hxxps://mega[.]nz/file/CggwlbzK#TqgvUGijzlEyueRjaas9RqMk9kxO7sK4cc--JWyq5-M

Analysis

user interaction
yes
max time kernel
40s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/CggwlbzK#TqgvUGijzlEyueRjaas9RqMk9kxO7sK4cc--JWyq5-M
Sample260730-vfpblssfkc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3656	msedge.exe
4648	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299041815080922"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{BAA8845E-A1F0-4714-846B-119ACE73B554}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1132	2452	msedge.exe	84
PID 2452 wrote to memory of 3656	2452	msedge.exe	86
PID 2452 wrote to memory of 4740	2452	msedge.exe	87
PID 2452 wrote to memory of 4740	2452	msedge.exe	87
PID 2452 wrote to memory of 4740	2452	msedge.exe	87
PID 2452 wrote to memory of 4644	2452	msedge.exe	88
PID 2452 wrote to memory of 4644	2452	msedge.exe	88
PID 2452 wrote to memory of 2824	2452	msedge.exe	89
PID 2452 wrote to memory of 2824	2452	msedge.exe	89
PID 2452 wrote to memory of 1560	2452	msedge.exe	90
PID 2452 wrote to memory of 2824	2452	msedge.exe	89
PID 2452 wrote to memory of 1560	2452	msedge.exe	90
PID 2452 wrote to memory of 1560	2452	msedge.exe	90
PID 2452 wrote to memory of 4356	2452	msedge.exe	91
PID 2452 wrote to memory of 1848	2452	msedge.exe	92
PID 2452 wrote to memory of 4356	2452	msedge.exe	91
PID 2452 wrote to memory of 4356	2452	msedge.exe	91
PID 2452 wrote to memory of 1848	2452	msedge.exe	92
PID 2452 wrote to memory of 1848	2452	msedge.exe	92
PID 2452 wrote to memory of 3848	2452	msedge.exe	97
PID 2452 wrote to memory of 3848	2452	msedge.exe	97
PID 2452 wrote to memory of 3216	2452	msedge.exe	98
PID 2452 wrote to memory of 1856	2452	msedge.exe	99
PID 2452 wrote to memory of 3216	2452	msedge.exe	98
PID 2452 wrote to memory of 1856	2452	msedge.exe	99
PID 2452 wrote to memory of 2756	2452	msedge.exe	101
PID 2452 wrote to memory of 1184	2452	msedge.exe	102
PID 2452 wrote to memory of 1184	2452	msedge.exe	102
PID 2452 wrote to memory of 4728	2452	msedge.exe	103
PID 2452 wrote to memory of 4728	2452	msedge.exe	103
PID 2452 wrote to memory of 4728	2452	msedge.exe	103
PID 2452 wrote to memory of 1112	2452	msedge.exe	104
PID 2452 wrote to memory of 2404	2452	msedge.exe	105
PID 2452 wrote to memory of 2748	2452	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/CggwlbzK#TqgvUGijzlEyueRjaas9RqMk9kxO7sK4cc--JWyq5-M
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcfafec188,0x7ffcfafec194,0x7ffcfafec1a0
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,12838374956111182765,16090739347391395098,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,15217202630722819131,5868889439949910725,262144 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,9945561630173824669,5397011758939949975,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,972374519693868684,12793598375929139711,2097152 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2532004438404534124,3313965773577810870,2097152 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,429682532395464054,12445007953079134160,2097152 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,10440349505705589170,1943315063875954047,2097152 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,10420025899473703793,2153649290317360480,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,1598151511335072108,16916729862580887727,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,732881768464553453,3968554363992786762,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6917131095986908469,1841457551838602361,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6917131095986908469,1841457551838602361,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,7253106860177077016,130479672181159820,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6288,i,7180578276348257368,7342203407744755097,2097152 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,6442881937519406409,5361183155186923051,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,15872590608855158847,16902237149351533513,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,17509265730046184884,8752990806774787286,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4048,i,4239992690674304874,18056658019775686835,2097152 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,272543517579059005,2410603326352220256,524288 --field-trial-handle=2420,i,8594553410214829295,11017118220664841184,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcf8f7c728,0x7ffcf8f7c734,0x7ffcf8f7c740
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,17835964397452437502,13484915334428389537,262144 --field-trial-handle=2020,i,4423268607966902477,9130594645563475478,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,4691435871346495906,6034377876929055014,524288 --field-trial-handle=2020,i,4423268607966902477,9130594645563475478,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,15958028951944499155,8528438505308455931,524288 --field-trial-handle=2020,i,4423268607966902477,9130594645563475478,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3277c3379bdb6b118b6fff464047b56ab1c3419def1055049b861024c8934cd0
MD5 827f960fedcc8eea9844d98d06321817
SHA1 2244e368d450db29183c213ec78c0fbb9c39ade0
SHA512 7c1a3cf72636189c671105fa1462c13dac35a6dd2d6a63b83d0b2699c7afd2560ba52aedb7bfe4d8eb24e533ea99f8daba12d2bd6ca0b23355f87355197a6eeb
SSDEEP 3072:pGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Im7Rkm1tYpBeh2BAoK
TLSH
T179C3123B5D65E8779979BB0EB08E0B1F1EF149A2D920DE92C8D85B0437F97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82018929d342f1e4ee59f7d07b64468ab1bc6afac1ac5ff4d4215567390193e9
MD5 572af0ee4d6008980580cf2b7d63e3af
SHA1 1bd0cb7fa70e5a5ff9fb8ad1aa5659f80fde4e50
SHA512 3aa93dfea8531495d09c316fb4b8206a025a81e1a74755dd05c633fdaecaa7e65bf725867ac0a60fc0dcf71f10d9469089bff3ae36061008ae5480d22247d5ec
TLSH
T17E714E76318104A1F7221532F3C26209317B8EEAF5F3AFB0AD9827B5A73CB51D21A148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ddd8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ddd8.TMP
Size 3KB
SHA256 be3a676ac2d4e4fef5e0cbde6562b983c17851743b83a13b56722828098c90a7
MD5 4e2511ba4215f915f34cc393eb639adf
SHA1 d755329dd72c33f33fe612dfdac20cc4d9df99ec
SHA512 2444c2a401737b825705355835c75d0c5e3c61dbb38152061152eacc359f3c25d0d42b9e44266ea2e3fcd40e876ef39b9e9298dcce1202dc8fd6bbe3d14b9294
TLSH
T1FD713076314104B1F7221532F3C26208317B8EEAF6F3AFB0AD5827B5A73CB15D65A158
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\00\00000000
Size 20.5MB
SHA256 1758c7fe7830d35977a864ad4e1e1098a7c67abc5484e6c64b0faef03d964b19
MD5 e2e9d51f354ce43cf8e328b5f90031ab
SHA1 911b5d29e659609ba5612fe8deb1eff240c67816
SHA512 5868f987c8507dd37de00e5cb46135871800906bfd361a42825688e4121d2bc516ec8974f6ad80f7ec88d9e3d6c189fe5f60527bc08f837ef9367df573f146f7
SSDEEP 393216:nioJl0HJIMCMQLOBnWY3iNrDByFhdcelkGxImkfzNqffwJ6avFJL+ETZRUOe:nhv2J57QLOLSJBypcenehz+gZvv+ENRG
TLSH
T1B62733AD7C92667518623409A21FE700D44793361F4FCD6AFBB48384DF12CCF9979AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log
Size 8KB
SHA256 4406aaec7b4a3eefb6d2133b600adff3a0003e32d8e67764cd31b1ea498af161
MD5 77b802ae903dfebd0d8bf2c65c5e0e82
SHA1 4cf68e068edb2fa8b2d185727123942188c2c55b
SHA512 02620758979da050e4cf26a5aa64d09a75df36de3d2c343dd73a0f7dc0379a211688f1aa9f36aa4b729ea16eaedf150ada3b5b961dc2cd2143128b73a9209c59
SSDEEP 192:OTNFSA1q4W1wGk1B4hq1AnHK1M3hHc1EHuHYRf1lHwHYRd1MHYRD:si2pFhifbtR5
TLSH
T1A4029BEAB6E81D27E07446B539230BD50332EDD0FC5CA459B4C0B3EC95BCA42DBA15B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 d0e2bb480817ecae38aecefd6ee8c04d8df60ddffceec47a9cf7d3a2ed727aae
MD5 60353c886e2760c9a26ed32399005dba
SHA1 d593458322ba231e285b0a369dfb14ffe63ba988
SHA512 d23fca8385421712d8575ea25654292dd8ee9c7dbb2fa6a0e4e39418369e9b60e224395b55912270d05931e435fe600cbb28062988b3f1d1b344d25275dd4073
TLSH
T105E02B5880CDC21FA10D2093C3687B8893A3354FD7CD3C656B03C560B881444E2DA590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 44abcfaab733d4bc6166fdf404fbbb0fd47a700cc2f92a478984089fdf007cea
MD5 955e271cc2c0a9d164880f52dae0802d
SHA1 69f56ae5a49538ca9a664c8362ae08ce094322b8
SHA512 68da7943abce4857da34e8501b728b47a79196f61b78c1df2e76232aaaf91ce4926397352046c639780b7e56384bfeaff871b1809e0b6c8996b248a534bc807d
TLSH
T164E09B5884CDC21FA21E109792687BD897A3354FD7CD7D456B03C464B442454EAEA190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 335B
SHA256 ad8e83881e24b285d8c565f5c1339ebc6550a4a836aeaf60231b334140257b66
MD5 518b61bae6a3c5e1c56af4f627b386d1
SHA1 8c08dd90e579eb58dd99d280f2510a2f6805d2a4
SHA512 8dd869f532acf3fa6eb6ea853f5e61a99fabe7b9dcef90351ba68267f3ad9396463404ec8849d55c62aaf3a59f0a2c6695bf74790683f932df9f14b98f60b3b1
TLSH
T11CE02014C8C9C21F525850E39624FBCDD6E3254FD7C97D496F82D8247842044E16E291
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ef69bba4f067da189b6eb216bb6a0474a4b9056f39b67a18f9820c8379851efe
MD5 2836128c840e693c2cb48c68eda46d20
SHA1 9d2047bdc0cec27839f828d0392fdb6c3b5e6b7f
SHA512 10e508cb5ef2175e838526b137ebf48e10f9d171a31ccb298e4124ed33298524187d23902d1c9bbeeafec5aec93ee61a533def952e04bfa7debae8dfd8259656
TLSH
T14131BDF7837185AEDF1196F09A00AE2BCF5C011643AC38698AE4BF5793B3471E102A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bfe6c002-3097-45b7-8339-d44fe0534fc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bfe6c002-3097-45b7-8339-d44fe0534fc0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a33356e9dc3ae9f04779fc37302b54da8ae06b698ec436146ae3357da2bc7da
MD5 2a6424cb9cd0f9ba803b971db8eb4aad
SHA1 bd00c2986ad86b09bc694ab0554be86b597d7980
SHA512 b97ee30dc9f420dc3f7e67a66b712cfbcc7d56a333f8aa4d152443aacb58e261a07095b97ef8e1f24620d6b1d01febb3ab025311c03075923942b4825a588dfc
SSDEEP 192:sxZPRJyM/jK1Ml8Mje/fJsFN8lQiIdpLTHW6+WNQFr/YIxNy++DIgrJ:sxZPXbe/fJsFNwQLnHbi/I+y9
TLSH
T12A52D716AA34597BCCCAD209FA45BB53E6F94572E2904D4499FCCA1C04E6BEC230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 be855dfe170ee098293a14df0331bc58a2ea7ffba69493c21385c4ab6e7354c6
MD5 81b6244b332236d72155a12fb546c437
SHA1 732d5ee781bc0470408557db7c619d4eabf84641
SHA512 9cdbb8929c114132d3527bb632febacad61b32a646419d28dddcbff49caef8a7f07d28240997c96e25ea99092b88651742329d3b4e884e701e0ee00c0d9ef863
SSDEEP 192:sxZPRJyM/jK1Ml8MRe/fJsONJlQi3dpmPTHW6+WNQW6S1x/YIIjy++DIg5EJ:sxZPXJe/fJsONTQKkHbga/v+yi
TLSH
T1F852D617AA245977CCDAD209B905BB53E6F95572E6900D54AAFCCA0C04F6BEC2307C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 502787abf4a0c3664bf450db39735df418dd87beaa4bc5f1e3ecb26330a230b7
MD5 6b903d4dbe3fdd54f4fd8762cc778671
SHA1 2d73f402763a6b9b8a0e9a86e0b2c25e964a1a20
SHA512 4c858a55bcd6602b6cd9bf0b3557a4619afa947a0c66d118f6a9d2c844259ad3589e68737b548af02e3e6f210dc7b8ac9b190ceecb2777f13c1ad0e6dca5e07c
SSDEEP 192:sxZPRJyM/jK1Ml8M3e/fJsONJlQimdpmPTHW6+WNQW6XYIHjy++DIg5uJ:sxZPXfe/fJsONTQVkHbgXk+y4
TLSH
T18F52D7166A245977CCDAD209F944BB53E6F95572E2904D58AAFCCA0C04F6BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ea66df2052ddcd19dbc8f0f9d20e832d4cc114a7ec58f8b3f4b7626e1daf77
MD5 062ef5aff3a9202b09120c48f741d10f
SHA1 830d71c31a7ea8569548d593717e5b808104b53c
SHA512 2262b923f06cdbb6799367caab74f21e71f2564497665fd419d110334add2a829abcecb37e74ba726eb89788f537faf5981121b97f69ade35b15d25674a0308c
SSDEEP 768:33sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9sroJ1XN:33sqxXlWvJD6Tu1ja54LAs93J1d
TLSH
T105D21C3B694CC77D4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 2KB
SHA256 7325956fcbab9bc6173c689eb7f13a47dc41daba55d1be78060389a3285aaea9
MD5 b91ede5c2391b635acc2ad8c40075717
SHA1 31bb2fc0f106bc86c1a13abfe56ddd93a9032c4c
SHA512 98bd79869bd26d7dbe5ed160258f760d6ec9d0c060a40e24e2a3544634875aec85a1e39ecbc966ff73a4870273556dbdae3a1836fb5edc83a9264b50b5ffff44
TLSH
T1C64195CD4D45966FD9A884B3047224E033B09CDC2B159B176C7C127ABD27369295B3A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595df5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe595df5.TMP
Size 2KB
SHA256 982e56f9822edad1c45229032a9264838f53512b175ca90b05f16cddcd73e317
MD5 cdfc74df5cdb840a49f1655b70fb8b42
SHA1 cbe03c8bef0c1ad0a8c62c852ac10f10a057a9bc
SHA512 a50a29d92e2b3b9990d3010ec7aa790e4c19aa213d084869e0520ab705f44eee4ff7171ddd32c355b1df1e2a46ab5a9b8791fc33c641a72f21d8a57852f5de4a
TLSH
T11041C98A4E82862FDCA44073099264B43339D84057517F47B8FC963A68E63BD2D5E1D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fca0caa4f8eed30dea564d6a5e4d018baa13bb133a5431190b01fa454ab15f3e
MD5 d90f7cdde4cd61ae1ada8b60d675e8ef
SHA1 b3ee6ba44fb0f28eb47ad11bdb609b6b794c79c7
SHA512 1a425a421a3091fe73fdf2a4c8ffad0c8eed6c8cbcf945a1d1a806578d376b0cb2c1919f6bab4c9aac9524f1d7ce44b6bba8a9ac1429753a43c49e57fd2316e8
TLSH
T114A002210E548472C200477590734394221198110A4DA61190AD01588D741895513A7C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dde8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dde8.TMP
Size 48B
SHA256 5e2a34501755b3aadab9f9a87bad7d6034fbdcaa31caa90206a463463ac46d4c
MD5 7b8b81084420347769d353997e13178e
SHA1 1cbd07fb8696960b605eb302574b05246d0c20a5
SHA512 50ea7792dded7a7a5053c3afeb8ce1c69f58a672d3c11215b735741f49c180b3ae5f1aebb738a625e583e279859c6dca6cec925490d04c7bed173fb5adc5ae0c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c010b4aae54f583a1256b57d8a5dceef743a792bd4df62a205bf4238a6614070
MD5 bd7ff941f5439e75f1c2101915b40380
SHA1 ca0ed9498d81f9e79275a5ab8893a06fbe1bd587
SHA512 2ddd515274b9e2bfe6b5e54272df22edc17ff16aa885df7f217c35b7a1200e6c6acdcae68963d3271be00c0eaa35028039483989db0a9c319551fb2d78ebe5e2
SSDEEP 96:KYbaKYIKS2IKrqmqcAKdqOjaKwIaia4K7is:ExHDvEx/v
TLSH
T1CFE138B2323B421238BE2919E36EC5375E4132A33818A5BF7B7850650E67E515DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c27510589610a4a33bb7d281ec6184d33d575eef8d9f5e68d407593c0503810b
MD5 d676aeacadee76416b4401428b06f9a8
SHA1 6ebc081210a64300b52aac049f3957c7a0d6843c
SHA512 3a0261f0c92ef1a94138c31b13b752e9dff7cc137fe87ec1c661fe7c980035dd7d0a6e86cc870b2d62e705d62d23d66d5e7be415587e9b25106527937783af4d
SSDEEP 192:u2sx3sNlUYTLVO1x/kRbZqQmiU148ONJ8BVRN7+Fd10H+CvK/gpUQ2+SRdqm58xc:K3sNlUYTW8bclONJ2VRNQdA+CvK/i2Nt
TLSH
T1404219326C346C7B4EE36545B04B36135FA4516BEAC92F90D2ED8B0D01DB6AC131BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a0bdb486e2e33523a6dbf946ada429b4345ab44d3ab8f2b01f18681943a7cc6
MD5 261ac056dffb833724cbacb2dcbc3aa7
SHA1 6194616eacdefe34cf8d057786713de9b1c45d46
SHA512 a88db5f3eba1a4b07fc4639a26c8c59021b90598e75f4dccb8e0484612bd46654ad3b2ba32ef49258485196d7f60b1c37624dac5e90c7e5388dd13901f2934b2
SSDEEP 192:tONL6JkRtQmiUyh83W+RN7+Fd10H+CvK/gsh3/TR4U6:tONL6UrR3W+RNQdA+CvK/lSU6
TLSH
T1A702B8356C382C7B9EF26D0AB48B36175FA4217BBA952B84D6E81F0C01D765C1347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 286a4fd77c494e39abb2a6603b840a0ba1a48e015b138bc71bab615a5ece9b12
MD5 753c4eb0b892c911e10e2ffc4d0b98c0
SHA1 6abe59a5353a70bf288cd13b93b5741e39f21909
SHA512 4dfae6c79329bdd68903b15df70b9e56296178ef5eefbd46a86b2e81b0d2247bdf501b581894c9d7f03fba94c328abff50caf544aa55294bd392cdaa95ae97c2
SSDEEP 192:urLsNlUBQVO1x/kRbZfQmiU1M8ONn4VRN7+Fd10H+CvK/gpUQ2+SRdqm58xU8:ssNlUBn8bzZON4VRNQdA+CvK/i2Nl8xN
TLSH
T1953209326C386C7B4EE26545F04B36135FA4516BEAC92F94D2ED9B0C01DF6AC131BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c56824f3bc77afcfc4533c948a8c582e76c46b487875a4fd9591fed8ea8fc8b2
MD5 e20357c58d840432c96af691a9e050fb
SHA1 99136aab9665fed68cc859208f7a6a5cc0073001
SHA512 b8244edee7197eab8ee8a1ee9b2b9bdd23d2fb5f68568281139f69d907af5f3442df1429e2a60ec041060162b72c0cbc93cf4d3060d8b8264a25bda9356023f7
SSDEEP 192:urLsNlUYQVO1x/kRbZfQmiU1K8ONJ8BVRN7+Fd10H+CvK/gpUQ2+SRdqm58xU8:ssNlUYn8bz/ONJ2VRNQdA+CvK/i2Nl8D
TLSH
T1A7320A326C346C7B4EE26545F04B36135FA4516BEAC92F94D2ED9B0C01DB6AC131BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c71637cfcd7fb4589fd84e315771bf89e0da8a41b33349fa78827df62dba9879
MD5 f7027995186f4dc94fe39abc13bc6fc8
SHA1 6eb39b015895e8cfb3237aea8556fdfd1b14c2e9
SHA512 2c23e90510569e14e33e551eb2cb4487ef9f00c6eafaa57fc9bcc532826c7165b6d73ba45116ac7e64c7a0b3266cc008941f3947ee43ab232dec5ad3e19da4d1
SSDEEP 192:uON/6JkRXQmiUyq83y+RN7+Fd10H+CvK/gpUQ2pVcdqm58xU6:uON/6U5A3y+RNQdA+CvK/i20l8xU6
TLSH
T18212FA366C386C7B5EE26845F48B35135FA45167EE897B90D1DC5F0C01EF6AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b540689-9ac7-4172-81bc-d99287db82e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6b540689-9ac7-4172-81bc-d99287db82e8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef2fe688477189c56697d334b1de24aba93478ca1d4136fd604606c1e8006fbb
MD5 c6117e16845a08cf2fef7046b4a2ea18
SHA1 4b929f502133b11d00dcbac26c15bee17e9c271e
SHA512 e2251eb1b18022d33f015d885412302f0aebfd762112e8fec3b9a05cdc9d37b9c875bb1f7f78ea84b3657202ca1d51953852439b704c0ecc137c3a713f18dde2
TLSH
T1EF412659A6E90108B3B77E5AAFF7A87D447BBD772F0BD4AD10010E4F0662A40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads