hxxps://mega[.]nz/file/Z2sGhDLI#6JMMG4yoYTKfenUTJgNM0DACapsWses3Zw7_AYj8o_A

Analysis

user interaction
yes
max time kernel
177s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/Z2sGhDLI#6JMMG4yoYTKfenUTJgNM0DACapsWses3Zw7_AYj8o_A
Sample260808-pg2ens1sat

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306651429467053"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{703B4A5B-9593-4405-8F23-DEE5D83DF242}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	TheChoicerVoicer_0-5-1 stable.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
3112	TheChoicerVoicer_0-5-1 stable.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3112	TheChoicerVoicer_0-5-1 stable.exe
3112	TheChoicerVoicer_0-5-1 stable.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 3536	868	msedge.exe	86
PID 868 wrote to memory of 552	868	msedge.exe	87
PID 868 wrote to memory of 3728	868	msedge.exe	88
PID 868 wrote to memory of 3728	868	msedge.exe	88
PID 868 wrote to memory of 3728	868	msedge.exe	88
PID 868 wrote to memory of 3868	868	msedge.exe	89
PID 868 wrote to memory of 3868	868	msedge.exe	89
PID 868 wrote to memory of 2504	868	msedge.exe	91
PID 868 wrote to memory of 2504	868	msedge.exe	91
PID 868 wrote to memory of 2504	868	msedge.exe	91
PID 868 wrote to memory of 3984	868	msedge.exe	92
PID 868 wrote to memory of 3984	868	msedge.exe	92
PID 868 wrote to memory of 3984	868	msedge.exe	92
PID 868 wrote to memory of 4112	868	msedge.exe	93
PID 868 wrote to memory of 1048	868	msedge.exe	94
PID 868 wrote to memory of 4112	868	msedge.exe	93
PID 868 wrote to memory of 4112	868	msedge.exe	93
PID 868 wrote to memory of 1048	868	msedge.exe	94
PID 868 wrote to memory of 1048	868	msedge.exe	94
PID 868 wrote to memory of 5016	868	msedge.exe	99
PID 868 wrote to memory of 1212	868	msedge.exe	98
PID 868 wrote to memory of 5016	868	msedge.exe	99
PID 868 wrote to memory of 1212	868	msedge.exe	98
PID 868 wrote to memory of 4736	868	msedge.exe	101
PID 868 wrote to memory of 4344	868	msedge.exe	110
PID 868 wrote to memory of 2628	868	msedge.exe	111
PID 868 wrote to memory of 3852	868	msedge.exe	112
PID 868 wrote to memory of 4064	868	msedge.exe	113
PID 868 wrote to memory of 4064	868	msedge.exe	113
PID 868 wrote to memory of 4064	868	msedge.exe	113
PID 868 wrote to memory of 2020	868	msedge.exe	114
PID 868 wrote to memory of 2020	868	msedge.exe	114
PID 868 wrote to memory of 2020	868	msedge.exe	114
PID 868 wrote to memory of 2248	868	msedge.exe	115
PID 868 wrote to memory of 2248	868	msedge.exe	115
PID 868 wrote to memory of 3944	868	msedge.exe	116
PID 868 wrote to memory of 3944	868	msedge.exe	116
PID 868 wrote to memory of 2140	868	msedge.exe	117
PID 868 wrote to memory of 2140	868	msedge.exe	117
PID 868 wrote to memory of 852	868	msedge.exe	119
PID 868 wrote to memory of 740	868	msedge.exe	120
PID 868 wrote to memory of 852	868	msedge.exe	119
PID 868 wrote to memory of 740	868	msedge.exe	120
PID 868 wrote to memory of 740	868	msedge.exe	120
PID 868 wrote to memory of 1440	868	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/Z2sGhDLI#6JMMG4yoYTKfenUTJgNM0DACapsWses3Zw7_AYj8o_A
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ff8d046c188,0x7ff8d046c194,0x7ff8d046c1a0
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,18360925612442475472,16881327303121668212,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,18032669299459287383,1338364340654622690,262144 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,16520993454920125858,5558141462523378415,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11647638848154513358,12089480743223058617,2097152 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13464571613021833843,12136754938944832963,2097152 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,10447588568245678511,2946523716580637554,2097152 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8903755930368170962,4327944970195737280,2097152 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7590602796497916807,796030081697338378,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,1710893081655388648,968697616422440207,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9444037393889561976,6205939391335493012,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9444037393889561976,6205939391335493012,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,16546725378052475160,9371905924037319883,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,3163931541982635512,13676270720583138539,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,4852139039171025998,8216337591968343480,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2116,i,16393980116963553424,10864980286648062188,2097152 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3572,i,17940887144884687441,12534355228995644745,2097152 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,6070848489522314570,7080543444760245689,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9829340815951540121,11678054844670266828,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,15567517763111746453,6656315635370611453,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,5624655387874911494,15755475174929186452,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6688,i,5085853333223688504,12109047014843127332,2097152 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,9862192265132616936,9583629048418412428,524288 --field-trial-handle=2264,i,16126264720334945856,5098633083396033805,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4776

C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable.exe
"C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3f19e501-0c39-4423-9c24-996d8d39a0f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f19e501-0c39-4423-9c24-996d8d39a0f9.tmp
Size 33KB
SHA256 b5654a529473805ee1e875c0b9a90ee6c5c2affb2a81dbffcfd19a69a7e719cc
MD5 b8d83353f6f46a31c6f66a0bde642466
SHA1 4e7a470f1687a408db5af6883004f0bf2c043c50
SHA512 310d89353627870929d4919fcf5c8d970d231f731d3faf6c033e674e893fdd99efc625d621bd06f8a4c850957cda29272c79d5d710a040b6f79c2f06f78be5b1
SSDEEP 768:5FIJYwgrGWH3A9X6SFvK+Y4MkEnewBKZOk0U:gJDvK+dNEnevZXR
TLSH
T1F6F29FE188D74CBAD49DA7C7977EAD0259BCD073B4885908B3E8A52CEC5B4BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fde5025ef66eed55fd88d8ade54159c6896f668960612cdc8ac646f38c6df2db
MD5 92fd10844698a944de0d2c25a0e93afa
SHA1 1449b369c4e6fcd8a01e721c49cb1ff8abbf0718
SHA512 6db7c50c102e0f642aa312115f988b94bf36359d77515a4972a61ddbac533d9fb04756ac734eb4054291d3cc6f89ad0157b4047c9a055152fdd82eff17da3b5d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74d155f2069139498c28efe13c794f3d78e24b4c653f282be4f035a2c6660c4d
MD5 d6ea3609b659a68ea1fa33a0fbe2779e
SHA1 538cb751822417cbaf2c1278716f5dd115db9edb
SHA512 542508fd7fca12af445e3e13b725ee5bcc599dd4d7f291617ed1f7515cecbc2bafaba623fefd83cb1694bc9fad6a447dae1102416d48b7bbd5c076c125b11830
TLSH
T1C2711B3A25030C95DF52053DC1D9C31176F1A2EAF1532F65D25085753B7EFB2961BE88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3beb74854b37686f39db7ce413470d3dba1947e51587d9845cf0e1934fe257ad
MD5 af76f4c60254438de3d69d7a88dce448
SHA1 5b75dfb4b6ee5e11c2354d3b98efc5f93a4de95f
SHA512 544a1280d7880ff24c336ace4af591a96603548522841591814bfdbfcab66251f2bf9a91bdb5d4cd9ba307b07f9122ee07fb60774d4c281401e99f215774b53e
TLSH
T14E710B3A25030C95EB62153DC1D9C31176F1A2EAF1532F65D2508575377DFB2A21BE84
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586f30.TMP
Size 3KB
SHA256 48c9752cbaa19f0c502aa0c454fe8249e97b8c6c6cc2bce51e2510ac078b53a8
MD5 fa49b4aef05040307b5552fa7472d09b
SHA1 47a2937ac5deecd4448facc9226d6dcf78929369
SHA512 b6cf0620ff3e05d8df742af289f6e9d35238fb8cb69738c9c2b2435e4cf1307d062a90eb3f875d28477a87be54e3c92b6e11f571e1b9139030512e75910da1fc
TLSH
T14B712B3A26030C95EB62053DC1D9C31136F1A2EAF0532F66D25085753B3DFB2A20BE84
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 e01e22decbd1aa16e05fa13ffba206d9ca74e51c4213486762a7f8a5f7cacd8c
MD5 ae84ad1937987de546e8f711fc273f5f
SHA1 e041027dbd16f19ad86386b369a181fc200f156e
SHA512 1697f14239fd7131b57c0bbe37d77e73434e6a36dd86343e46f77b5b5adebfc18ad0b930776b8179e9ccadc4971fad2c419941444e68b915e2a8644a9c7f7a61
SSDEEP 3:MsEllllkEthXllkl2zEnP7Sat:/M/xT02z2DSat
TLSH
T13244040C7FC00D05CD001034D011C3500370D4743513F7433D55CC135CC75C00C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\00\00000000
