873DC81516F06B142E16CD5E0528B2693C6B85D5EE4BE3E24BBE28554E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00ef925a1ba9c1aa37b006fa0d7c01ecd9b60018b19f16bc23581b1edb7b9efb
MD5 7d1bf67d1055a96d494aaaf7dca3c978
SHA1 9655a4f4aad8ec8921a6bb2290ef0c4a4adaa3ed
SHA512 c2c12134c9b23994b3e2b543c255d3ab4a6d144d71daa5c0b1fbcd679412679cc4ce3cb198b5ecf678804d9cb9b068de280cb4d5070e6916c4a2486d39851cac
SSDEEP 192:sxZwRryM/jK1Ml8Mku/fpsM2tidpPtHW6+WNvcHE/Y9IrDt8IgrJ:sxZw7Mu/fpsM2EFHbf/S9
TLSH
T17142E816AB349977CCDBD209BA51BF53D6F50572D2904E48A9FCDA0C04E6AED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6cd3265edd683b8d3fed7308ce930172b23f4d4dbd137c14c54cc33ef99be534
MD5 f925057eb93c1548032a1c8a83552c3f
SHA1 904cf005871c73e95871c120a23afe58a2f79559
SHA512 4aaa03818d1bf5c57cc31bf49638bb77a1c3b851eb2efcee495d35786b6ed0e964757ab64e35b8cb63b769d40b7b4bc3f74b9f4d1241b9a14cb3636989cb58bf
SSDEEP 192:sxZwRryM/jK1Ml8UQ89u/fps7cItidpFtHW6+WNvcnDXY9IwHt8Ig5HJ:sxZwVqau/fps7cIELHbAXzz
TLSH
T13F52E916AB345977CCDBD609FA51BF53D6F44472D2944E48AAFCCA0C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4adbb9906d4cd2e239da9d1b10aa05a7c19b6f4e84fd6c3c15a5eccab8125d3e
MD5 62e375fdc1c75e241cdeb4211e34b452
SHA1 84bb494f6363cfee6a6fa85d9d2db5abbd5cf979
SHA512 1efaa86e7bd7cc63f4b785e4ac4889dd75e01b0f5f76d138b48349bc1c6caeb434606462dcde59d7ea85d64cda533862b8b86c8253c7128bcadeca9ca9e76910
SSDEEP 192:sxZwRryM/jK1Ml8M9u/fps72tidpPtHW6+WNvcnDXY9IbDt8Ig5tJ:sxZw71u/fps72EFHbAXi9
TLSH
T19052D716AB3459778CDBD209BA51BF53D6F50572D2904E48A9FC8A0C04E6AED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 def2bc399db0d61e22cdeb9a86b7fabb7f03f2ce3486ed4e44956d5776c7be22
MD5 c13b3e8f472a34144ad044b6152a2b05
SHA1 3d60558336cc56afbb5be7cedbd11cc93f313861
SHA512 07a311e3000c59f17d05dca4bbebb3e5270e1e1d5df6a055329e78476e9ea1a6a93d8037c897f674708e268d4f30bc52fad5ab1797d5090a9f3a765d4f36bb26
SSDEEP 192:sxZwRryM/jK1Ml8M9u/fps7cItidpPtHW6+WNvcnDXY9IiIt8Ig5HJ:sxZwV1u/fps7cIEFHbAXkz
TLSH
T1D952D816AA345977CCDBD209BA517F53D6F44572D2944E48AAFCCA0C01E6AED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 80936fe9fead5376c6b6f8ac462b6319264376ceb2d991bd03973bf114e5211f
MD5 f292b485cd1255657a3966b1a365b545
SHA1 fc6bd744f1e44e770312b9d5fccf1a65e20cc96f
SHA512 424533b64d1bcf79d2ae292fea2e4cc6864af882902f309e91d797ccab3c5f9bd6f9bed3ce5585a03bc3c191aa098db5cdbc41ddb60bf68a97c2650bd90262f8
SSDEEP 768:shcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN/roTg6O:shcv21wWvu+Z+u1jaeFLeRNsT+
TLSH
T1DCD2FA2B280CCB7E4F841E9CED2A6F866ED801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e00e94654a07066e9c6020d6071eb2bc68fdf4197bdec45c1ee801c9d60812ff
MD5 c21a1ce07c407efed7fc56ccc49c6096
SHA1 e693d60c53f4d6aaa4013ca2530ed35edad4c85f
SHA512 e1cc6031cdb9b25e34daeac28aa0de5375720866ff55c7af88da1c86d963accc5aee85192b44b97039d1ceb42996f40a63670ca90292d85adfdd7ef34e8a9235
TLSH
T1BDB02202C22E2083E8208BB0E8CA3B8032B00CA2C30E0C83C0F0B0BCC88330003A2000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589872.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589872.TMP
Size 48B
SHA256 2fb531a46da9c523c9692f164bf577090adf0e9e0673bed4b517eca7595523f0
MD5 ff00bbed01ffbffdf2cad2b085b86d6d
SHA1 43d7159da10905eb81192f3546a7bb2ed67d5b83
