hxxps://mega[.]nz/file/yw4WRRib#GD-tbcefoppv3DROQKZ1-_gDYrfvGZ3bwy-haU0yBCU

Resubmissions

09/08/2026, 12:41

260809-pwr5jsxgpb8

07/08/2026, 17:22

260807-vxztnss1es10

Analysis

max time kernel
598s
max time network
433s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/yw4WRRib#GD-tbcefoppv3DROQKZ1-_gDYrfvGZ3bwy-haU0yBCU
Sample260809-pwr5jsxgpb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307528770532739"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{BAA69BF3-82F3-47AF-A67F-5AF44FC99408}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 848	1980	msedge.exe	84
PID 1980 wrote to memory of 1908	1980	msedge.exe	85
PID 1980 wrote to memory of 3736	1980	msedge.exe	86
PID 1980 wrote to memory of 3736	1980	msedge.exe	86
PID 1980 wrote to memory of 3736	1980	msedge.exe	86
PID 1980 wrote to memory of 3548	1980	msedge.exe	87
PID 1980 wrote to memory of 3548	1980	msedge.exe	87
PID 1980 wrote to memory of 4952	1980	msedge.exe	88
PID 1980 wrote to memory of 4952	1980	msedge.exe	88
PID 1980 wrote to memory of 4952	1980	msedge.exe	88
PID 1980 wrote to memory of 2532	1980	msedge.exe	89
PID 1980 wrote to memory of 2532	1980	msedge.exe	89
PID 1980 wrote to memory of 2532	1980	msedge.exe	89
PID 1980 wrote to memory of 2528	1980	msedge.exe	91
PID 1980 wrote to memory of 3564	1980	msedge.exe	92
PID 1980 wrote to memory of 2528	1980	msedge.exe	91
PID 1980 wrote to memory of 2528	1980	msedge.exe	91
PID 1980 wrote to memory of 3564	1980	msedge.exe	92
PID 1980 wrote to memory of 3564	1980	msedge.exe	92
PID 1980 wrote to memory of 2948	1980	msedge.exe	96
PID 1980 wrote to memory of 2948	1980	msedge.exe	96
PID 1980 wrote to memory of 5028	1980	msedge.exe	97
PID 1980 wrote to memory of 444	1980	msedge.exe	98
PID 1980 wrote to memory of 5028	1980	msedge.exe	97
PID 1980 wrote to memory of 444	1980	msedge.exe	98
PID 1980 wrote to memory of 2636	1980	msedge.exe	100
PID 1980 wrote to memory of 1360	1980	msedge.exe	105
PID 1980 wrote to memory of 224	1980	msedge.exe	106
PID 1980 wrote to memory of 3328	1980	msedge.exe	107
PID 1980 wrote to memory of 3168	1980	msedge.exe	108
PID 1980 wrote to memory of 3168	1980	msedge.exe	108
PID 1980 wrote to memory of 3612	1980	msedge.exe	109
PID 1980 wrote to memory of 3612	1980	msedge.exe	109
PID 1980 wrote to memory of 4500	1980	msedge.exe	114
PID 1980 wrote to memory of 1988	1980	msedge.exe	117
PID 1980 wrote to memory of 1988	1980	msedge.exe	117
PID 1980 wrote to memory of 4060	1980	msedge.exe	118
PID 1980 wrote to memory of 4060	1980	msedge.exe	118
PID 1980 wrote to memory of 4724	1980	msedge.exe	119
PID 1980 wrote to memory of 4724	1980	msedge.exe	119
PID 1980 wrote to memory of 3348	1980	msedge.exe	120
PID 1980 wrote to memory of 3348	1980	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/yw4WRRib#GD-tbcefoppv3DROQKZ1-_gDYrfvGZ3bwy-haU0yBCU
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a8,0x7ffc154cc188,0x7ffc154cc194,0x7ffc154cc1a0