Size 4.5MB
SHA256 549ae1ba2bf7f623919d1bbb74140e6a8f07bad68060f5b5bde7179f46de8df3
MD5 cdedd6b7b9ce4810a6e56faff64f7c2d
SHA1 33be86eee68688bfa70f6ef66a74fa712a0fe37c
SHA512 73b3ab6451e65728c24ad7b6b910d432d186a496f6e3e4963a5d91e75366781b52f074a91ea9d607525ea0904c460ec9038d3e03bb08af4903259dc8ea89e725
SSDEEP 98304:UopB88+MUkt9sd4I/mmJ1Q6eceDNIkInlcaEj7uXSwiAKSa3CZ4PGIX:UopB88/Uy0hm8QS6NeWaiu433wEz
TLSH
T15A2633E15A398FFCA17B3006DB830C3CD30BDA43EA65AD96C042686DE55DCB95AC435E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log
Size 9KB
SHA256 929081ba859caac1479ec7d3f879dbb3f4a54794ec6658a978f217b0def36f76
MD5 8b0300d8fc9dfc7fba46bce456f391e8
SHA1 122e5ae7126bca894836a53dd97c981a3889458e
SHA512 6648031f4ca212e1873fad0426f64f81a83bd537b818dbc2f784a2469d39f05e3d89008ee0865bf44a9f5a663e7941c725d0a63b674d58656c57cef4ad7c49d1
SSDEEP 192:OTNF3p1i9DmmD1QDmmh1D9Dmm1Dmmv1TDmmekDmmt1nDmmN/xDmmr1xDmmYDmmpR:UbsjQR5P/TTNndrxm5KZnKoI
TLSH
T171226CAB7A449E43D8348D7839779FC81731CD80FD88A59AF4C4FBE8463C692D6702A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 dc5b8691d9dcf79d0a4ca210c22380e313c0af94a2edabc2d0a4d045c55f7819
MD5 e78f1235b1688f181cb3ddc480a1f642
SHA1 4348ce8fc61243a5e3c941650dc0cc8284195e07
SHA512 6c1435d1507ad0a6992aee860391fc27bdb0c684f253db63a1ff796e1c6953487ec9b6e65035c2331afea0290997c961bfffd01e7476885472705eb7d54fe20d
TLSH
T1EAE02B9250DDC5AF68041057A638BBCDD6E3394FDB9ABD862B01D452F8414C0A59F570
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 c44571ea73cef91eab6bf06567cc8e22b72152ab48269f6f30d5a3eba0337294
MD5 5c0a2f7b2dea6f0015c3fc1ce9edf2e5
SHA1 96a5b9b2cfc9fedcfcedad0608c63dbdda02d25f
SHA512 49286ceb8666575d61ed72b65a4db684a5f6ada171cdb811fd738d7ce1e946ddf527f6453bc1c4922337a0baacacfb8c871f9f0ada909637ce9bc6c7c3c7370c
TLSH
T1CCE02B9594CDC26F6908105796387B4DD6E3354BDF8A7D862B41D455B8411C0A35B970
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 592f51443fc5b8980c9929b526d4b733a0fbc6d4d34bd88a6d370494040e5659
MD5 5e87590d90506db85c836ef526d9f1f6
SHA1 3d6a2bb862cb5191b606485b494bdac3ea5a8de5
SHA512 509ad38399f5222fc60588ed9ff7c3d1b7d906f00b26f34eaa7679cf86d7b3b273673641d27aafa04c7a4ee1160905ba48675e926fd32aaf3f9816cbab76aa01
TLSH
T117E02B9150CEC57F6C04205B95397B4896E3798BDB8ABDCA7F01C851F8411C0A65B570
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 335B
SHA256 2c5d42d0a496e587cb44ceb3614ddfbcf703c94eda5449097326e556911f43e2
MD5 50394c8abbf6ee25c4c0989ee163b7ec
SHA1 360513dea27c944ad54f2d798d8fd8f36944c896
SHA512 1c113e9a78cbaf1285f74bcb5f5b2b1249f6bc4f66bd81e4b31d346b779de3c7b30ffe0376f7da3da3da10fc1e0cb3e4495578f168df358591714556e48f0455
TLSH
T176E0C01080C9C57F254410D35524BB4CC9D370CEDB867D861F41C82878430C8E16F6A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7d0576de311c9bdee5e9e76b2d1bb7b7bd8a0396068ab333b2ed893fa9634507