SHA512 1811c4b50aa8343135ede79fab5ca456ea3458035abf80bcb6cb7989b215ed3ab21f9c96191d47cf06e21741d19d0610b10a4a680a9db96666d3150f0cbb9afe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 52dfe3eb81b4e8271654ace4eeac5397cb0bafb3caa9f5de455c3e696d002b4b
MD5 9aa3fd710dc9fcc1c8b96af0f97ac6b6
SHA1 73ff3c4328d465494bcbbc10e371d0b787066979
SHA512 0413bf714b4b9fb662e5d6790f601ffafd3f683fb0acf3450ad7ace95fb0b5074f0699cc95b4c4b813d5b6f15dee6bdb6a096a43e204d648073943fb9d4d5e99
TLSH
T167A0022243861105E5191375258307503310D8304125135751E100848C956904B090C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 df73866603fb83eba8fa0afbb2fc8bbf35bcc7c23aacfd006504ade70aab345d
MD5 5ce82ad82df092604d5f0882e8ab3a96
SHA1 a96305ae6409bf0df7befcabe7cf320fe50edd6c
SHA512 1fedaf7fc369eb3958d101e20691bb1451e4db6dce959a9e2c7d100cfb5e5efdc6d19ed1c5ca2f079e4e4a094c485bb91a721ce5aaff5effdacd39a017212749
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyamP6K0Iyu:mTfHlpu
TLSH
T1F0918245707A02A2387E684C97E6953A8E827163B418E57F7BB800A10F27E179DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8abe042-fc92-4284-84e9-9dbe4f578597.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b8abe042-fc92-4284-84e9-9dbe4f578597.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5b84c5d8097be1ed62726198b56e3a73260f86044e36c095b54f8f4117fbb06c
MD5 dcc95f9e67e29618ae1c10e518851cf9
SHA1 9a8e90920f6062e2ab3de99014c1164041ea1834
SHA512 976fa146182224bc5fde9e9ba8fb0f92bd83ea9162f883cd98a1a489accdd0e73a3dd967036f3e8fa3ae7f8941b4f53281ce518ebf2b51a34ae788f1f11e2aef
SSDEEP 384:9iFTZcIsVGsNT8TUNTUlIlCsAzitIue+CXOmep3JrppGOObjI9G6w7iI:0FLX2wgdMJpvO9p3hppG29M7
TLSH
T104D229F659E74936DAAE4B43B77E2D128EBCC067F6845A44B3D85A0CCD961BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7318e5f181bc46533b6555ba976abe93ee2573b5867100817f9da27aa00ee950
MD5 0a799170e25e7b72e2c333f50dea43e5
SHA1 94de46b10407972b33c8589c4f7e0efc69364c1a
SHA512 0ed034f71ede07ce194862fc9ee6b8522073f55af48bdac99e985b8bc958d9b53a2bdfd1bf6ed26b94a892a83b5049651dbe43494183450750e606ad6da26b69
SSDEEP 192:JONO6v+YLNQmiUyAqZh+CG6Om9oEusClU6:JONO6vz/UZh+CXOme6iU6
TLSH
T11902C939BD281C6B9FB25E45F5873B275FA8217BE9952F80D9E42F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c0bbe6c32d21ed3f527b06d1bd8c41df29437c88fc75e071dceb7de076aa0fd
MD5 893b3028c7c6cf3dabd2096b09f2c32a
SHA1 1fcf840d836fcd6b982cca38dc6c0ecb21e29098
SHA512 f53efe480072a526f56570545faa669f3bd5464e7d7b795ea36bda8c53b286bcb92fa801386f24b22e281ef02aa8c0ff5465c572e15070f24b7d4cce42bd379d
SSDEEP 192:FONs6v+YLTQmiUyHqKh+CG6Om9opwSJrHcCHpbq5U6:FONs6vzZ9Kh+CXOmep3Jr1pGU6
TLSH
T131121C36B9785C6B5EE36991F48735139FA85177EA8A3F80D5DC3E0C02DF65C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dcb74912a60e2cb3ac1e4fd3acd32b5d99b98b2d021418564f3654707b01d1d0
MD5 aacd47f96c3fe0be24866bfdacdc835b
SHA1 33bf35190d0285b51f146ae1d43fb399479d1e66
SHA512 b0fc68a3b611807bcc2e604cf047f50cbfed82551a2d96d2f468f7579f357f266633973963d812d3c3fd8a6d36aa6a238683eb8a6f3e72ddddedec232de5a0d8
SSDEEP 384:vZcIhsNB7sAzixbue+CXOmep3JrIpGOObjI9G6w7iI:nhvMSpvO9p3hIpG29M7
TLSH
T100928D36A9384C769AB39952F48B39139EF89077E7C82B84E1EDAF0D06DB5AC1306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 530b346c4af4826052cfbae401f20e99d2e1269e19ce98a9d7cd1b72bd1cb920
