hxxps://mega[.]nz/file/8QAGXCbT#X3hjZO0S_XJaPzOvAJMJrxkCR3jaum6jG8GrEb-mO-U

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/8QAGXCbT#X3hjZO0S_XJaPzOvAJMJrxkCR3jaum6jG8GrEb-mO-U
Sample260802-strb1sbh99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4948	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301579632592150"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{3A5738F8-95AB-46B6-914E-1CE4E3D131AE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4944	3476	msedge.exe	86
PID 3476 wrote to memory of 4948	3476	msedge.exe	87
PID 3476 wrote to memory of 1736	3476	msedge.exe	88
PID 3476 wrote to memory of 1736	3476	msedge.exe	88
PID 3476 wrote to memory of 1736	3476	msedge.exe	88
PID 3476 wrote to memory of 2200	3476	msedge.exe	89
PID 3476 wrote to memory of 2200	3476	msedge.exe	89
PID 3476 wrote to memory of 4596	3476	msedge.exe	91
PID 3476 wrote to memory of 5080	3476	msedge.exe	90
PID 3476 wrote to memory of 4596	3476	msedge.exe	91
PID 3476 wrote to memory of 4596	3476	msedge.exe	91
PID 3476 wrote to memory of 5080	3476	msedge.exe	90
PID 3476 wrote to memory of 5080	3476	msedge.exe	90
PID 3476 wrote to memory of 4700	3476	msedge.exe	93
PID 3476 wrote to memory of 4700	3476	msedge.exe	93
PID 3476 wrote to memory of 4700	3476	msedge.exe	93
PID 3476 wrote to memory of 1580	3476	msedge.exe	94
PID 3476 wrote to memory of 1580	3476	msedge.exe	94
PID 3476 wrote to memory of 1580	3476	msedge.exe	94
PID 3476 wrote to memory of 1868	3476	msedge.exe	98
PID 3476 wrote to memory of 2384	3476	msedge.exe	99
PID 3476 wrote to memory of 1868	3476	msedge.exe	98
PID 3476 wrote to memory of 2384	3476	msedge.exe	99
PID 3476 wrote to memory of 4780	3476	msedge.exe	100
PID 3476 wrote to memory of 4780	3476	msedge.exe	100
PID 3476 wrote to memory of 3656	3476	msedge.exe	102
PID 3476 wrote to memory of 380	3476	msedge.exe	109
PID 3476 wrote to memory of 4820	3476	msedge.exe	110
PID 3476 wrote to memory of 800	3476	msedge.exe	111
PID 3476 wrote to memory of 4788	3476	msedge.exe	119
PID 3476 wrote to memory of 4788	3476	msedge.exe	119
PID 3476 wrote to memory of 2984	3476	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/8QAGXCbT#X3hjZO0S_XJaPzOvAJMJrxkCR3jaum6jG8GrEb-mO-U
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa0844c188,0x7ffa0844c194,0x7ffa0844c1a0
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,5590889923466083724,2687684292536033101,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4744766203133754597,1463588026057787443,262144 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,9131054467714622527,14190114904981246812,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17528232949317612378,3261933605612051461,2097152 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9584040284148718001,6586638799528685688,2097152 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,10534868451929392893,14162109741301717366,2097152 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,3459731478089889750,10108842236799307218,2097152 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2892921787761437171,946184253832632476,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,13462242396763049405,18044993561407317841,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,17556846771009700939,7184119537193683788,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,12636827826505729347,4378810777078126149,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,12636827826505729347,4378810777078126149,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,12877751565550609454,9260929944616092315,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,10266871838410717724,3124737132287939942,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,7152790935818967598,16900211669240597239,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,9843810820687855551,14997370380272958847,524288 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,562659372995761069,2139920873741622992,262144 --field-trial-handle=2352,i,7463368205553038611,3509561462769201202,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 88b16d3840dc1dc65205285943eab8668887984c4333d1f2b353b948b778ff2c
MD5 42c96a13171d9e6ad6fe7993cbd5bb44
SHA1 cb6a4734a53456b81ac15fea372389c35b8569ad
SHA512 c611a3b3cf2043d2c5ff63619a7e27ff0ef29a0d5d7430320aa5964efbdcdffe8246ee821e2b68aabfd3578561207a1f6e8e32a92f2317dbd2c0c4863d10aed3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e2d6382351227b9a43b029e7b23ea2c1c1fb5706ec1e1149206634df664e4cc
MD5 797a833eb5b45c275f3c2d2a839b8921
SHA1 db921484dd86d10ea5104d8f680a679c1f6755e2
SHA512 bb982f70f3c653e0261cc960f489b81e33645c9114e8204477ca2664972948b9157396ed7fe6de69f21321f39e7f1d4d077af9bb7a51200da6b9a578cd451551
TLSH
T1B6613E7DC6924491F3B05239E0DF06B279360EC9FD275E7711E0EA7436D7B62C052889
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d0c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d0c8.TMP
Size 3KB
SHA256 1283dafbd22e4d8fddf63b010b5b936cdcba0b5bc112610b55f134ac972f1c92
MD5 6b205021c8e6cef7deb8c45541d157a4
SHA1 3922ecbf71bb85dffbf5842429b44dbeebffbc42
SHA512 f03ae7c5b4810db029b68145de17c85c238e4ff3d7d0765c21b706ad86529b1095e658b96d4cd3f81c16df8220f7468ffb2ce7a9af3e6729ff02407783814e6f
TLSH
T1A9614C7DC65244E1F3B05238E4DF067279360EC9FC276E7A11E0EA7436E7B62C05288A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 819bfdd8add4946c8cb1b5c7d957867c9491f567e6d19c888bc20c592a3ccc34
MD5 1ba621b831ba2a0a156fedd6319b15d3
SHA1 a95510ada0daf48f93281def4f0bf8a7d4d07e39
SHA512 8cf9f2749bf025c8cc922fbb29114569f6fc629779214e4698f8640913a2d769194bca50a3c63397df1a0d30669b492016c9483a52800136193fe0edb1354651
TLSH
T197319EF783B186AEDE1156F09A04AE2BCE5C0516439C3D6986D4BF1793F3471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d1a614864a82d1dd6d457051e526e52640a22b076dc6c312c2c73ac987638b60
MD5 c7ea44f7f42578f8a57c7dc32bfebc87
SHA1 147f8d896eb56b3fe7fa5b6fd40a902067e8437e
SHA512 320ec795ec7bd4e917b7099e25a7eda81154cd0007614a37d45894956baa9311677b7c531d65c73d018fdde57386d472486e6a2ae811c053b392b90135ff6cb3
SSDEEP 192:sxZeRXyM/jK1Ml8MkM/fHsa4xuIdpL+HW6+WNQq6/Y9Ie3MTIgrJ:sxZeVMM/fHsa4RiHbg/h9
TLSH
T11F5209026A34A977CCDBD209BA55BF53D6F94473A6900D54AAFCD91C04E6BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0729f77a04174de36ff01b9bb318937372263a99186cafacc78fd5b5f3838d79
MD5 decff5d2f37caad05d211dd5afa0f3c3
SHA1 95d3e5454c9e21873d93b171967ea6a6d3f30d29
SHA512 5c8faf4cf17e54333f99e0a5cacdcd9a6c1221e67a77199dd937701239e8f374866317058b51b1cc7473b674452ab18ed2de8698ee10411f15f273840608b339
SSDEEP 192:sxZeRXyM/jK1Ml8UQkkM/fHsaUxuIdpp+HW6+WNQq6/Y9IHm2RTIg59J:sxZeVq/M/fHsaURcHbg/vdx
TLSH
T1E6621B026A346977CCDBD209B945BF53D2F94473A6500D54AAFCDA1C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e65fd9a5954ebae650682f28394394cc0797bfb585b4074dd3daebaf24b182d6
MD5 1ffcd971e7612c737d75c1e049dedfa8
SHA1 b23bae6aebd65137a1ce6dee44bccd65ce5f471c
SHA512 5208b07bdc11750878c4bb0e892464e287bfcac5bf36a42494425935b5b1d780f908a883b79df69221a677cd0c1d3f272e863d57da9b96c8e1da819ef657c64a
SSDEEP 768:yncv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNZroVg65p:yncv21wWvu+Z+u1jaeFLeRNSVJp
TLSH
T1A4D20A2B280CCB7E0F845E9CED2AAF866ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 374c696327429d8af439aff4f1cbe2350918243800473c3861e3e4649186689c
MD5 0c5aa424e57fbd3eb75ac803f4018f38
SHA1 76a6bdcf8725169a132d78b859e53422e6a61301
SHA512 e3daf2aac4b05bf640eff03457a70b65f66269b7943354177befb2e626ee8cbe0be043f65cf2c3c6dbba800597ab0cc5b2c869c3da6b4745d7e265e26a38a175
TLSH
T19EA0026889899061CC420A71106B5D9037718879554717118890919D9F91158614352D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d32a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d32a.TMP
Size 48B
SHA256 0917294732dc1cf30c89b0579ff88fa6f65cfb74878ebe4153a2c1acae0a4e64
MD5 ca1357bff38c95ae5790503968e6c6ab
SHA1 b10f8804558f326f69f6c730ae7ef7875189af8e
SHA512 6e609b33351bf2864a263c0581eba9d6d57e1da63db379fdb4990e5a73c4fe1cec21b84d8d5a0948823e2378aca063447346aa97b744eb2b5dfc33457d7aaba5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4e8b78443b1e58dafaa37ae7b52670857d3d9d53704875af1310475a081947a3
MD5 d0a2a80476a5a3f3632e61c5ac5fe956
SHA1 830d8c92469474a84ef7d84f7fa28f8e1d03b584
SHA512 4a3f0278f6f2e304a15d83e07238b3497de55a514fb6bbd588742e958e632ff29b884b993a3d175f64212fce42c91a5dc844c789ab73f80d043a8d0a104b65bd
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDauoKf6yauIKXKtjyhljxRxz:mT3/X+jyhljxRl
TLSH
T1A7911E06303B02E3787E6848A39785364E4139A77819F46F7BB850A14B6BE111EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c032b38-78b3-4e36-96d0-1c0860fddbc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8c032b38-78b3-4e36-96d0-1c0860fddbc5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 01463714705d831d38def2804ba8bda22453d344c9c008915a92d329b69cfaea
MD5 056d1ecd88375cdb9c7635911d5e5a15
SHA1 5ab57f69dddec46aead351bc90316cf41cbddc95
SHA512 e179d34c48209349537b2910d4f3e02d65ec3063b6601060efc0dd1d729b157d6eeca4e16708328ba4ccf1e55ab6746a00e1960887f188f8e082c3ccefd71993
SSDEEP 384:AZcIhsNRfO9oziUVzXOe+COdPeTJrQ1HuSnTKwBODNZOCeW2:+hyOmLBXJ2cThQ1HuSnewBKZOjW2
TLSH
T102928C316C382C6B5ED6B145F84735178EF8D163FAD53BA4A5EDAF1C00DA6A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e1fa4146e46ebf0de42b46cd3deca5285eb67daf23c96f22bbc48bc019dc9fb8
MD5 457d470efa2eb8fdae21210be7750ce0
SHA1 8ceb2f0c4f081589b06ff7a50c58e361e3459913
SHA512 c57d6237536edc6436c3620718fd961ccfe0f13c07981092bce11b4b5c188d18e8edbb5c51a4eb17ab313ef2a0b31b47b51de3ecc020987e713d4e0763538911
SSDEEP 768:UFQ2ewgIOmLBWJ2cThQS7uSnewBKZOjW2:t2LO6BLS6SnevZgF
TLSH
T1D8D229F258E7587ADE9E5743E73E2D128EBCC063B9952650B3989A0CCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5d17330541c7b9f69632fb1acbd8cf3556221908f8fd0929960dcd6976d2a1d
MD5 0ae545060ace39e050493be849a1e54c
SHA1 7a2c0c192b56f88518b4b9fa7f8ad038bda7cc74
SHA512 c5f4657879862ed010cf30466fd4710f6326198f4ba20769262f7986acf17d8150111dc440853ecd675b8b6d98fffdfddd3993a6c33a07f7e71f63abb8be7859
SSDEEP 192:JONVm6v+YLNQmiUy0o2Zh+CGU+Fdes9ovtusiEU6:JONI6vz/bZh+COdPeFLU6
TLSH
T13F02F9356C382C6B9FF26E46F4873A275FA82177E9922F84D9E81F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 982b41789de7f0bce122470edf47372dae828d88c23d786e82a5fcc9a206df86
MD5 50249bc8471f7d80deae3182345da01b
SHA1 e9edbbde79817332751aed8ba64cbbc7154d9cd1
SHA512 934e2da6166e9379120265e6cf9681fcb32d14839d116ed9afc481fb1ea8e1d2c32705070f679e9823269877b63cabfe2667666a4a03f077631873f1d219e1a0
SSDEEP 384:qZcIhsNRiO9oziUVzXOe+COdPeTJrQ1HuSnTKwBODNZOCeW2:Ih5OmLBXJ2cThQ1HuSnewBKZOjW2
TLSH
T1C6928C316C382C6B5ED6B145F84735178EF8D163FAD53BA4A5EDAF1C00DA6A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 985708a2ceb3439aac00c986a89f59b850eda429dd902e4d4a8c90f1962d623e
MD5 5a42c213e4413ae8ac0618548fedd84d
SHA1 fd0184552ae24e1714a11e111161e2182ca3bfd7
SHA512 99f9f56dbe6886fad0c701a0f3569e915e7bce495f4b17c308a21568edb920b704841db8fb6f1851741ffbc6a21209131486d2bf0786f3701538ec4c7a721485
SSDEEP 192:mON06v+YL3QmiUy02Z2qh+CGU+Fdes9oveDSJrQ0CHxqJSU6:mON06vzlQIqh+COdPeTJrQtuSU6
TLSH
T121123B366C786C6B5ED2A941F48335179FE89127EE8A3F80D5EC6F1C01DF6AC1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64340151-cfda-4998-a2ac-e67cabc6269b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\64340151-cfda-4998-a2ac-e67cabc6269b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 128229f009e64852eb6aee7482051907b8fa4de15b68351bb92c8b54c51f7616
MD5 7540d49930ab822112d6b4abd7ab71fc
SHA1 3eec5840f8da30192c0f8f2d65adf7be03d2bcc6
SHA512 f286c852dedf40677cb50815fb4d1ef0c47144eb0a57faed183ad2681e1e17849dcef1fa63e2139b49ed15b4cac211d0a0f13444d91ab7d2e1804c916581bbc8
TLSH
T167412858B7F91148B7B76F5AABF6A86E447B7C772E06848E10110D4F0A32B40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download