MD5 e16963d0d708e3713326930dec0bf780
SHA1 11e1231ec677745468574765d4f0ec161fc350da
SHA512 0363f9bbd9ad87beb014d9677a3341159142cf4ea5ede4ac056d3a395a03896c40285a03cead3afe12f8e77d055300adb40372cde33f0e24606ac57a4b8035ff
TLSH
T16E31BEF783B185AEDE1156F09A04AF2BCE5C0506439C7C6A86D4FF1793B3471E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 142d7ac1de02086d2f67e5d8365b1d800946fbadb0941db8b83ce098894c589c
MD5 adbee1350d6ab671b3d5086126b5d98e
SHA1 23fc38d044affeb9efef87473f85f2ce23e4b04e
SHA512 6a0a08d57ab8cafdb223ffc6e8651663767a58bced824dccff788594d457eee383da641b0b2976676363f67059e8b02f72285a0045afefe1537698f0f3f7f46c
TLSH
T1EA31BEF783B185AEDE1156F09A04AF2BCE5C0506439C7C6A86D4FF1793B3471E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 12f5e7dca5d653e54361338cf98dcd88d47cc51465afa7ce5a753e8691c0596a
MD5 be5f9896027686a25232bce445cd90a7
SHA1 fd5f536072edfa151bdfd1b37a8e3d19fcbc9ffb
SHA512 22a72f96c23d9eea14abf9583e0645633abe78ac5088738e426538bd44a93744877ac82a0fabfced3d41b3ba0e21a0731e1c1f5061a0374b1b94745b903cd935
SSDEEP 192:sxZWRqyM/jK1Ml8Mkw/f0Ws7EKR5YIdpJHW6+WNGYIwiTGIgrJ:sxZW8Mw/fLs7EKR5pJHbGg9
TLSH
T18542F7126B34A977CCCBD209FA557F53D6F91472A2901E44A9FCDA1C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f28d89986d0f3d89f2766e18afb24466c604374ca44a297d189790de2755d28b
MD5 723a64cb4569af4c893cc03eb53a1b1a
SHA1 d328580007833a7a21537c0b36ba4fa5d39b33c7
SHA512 130ba856aac5bf999c92e968745463c834ed663d36c535ef0a69975aa8abb76f7f2768bf87bb23b3c6ad449630499b9c7f6e4022848d12162debe4e40390274c
SSDEEP 192:sxZWRqyM/jK1Ml879w/f0Ws3WpVsEKb59IdppQHW6+WN2eHIZYAC+71YIgbNJ:sxZWcMw/fLs3WvsEKb5+SHbgZ87r
TLSH
T1B462C712AA345977CCDBD209FA667F53D6F91473A2901E549AFCDA1C04E6BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3df49788e65d84852cc5a8d116f26b7082f13ddf37e72e2a3c4c2e133c93377c
MD5 ed431849506dde6832c29bca233edb9c
SHA1 5e8ed5c94a81290d7f3bd61666e5ea090086e73c
SHA512 7d8d7a9c71fec5dd7397d1ea6e27ff146a8d8fdfab0840ec3e816cbd092b4a039d6c0ba5a33326c51b7050d04a6eb79393a06512ff4d4e878e6dbe6d75714a23
SSDEEP 192:sxZWRqyM/jK1Ml8Mkw/f0WsxEKb59IdpLQHW6+WNQuD/YITmTGIg5NJ:sxZWcMw/fLsxEKb5+cHbh/Dx
TLSH
T13752F8126E345977CCDBD208BA55BF53D6F90173A2901D54AAFCDA1C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 682ae3c49b10d9f6c1ea5c9c922d26af52695e59bef5b53fc4d7eae5bd8726a2
MD5 d72e0422aca9d882c74672473f1a8762
SHA1 d1f6eabb666f9363efc6687c2fdfcc1e84a1a0d6
SHA512 dc57a74d33e5a2eb464aa0dac611a8181fbb2f4bc7dc66209b97a08a793d46fe371fa83a67d98c5d8f682bb5bb6ec1ed3c89a4eddcf5fefb3be63bb4499701b5
SSDEEP 768:3a4lsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR94uro2kc:3a4lsqxXlWvJD6Tu1ja54LAs94l2h
TLSH
T1E8D21C3B694CC77E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c4d2116ef56ff6b290ec2cbaed9bd706550c4041759eefee47c7b85fb74f7ee2