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,12251343240560469027,16620146458983227468,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6751953064554094560,2412668305852166910,262144 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,11241021120138087956,8150539346045628428,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7424508884548414244,16842855723654654870,2097152 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3355383198351957669,18419055487830321724,2097152 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,16396481813572378444,12499312915290470706,2097152 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9070764962435501730,14744725099568246715,2097152 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,2620353417488633081,3142281874406684700,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,4005008872610116237,14450418860133084591,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2073305092504479182,7646619099273169189,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,59468156520480325,5403319419751798405,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,59468156520480325,5403319419751798405,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,1643399811869444593,8063170783726162911,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,17470734197738578315,14530617264390276591,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6450259567556624989,17934261305350023762,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,18195331369579786547,3490615690037428242,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,13105167600292275019,5096386163283567364,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5868,i,1545936282901749493,14302731137300990047,262144 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,7316297899907390519,8625505296456567099,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1552,i,5535352063633713811,2070710713623843654,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,4993726006749117782,15305429643972671726,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17194817385488041919,17389767026594292200,524288 --field-trial-handle=2380,i,17974903539548212825,2973646101573086759,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5ff05a621df8df05426fbba3639de62cbb6d573187a90f20bc797fdbe4b71bf
MD5 c23168c2b4dd096d77fb57bb53393a90
SHA1 0038662e136abcde2c29c9d3d3c3bf2dbb11d164
SHA512 7ee97c45aa94467885b8aa2145e0879de4ec2397c36198ceede5ec06664080ad500e1a9d62566de09c10902658158cd7d9f529ec85a76fea0c32eb7ae7182b5f
TLSH
T1E0D09B2036CD5443C59133B398455F45165D59681556D242A434514CDAA6044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1df9228ea12eaea3fd4bb82e3dadc2f8334cfa6d5288200e0384c872d9dc7eb8
MD5 13fb18209cb1d47e18c2a635a41efb65
SHA1 7781ca4ffe09d7956699d21d201cf5fd04d2de0f
SHA512 f4edad6ae135f7b9b9cc18dd15240e06cd19194676c85bc6d2c1a57a365c7a3962b85374a7a795fa99d61fe383a329a93bbe6808880ba35bd1982053fb055bdb
TLSH
T167E0208C14C4C25DD554645FB1789F1CD3D0360F96C4F9CE1F0488447342440F3D5960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 73697bc4c41a5400e2a475be10855f6bfab6300c3c942383d3a5f86e389ed96c
MD5 c9a11f46798e8a3820989d4e6bc3990e
SHA1 15179543ec952325552be8f50093cca8fc917cd1
SHA512 3ef7f93d739e11faba99691a00b027980418c8e273179a7257bdceab6c51c590c3c6ee7232187624a325c64e7e7bf1a7b7eb3b4138d8379af22e7a77d6cc99ef
TLSH
T146E0788805E4C25D5775A4D76174771DC1D2364EE7C4E9CD57009544730144477C7DE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e839ba3f5ad836cbee90b01af689c0bed6641388031c961c7838576fc590817c
MD5 ee9546ee74a2553483b5f164298a03d1
SHA1 9be2578c4840251125e7cfbb272a0f6734421147