MD5 67174b336f7bc72e4a4a8a300a86886e
SHA1 85f395506d88445cbef9c3f7f712a070902662a1
SHA512 b76ca5958c3272a458ed343df1e9fe86edba8f853fdbb13ecd24f5995c7dfa4d017aca25a3b39eb655a805337da78569dbc3247f1fa2740ea4b54bd9f07fc692
SSDEEP 384:8ZcI7GsNBCsAzitbue+CXOmep3JrIpGOObjI9G6w7iI:qCCMOpvO9p3hIpG29M7
TLSH
T1CD928D76A9384C769AB39952F48739139FF89077E7C82F84E1ECAF0D06DB5AC1306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17e393ae-e2fd-4ce0-a1c6-50a79e18ee6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\17e393ae-e2fd-4ce0-a1c6-50a79e18ee6d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc95413c6dec3e1b2f31108e755992c1b3a3d247424207334145f97024227177
MD5 cc26473936f07a19a1ece788e8ed67a7
SHA1 dd962597ff4416074411cc784d4a07b827d7df39
SHA512 74bf698a45d5f1b9caf9bb396ee946443869d5db610ae31594baf34b5f3d013a58509b3b3a4738a6650340032b7ec1024e948aa2e6d508b2dee8145f25ea55de
TLSH
T1A5412659B6F91148B3B76E5AABF7A86D487EBD372F06949E00110D4E0622B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 0bf8507722b905159eb1bb92dcfc118e23efe1e60cca0244f6c4e4b060c65559
MD5 0cb700a5db8e24e06b85ac1e855459a1
SHA1 403b346b61b757f58e38342c335de772997cb1da
SHA512 ed4690f9acf32fdf15f9954588fc515b7d6e9e252484546e8cf09652f84414d37ae21d122e8e66df5b2b19d2cd76a2ed56c0dee43f13ebdc7c9b9ffa4be062d5
TLSH
T1D051FC58A6E91148B3B77F569FFAB86E487FB8332B16919D10110E4E0B12B41D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 274B
SHA256 7705adb946dc2b5443745fdee9d93dd807e2302dd333395c821fe67ee36227c2
MD5 05b321c891d86430bf02cf86b6b2d9e6
SHA1 ec4597ec34dfb016b89700a615cdeb9428868af9
SHA512 0cf6de58b30ec37cf3c5bab238fd1e73bb0cfcaf1b60f810995394820b993d6845833b29003dc9b1a5b65371885f43ebd1699b638f6607ea115ad58d0dbe4d84
TLSH
T126D0674B1369E3F1A33C9AF4B5B99CF56AF1886CC66701B069ED1CC40D60907209B556
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 aa83e18a4b1edc91bed05bd7ba10ec4e358b67dcdd5c49be84db3048dee3e661
MD5 6401added8ceb02e37ae296b71163bf3
SHA1 3b5179b156dff033c707ef2790b9bd785b1ca116
SHA512 7342e1f5e2b903e7bc795a6edf181d315ec3d9a5b789496cd0e1dbb388da7c271798c7cfaf7073bee7ca97222595b834af13e7583ba7bce096d728349d1f04be
TLSH
T12A5135411A8B6F77C07842767F39A756FB603E23DB14811D6284115F7CE19009B7AF6B
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 11bd246bc2151d060defe228d44962cd00b38155c270da16d4c508664de48910
MD5 704c6ba7c5399eab88701206b874c2ca
SHA1 baf686e449f7d97c40009f9a6c1ef91aa93ddf9f
SHA512 19aa4c21bbe374c6f8a3fa216b1034ffe26ddd309f14eabb79e9e418157d7e3c56c2faa0559904098426938a9adcf9e720f0335cdab3964b525fc53d1bd4e67e
TLSH
T1C541044116CB6F67D07842766E39D76AFB203E23C714C11E6284155F7CE2900973AF6A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5452-753-0x00007FFC84510000-0x00007FFC84520000-memory.dmp

Download

memory/5452-749-0x00007FFC86870000-0x00007FFC86880000-memory.dmp

Download

memory/5452-750-0x00007FFC86870000-0x00007FFC86880000-memory.dmp

Download

memory/5452-751-0x00007FFC86870000-0x00007FFC86880000-memory.dmp

Download

memory/5452-748-0x00007FFC86870000-0x00007FFC86880000-memory.dmp

Download

memory/5452-752-0x00007FFC86870000-0x00007FFC86880000-memory.dmp

Download

memory/5452-754-0x00007FFC84510000-0x00007FFC84520000-memory.dmp

Download