MD5 30fd306012dbaedf3d41d26684d0ce93
SHA1 f2cb82759f681dac22aba82b1da8eee8b096824b
SHA512 87a0709b732f4d0df039fa8d8ea6f20f5396b9786086a51d9ffdb856c9497a2e5fa0e413d9d37b414347a3f2fee3391ba04f16426ccfabfba32aac3fe80280c2
TLSH
T1A3A002110E659179C4240274EAA306992220E8100A0D23A584A580A48DA0155461607C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592820.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592820.TMP
Size 48B
SHA256 f985a42f86df7979149c580a48441d1e96552d96fa6bd32d46135299d889da05
MD5 1c4247d5479f95115a9522394d15aeca
SHA1 49824ab7d96d760f0a4a4a2185bb38accfbca23d
SHA512 2c3b847383c1d2745c0b7fac598d60c9526d9071660855f8c212537e96a3697a0c9ce6c390cef73ff534bba0a12e0df48dd53a9c47a9885c9449241c63a60d43
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 e49ffa87cc91b687cd6f83978a3b6b0063e34d8c27450e7ad7ed584e7997ea98
MD5 d1cb961cc44c5893344d10a7ee49dfe9
SHA1 5e6e252a7f7a71a9e7e61ebf567ce8d713be4191
SHA512 edbd9ccdd73c9a500b6ee4a6d06732d5d0782e2e7558236af747d09c7e6ea27677369288bdd97fa720f50e3c9b3c7655c6538917e619e6961bfd8c48f717ae76
SSDEEP 96:KYbaKYIKeBOKy8CeH+KccvaMKvaO21KKGc1/:ExBlRXTRQ
TLSH
T13AE14012367F424238BE381CE3AA85774E423163341C697F3B7864A21D66D616DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f15e00ac-df36-4225-8161-c07ca50efb52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f15e00ac-df36-4225-8161-c07ca50efb52.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a3f6a66a85d74097838915c596ebec5022074ef5084e1ff52e2555fe914301cb
MD5 375b35e312350cda01a6d566c3aba576
SHA1 fcdbc9d557b917f2a3cdc8a3058adf91023fadb0
SHA512 ce64af513d80ba87aa90ea14bebfffc5083474d3e302e88acc302e038da31c63e1cdde5edae90bf3c785c805e988d1f1e6c9d170939e9f95295e515791371ac8
SSDEEP 192:u0LsNTpQsAYdkRbs5QmiU1+/zv4VRNoCk1EowFVjTSRNqlBU8:BsNTpvubEaAVRN3AaiOU8
TLSH
T13A322A32AC745C7B9DE2A505F44B32139FB4607B9A893F90D6EC5B1C01EF59C630A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 172df7982cf10da66dcc455d512b3795ce5b57e430b71205dff49365311c79f1
MD5 0b4de97be5e33a45a2f2aa1f29a45472
SHA1 0211b9c22d28410e1b01fd0f47a235175bdb47a3
SHA512 a2132a9fb94c66d1e69ba9706909ccdd87951e76ef6f4f28d38f53b10533359ad09e827ad330714899fb4378089b3b01da0db9a148fbf67a321e4fefe15a5d81
SSDEEP 384:LZcIhsNTZvubEwAVRN3AaiOnTKwBODNZOCl0U:Th66WH3ATOnewBKZOk0U
TLSH
T15E927D71AC385C7B9EE6B505F84B32074EF8A177B6C82F5496EDAF1C01EA548130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 adda73c911f80e27de559bfe0842e462c011ce8e5b5ce3f35eb074d43479529d
MD5 7203750bd8a70a5b008700898a28234b
SHA1 0ab79623c0a3551237d901c964a66dbd2e443e17
SHA512 cf4530c22fa3b1263d25b72471534521548f1ca33ea03697264b8abcc3d6004f13ac393c6da0b8a8e9933f3d3b529d64101df480261754f7c1e0e6692abf0828
SSDEEP 384:yiFiZcIpzsNt8TUNTUlIlZvubEtAVRN3AapOnTKwBODNZOCl0U:5FQJswgrLWH3AqOnewBKZOk0U