SHA512 53f03febfe2101e9e1de6a19527c435a5dcb4141466458b607aceb7052efd6226d13830b05832f2344d32cdbf8c24ec2e77be22ad8837c2e0c18eafc3ea986ae
TLSH
T19EE026C824C8C2BEA6007847A178570CC2C0375F9AC8E90E1B048C8572C3040F7C6EB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d875fa8a24b3ca727202b540f371982fadb5b733ff0a495d82e5d37d20180c9b
MD5 99ddb8e3ad602deec5d0b97e8db450b8
SHA1 d9e0548033015feec25ae17f3c208fa4d8f4e562
SHA512 97068e109bef437008ea73602362c01504189517d5fd7524041951d7a800aaa5cddeba54589ae8aa442fb91e838e68766a9726b83297e25471f62d427eb94f4d
TLSH
T1FB716D2712F572E9EB62C1B3A5E22EF03BF281FA08577ED22C4058BF7521715C355648
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5893bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5893bf.TMP
Size 3KB
SHA256 8391b5e646d6b595ec19d1f48c7280e2ee903e2ed8927aa20d92bf7ed513615d
MD5 f7495b8ed261c0ce4eeff380c0553bdc
SHA1 4b0853be07cf458434d2f9b101fdc2e03de02b68
SHA512 0747d15d99a4653b9606bd06346340f2e46fb2955018f843142cc1abba4eca994db37954d1416a1485ff3123f2459e307a0a3130c151210cb5ef63e38bfce86e
TLSH
T18471902712F572E9EB66C1B3A1E22EF03BF285FA08577ED22C4058BF7111715C385648
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3015c95bff33cef0da08a02972ebbc9a278e4721f3d793a46c1a555c5c05dbee
MD5 5f6cd264b05ea1b56472e3bc42211e50
SHA1 832bbe6bd5b2f99b688e8da7df721a29dd1e0bf8
SHA512 3148f942b86de4064c9b567df673ee4cba604fc1ba9ad75fdf50469a955e6a6adb4ad4a002a613f5c285f639b0fb9cd37c518258abad0e78c72ed98eb85b0b66
TLSH
T1CB318DF783B185AEDA1156F09A04AF2BCE5C0116439C7D6986E4AF57D3F3071E102E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 73a8d5bbec79f0687da63bad5ecc8248b458505065d042e1a8f8b6c048ea642e
MD5 e01f10ba015899cac70ec3f71370c6ed
SHA1 39623830cf38d9a950c70d2d19195fe24c2efd1c
SHA512 989f0475080bd7e91378117fba55b9876d3f218fd8c1cf05d38d51e853495a09b402c24e12e2644261017335f1672e1d237bc7ebc10fc0ddb606c63474dc7952
TLSH
T11E31ABF783B185BEDE1156F0AA14AF2BCE5C010643AC396A8AD4AF1793B3471E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c4f3fce1d9a89a1350c1c19dd7f973e7e4fd8ef96636eea918a26b4f597142f1
MD5 1cac9d14460fd0586aea95df0a958517
SHA1 a469c95229716541d7a2ee479c27d5913f618771
SHA512 193e409c835aceb59cfb92ebb226615f844f3c5f8186f6342eeffd126f62d25d11aba4c14c759931aae63a6d7abc11cad62ea822037fcf72f63a7c55fc0f7ca9
SSDEEP 192:sxZyReyM/jK1Ml8Mkg/f/sR2sOsEIdpL7lHW6+WNQYpN/Y4l2RljmIgrJ:sxZyEMg/f/sR2xsd9HbX/Eje9
TLSH
T19452E8126A34A97BCCDBD209BA45BF53D6F80572D2804D549AFC991C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 022694e875ec23e9eb299de8d2fa6b0b8de22eadebaca1d233376a269e6c26f0
MD5 587f28e416f5b3a6e858a9528c1b5852
SHA1 53f3cf922847f158a0a7a6f73416153459286182
SHA512 e527d0c4bb62991aeabac31187c10c3e7148baed24dfd6458a304ead580a7910c9afbdf07c288cc3bf424ae3ffe8605f7a5bbab5e940b6bac08f7a481623ebe7
SSDEEP 192:sxZyReyM/jK1Ml8UQhkg/f/sV2HuOsEIdpp7lHW6+WNQYpN/Y4ltRljmIg5jJ:sxZyEqyg/f/sV2PsdPHbX/tjez
TLSH
T12152E9126A34A97BCCDBD209BA45BF53D6F8447292904D54AAFCDA1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 50d512e9c3ba3807dec54012e17217f1dc5c598ae9dae1c8d1122276db1832ee
MD5 ebadc5c5e23622240aaa3b6d481fac46
SHA1 bc92f377dfbc3884360511bc5e52d69ffd4e2279
SHA512 f3dbf1c72449fe7294aca96696bb9f8c2494332a542b9e0e20e64f3ba43f2bc8b1a9f100f71bcd5d062679d29ee8b5cf9d8b3c90993579231f18895da579187d
SSDEEP 768:T8EPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1kroA7GSD:T8EPO/KWvWeI5u1jafqLXO1vbSD
TLSH
T15DD20B2B680CCB7E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EB51265DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\temp-index
Size 1KB
SHA256 731b037c6b241b48c93298be305a00c0ec3448d0b8c4a523bffbf3dd2c91364d
MD5 15f49fc635791bbd6eb212c4046f9c4e
SHA1 2d3b0b3b4aa3006bd2fb9256457cd033511822a4
SHA512 6e27513640a31364fcf433a13707de7fc2e7f3950e4dd51e22c41810ef6fc5bd25ed367ecd01fe8689066bfd8ab089dec1daa3abfdc6a6404d4b959535e1ffe4
TLSH
T14931F08D8E51999FE8A488B2207675A473B0C9DC1711A2634C3C723A7D6739E1E4B5C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cccec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index~RFe5cccec.TMP
Size 1KB
SHA256 0057ae4198304f3795c09022d36cbd3931fda82c1eba75da8e7b7cbe2a13cf07
MD5 283e9317b1afc5b17447771bc8e75e71
SHA1 fab40af62abf3a59334ffa31d151225090a7fdce
SHA512 de671e8f3bc2203fd4342486697e0846d2296aee20936b386d83771ce39733964361369634b30decff349ac0a3c048174c41753220ac5d66fdd61fb9e4dcb85d
TLSH
T15C31258E4A91590FE9D040B20553B4F83379CD406312B393957D633D6C7579D6E4F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cb67e6b76c18648fad65fd6eda2fe58c94ae59c022f7d756f26050bb2e70e280
MD5 26945d3dbc36fdc79b57fb9176c54120
SHA1 d72d061fd5f36159f90fedb26258989754a9578e
SHA512 71812caddb13c9e08b9efe682ba21b05c2ea93a7090871d8ac41e53755f96cd274d7e9f37a81328a449ac82177efc9b3cbec81013d9ff4edb2cda70fdbf284b8
TLSH
T1B1E068B63CB71C10FC6BC3C6A47055A4011679688600AC8F141AA2CB30E1328344EC71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 467c94322d66260a7a1433f93214d7f298932f0bffc8f184af739881f539a338
MD5 98b74529ec979ffd900beea69cc84ead
SHA1 98f40ebc6165fb7026a39c94028cfbc073b1d6ea
SHA512 9d50d6308ba1d3e53c984fb49d110cadbb3695814e4ad5ee4e07801ef0900631bb1b5f52067b92d456ff82e3e5bb7cd4663d54b55b22be6ff429682d0db025be
TLSH
T133A002220D948571C0100774E1771185261188164A09221540B441988E60145451282C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58947b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58947b.TMP
Size 48B
SHA256 1a328578ff78903bb1ea2296dcf48e06c20442e821c205c5d44d66eeef3bf967
MD5 664104016e3c1c53b1381c889db8bfdd
SHA1 5bdc017b1f2dc472457b8582e01d2e2245f4b4bb
SHA512 9ffacb6bd26cd1f7f891fa0670d09bfdf89eb7851972aa2d561c80574a701dc733bf5b677532a26b9fd9d20090f17c18dbb75dc986bfcb4c9b6bae700a02a202
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5e63b86aa171248e0d26f71574e412394be6756ca306239208e65f4f106b5c02
MD5 5caaa9abeb6f35af54e58d7a872a8f20
SHA1 fb0f9164c49199053002a988815f223dfdcaf133
SHA512 cc0c5e9698f180f87e4b470bba125af3d4b1a1c85a1c5744c1d2b3462a99c63f64e205a75ce696a9d682992734a3ac084f027469090cecdcbc3f6bd4e98ea186
SSDEEP 24:KdyGfypyaybayIdy8yoyE4y8yI+yvIjyeyEKiynhayIyE1EyGyUSmy6MyL8yGyZe:KEqIPKjSoPy9vIJKcwUAII3K5+0vyXz
TLSH
T11991C202763E169138BE745C91798A2B8E4231A77069E56F7BB908610F6BE112DFCDCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8a5da63234e15ae68b485b6f352b4c4d9b8cebe890ba7a2c40ba664dce264df2
MD5 c382505ee2fa8855114593cd22d5c3ea
SHA1 2cdf601fdf7a51774b03ee3ea3838d11a81b795d
SHA512 371a741eb99dd3167f4d393dd9bf22ef1da6430454e1841b2917ac49c30d3504da79c226851c87f3a035f1005767409020d4d8653aae3252f40e0246512482ae
SSDEEP 192:ufLsNRk7QdpjOkfCAL9vq5KQmiU179i4hC4XqMB/1jAOBnURYcZk9dHbsqAKU8:ssNRk7odOQIQDNVXq6GO9lcZ29U8
TLSH
T18C3219327968AC375EE2B644F04636039FA4512BD6887F94D6EC2F0C05DB3AC131AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c0e2d6ecc24b243d2b79ce83efa62a62af3f56da1f466e3a1650529797cb8219
MD5 35362b92efe7f9663d931d061b15be2f
SHA1 32327c31c8e7b9b6b0301d57541423edccadd0ac
SHA512 2f1d473e02fceb56d1bce73b9d2464a834e346fbf6370df7a53cac18de9f22ccd85e220e353aeac9b167ca37ad84f939dabb697ddc10b65e13f08d525f15372e
SSDEEP 384:4qZcItzsNRknodOQIQ8NVXq6GO9lcZ99XC:bV2dvcXcOHW99XC
TLSH
T1C9A20AF168E75836D59DA303A77D2E034EBCD127B2846A44B7E86A0CCD9617FC31A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc19fe2757015fd32da88cd5cb99b320667f1f1744ce97ca81a4c9bfbec13e74
MD5 61a0a726377beaf334c30784fa0eb28b
SHA1 fddc06020b515be5f83ef801f301edb55bfe5872
SHA512 d983424a84f287efdfdd31f3089614f7fd56551aaed9698686dcf397fa6e7d7e6a66b545db72c3300268b98dc5d293875b42487ed7c7aa7a549fad5691d65a70
SSDEEP 192:mONS6rvoQmiUysKaDrKhD4XqMB/1jAOBnURYcqExOBU6:mONS6cd+6Xq6GO9lc7uU6
TLSH
T10B02E83579686C779EE6AE49F0873B135FA4212BEA817F84DAE81F0C01D765C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 88e597ae4ce67dd573d0c9e4d0fa612ecd6211541ba20f5705ef5087cbd784c0
MD5 47ae4081ac817fe827757fc1ede36c7f
SHA1 c8334bb55bd33d2e45b7be0fe591702338b2626f
SHA512 8ff7db741215b2f3580c6ef1ed76eecaa4aa43287124d3da21ff899928e14025ed0a412a290f276a3d0151907cf4968c89aca1a6370778bd21f20b33d453856a
SSDEEP 192:uwLsNRkXQdpjOkfCAL9vq5KQmiU179i4hC4XqMB/1jAOBnURYcZk9dHbsqAKLqyi:VsNRkXodOQIQDNVXq6GO9lcZ29Xi
TLSH
T18F52397278689D375DE2A145F00636039FB4912B96847F94D6EC6F0C01DB2AC131BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 8c64a7bb976185e7bf2c58d4ea3178e9cfd8d7fe02e9f57671890408a89ab2f3
MD5 b15ebf84c5f0b4542977ee737b8bd0d6
SHA1 25153c58a356fdb32b3421bc80a0df464ea0830b
SHA512 22204429483d5ae45c7d4f87016cdf324bc118a7d3785d48579bb0579c4227576bd2ba846154fafb11f288fb918b89656f120e61965ac958c45994f5d39969e7
SSDEEP 192:uwm+xasuheOwQxMGsNRknQdpjOkfCAL9vq5KQmiU179i4hC4XqMB/1jAOBnURYcZ:aZcIhsNRknodOQIQDNVXq6GO9lcZ29XC
TLSH
T127727C726878AD3769E6F145F44636034EF8A137E2C46F8495FCAF0C05DA6AD031BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3177f3f45d13eb7d9d4f5da33ef8e6f0c0fea1b6930514fe8053ace08e6edbed
MD5 367d0d4ed15a36c7df677db0d5691b26
SHA1 0cda9732bfbaed67aa89670245efa06afbe09f72
SHA512 00b96f967f5e50fbf5948a1274b8dec852c0b2a91ced55a65b324d99cb1c1d9b860d2f1ef84a0d997df0bd212b13a1e84f21b8f61e5ef8ebe754aac5ef3ae1e0
SSDEEP 192:/ONs6rvfQmiUybaDPhD4XqMB/1jAOBnURYcZk92ICsqAKU6:/ONs6V/P6Xq6GO9lcZH9U6
TLSH
T12F120A327568AC375ED6BA45F08736035EA59227DA85BF80D5EC2F1C01DF66C130ED26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4bb4b36-7296-4de8-a03b-53a3d6141e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b4bb4b36-7296-4de8-a03b-53a3d6141e50.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef10fe0733243ab74c54b44861ad6c496397a9e759aa16675de02401ebc0c9f1
MD5 3ad2e440e7fedbc2f6a2d71b2c591c87
SHA1 becc96c4fbbd44e0f819263c8ad9e873389d68ea
SHA512 471036ec7654d6cab1207f24f018605038108ea5a0711e9c97f3ea70ffd9cc673fcc72c339fa7e667f9152c7a1fc63a89f634bd79305440ee7f17fe35b10f5e6
TLSH
T1BD413B58AAF91104B3B77F16AFF6A5AD48BB7C732F0A905E00110D4F0A76B44C8A1B73
MD5 SHA1 SHA512 TLSH

Submit Download