TLSH
T1ABD239F248E7487AD9AE6707A77E3D034EBCD063B5846A50B3985A1CCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e7682314b68268f2504131deadd33e4c1a32da8a10834fcf76301d831f4beb9
MD5 4580cb46f60f2560595038f4a6666f44
SHA1 b496e1fdf83f3eb7c4c04c80934e1192c7365a0b
SHA512 18c11e77417dc82542eb40f64df78d92d7b4f62045c63e4e996d091df2d73d7c7249b108583228eccb3977390e3df7e5461aebd96ebc6ee609c2dcdb742f1f9c
SSDEEP 192:tONt6JkRtQmiUyrIW+RNoCk1EoPh3RRgU6:tONt6UrXW+RN3ABAU6
TLSH
T16202D9356C781C7B9EF26E0AB48736175FA4206BB9952B40EAE81F1C01D755C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ed9573d91ee22484734d8a81e9e998406f46747a6d51ddb9dcf9004b8bf0595f
MD5 04a3216f280f47d73aad061266dcc555
SHA1 6ded8d76521a29dcb574184335b4682131a6eee2
SHA512 6ce37100005d596ace71f7848390304a381fda416146c17a7ebe732a13584dd1cce1d640bf86a601e5b956fbf4a8b5a158a53123f308aab547f86927b7c2edb7
SSDEEP 192:uhLsNTMQsAYdkRbs5QmiU14/zv4VRNoCk1EowFVjTSRNqlBUt:+sNTMvubEwAVRN3AaiOUt
TLSH
T1E0421A31AC345C7B9DE2A505F44B32139FB4607B9AC93F90D6EC5B1C01EB59C630B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2989e6c2f334080df13f714a9062d8a0cefeb74b0c74d79052500de4c1864f9
MD5 da0645e720195cafbe5165bf7c4a66d1
SHA1 14503fefabe379f5a91c5f2edda612b48c34921f
SHA512 53a713b67d4af73d1885032c0459ee4dcd2c31c1b56525bd5297b64270f9426879a836df5db593fa1458b9ce7bb509a86d0f395f09afb7658114e3f6bbee448d
SSDEEP 192:QON26JkRpQmiUy0Ig+RNoCk1EowFVj9VcNqlBU6:QON26UHmg+RN3AawOU6
TLSH
T113121B32AC781C7B9EE26945B48731134EB4517BEE893F40E5DC2E1C01EF59C134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b642d80-9ce9-43d7-9006-e54ac2c37085.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b642d80-9ce9-43d7-9006-e54ac2c37085.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f164d3210a8a70929448670262a9b0a827842d9aa10239c05cf3aecaf78a10fe
MD5 2040d93a86ce41b204739d021575a16c
SHA1 57024c9a51f8acafdc61a6de7932e1120f1930be
SHA512 757399fb0d009487b0ece870d9cf25170e7397bcadabe4f6dad0f3ec8884f7892be75338a53af28cd95d9a9442280ad86a325050956091d08b830231b3f747fe
TLSH
T12941F65CB6EA1148B3B76F5AAFF7A86E447BB9772E06C05E00110D4F0A63A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3112-731-0x00000253853E0000-0x00000253853E1000-memory.dmp

Download

memory/3112-730-0x00000253853E0000-0x00000253853E1000-memory.dmp

Download

memory/3112-732-0x00000253853E0000-0x00000253853E1000-memory.dmp

Download

memory/3112-804-0x00007FF65C090000-0x00007FF661EE8000-memory.dmp

Download

memory/3112-814-0x00007FF65C090000-0x00007FF661EE8000-memory.dmp

Download

memory/3112-815-0x00007FF65C090000-0x00007FF661EE8000-memory.dmp

Download

memory/3112-820-0x00007FF65C090000-0x00007FF661EE8000-memory.dmp

Download

memory/3112-839-0x00007FF65C090000-0x00007FF661EE8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads