hxxps://www[.]mediafire[.]com/file/7ey90vzgnrus1mi/Warcraft+III+1[.]26[.]rar/file

Analysis

user interaction
yes
max time kernel
13s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/7ey90vzgnrus1mi/Warcraft+III+1.26.rar/file
Sample260821-t48vgstdrc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318048820317148"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{4DE0B905-CF4C-4C36-ACD7-22CD8022233A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4148	1180	msedge.exe	86
PID 1180 wrote to memory of 4284	1180	msedge.exe	87
PID 1180 wrote to memory of 2344	1180	msedge.exe	88
PID 1180 wrote to memory of 2344	1180	msedge.exe	88
PID 1180 wrote to memory of 2344	1180	msedge.exe	88
PID 1180 wrote to memory of 5116	1180	msedge.exe	89
PID 1180 wrote to memory of 5116	1180	msedge.exe	89
PID 1180 wrote to memory of 1500	1180	msedge.exe	91
PID 1180 wrote to memory of 4476	1180	msedge.exe	92
PID 1180 wrote to memory of 1500	1180	msedge.exe	91
PID 1180 wrote to memory of 1500	1180	msedge.exe	91
PID 1180 wrote to memory of 4476	1180	msedge.exe	92
PID 1180 wrote to memory of 4476	1180	msedge.exe	92
PID 1180 wrote to memory of 4696	1180	msedge.exe	93
PID 1180 wrote to memory of 4696	1180	msedge.exe	93
PID 1180 wrote to memory of 4696	1180	msedge.exe	93
PID 1180 wrote to memory of 3064	1180	msedge.exe	94
PID 1180 wrote to memory of 3064	1180	msedge.exe	94
PID 1180 wrote to memory of 3064	1180	msedge.exe	94
PID 1180 wrote to memory of 4892	1180	msedge.exe	101
PID 1180 wrote to memory of 4892	1180	msedge.exe	101
PID 1180 wrote to memory of 3608	1180	msedge.exe	102
PID 1180 wrote to memory of 3608	1180	msedge.exe	102
PID 1180 wrote to memory of 3520	1180	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/7ey90vzgnrus1mi/Warcraft+III+1.26.rar/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,13519202058419226577,6646838694921613374,524288 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,4895359752778501748,13070068635136951999,262144 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,11541552119032291916,2302215342571318907,524288 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5231316551349826177,17905806616554429716,2097152 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16575087742248038826,6895654913777914382,2097152 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8739385091725205644,14709566950612144803,2097152 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,12137676494619601407,16143470239281566151,2097152 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9108190871112208158,6878149860825432340,524288 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,4102138178392211060,9922715832006617369,524288 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9153846895868818519,2726092621952244334,524288 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9153846895868818519,2726092621952244334,524288 --field-trial-handle=2356,i,12120410329093829697,7353804672560797282,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 286db8d476bb9da9be1d8cec7a9d7049b1c00a422a6930b94682bc7719e1795d
MD5 3ca5795137e2d01f9d4e2b8b05f2a486
SHA1 3fa79c7e5416bd41065bea4d26f8f9782785bb78
SHA512 3b86678fa2158509c2b5a208f98c5ec26c12660b47e39be59bb1482bca298d9ba74f16074394e51a44afc7cca0d5264386e3794fd3441df8420daa7bfe3b5b61
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1C5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e91bcfb0be45e6ec174473d95354f3ae4cf254a178fa07f2a4daca2c36f76d28
MD5 c20886e59333c084396ac60957911a14
SHA1 bc72945cdc56906b6cc510ceb5f0a6f876a967be
SHA512 2ad1dd2fec8a5f63d24d189c638e6aba971e6474a6797143fd8c31f086d0146cb3f4096ccff2cb55d9bbfaf9f9effb3cd19e26e7feaf0d9e081db3c90889df5e
TLSH
T17361605A03C244FDEB301378D5E00D013571CFBA2ACBBD9452A498FF7D06B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58873c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58873c.TMP
Size 3KB
SHA256 b7837a23cf5b6b61147e2b5412e2a4b89e5b09774acbc93555fead58c15b134d
MD5 3259b771ffc27e140702c7ed77c767fb
SHA1 9969588f070e94ed226b81f2c119245145fe4e1f
SHA512 dbcdccca092a40eb1177ed0cc6fc32a5ee79680bb844d457d011340665347827bf438a9acbd5eada86a6872bf434f2e19114311a903ad2a159e64af05207022d
TLSH
T157615F5A03C240FDEB301378D5E00D013571CFBA2ACBBD9552A498FF7D06B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3eb23c2e500166dad53a65a545dd5d3ea767260ab7f545eef740ace22a4eea8a
MD5 33f671aedaa94056e97ea63d1af8e5e2
SHA1 0db38a33018e3316429f42a5c0ee4c001bf07180
SHA512 afb9ef3a95c15ca26b74fa0615bff5017d58e2980e893a012d61e80b08ec625ada24604413adfdaf84e2b0c62c7da71c458a2286a5706589caaa73bba05a1fef
TLSH
T1D12198F3C3D5955EC9151AF05A24AE2BCE2C060542283C1A89D4FF6BD3E3076E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d5ac3bbf49b300c48b810bbef9bbe228e9cd8b7c99ad4c9917dc9bab2af3491b
MD5 a16b2382703ea0236d227d1e8e942eb9
SHA1 bc10818f4b05a4b416d7519c9c1f6f0e856fbfd3
SHA512 e6da39c17ba6dea23a0b9279dc032b1d3b5da7c407a4f17b7ff2b4b9a053d537af790421c2f7d56d12222620fa2f6e3298d68050b19b69b75568b3682947cdd2
SSDEEP 192:sxZwRxyM/jK1Ml81kn/fesQWpVjzPIdpJHW6+WNGYw2WXaIgFJ:sxZwR3n/fesQWvjzgJHbGEv
TLSH
T1CC52D7117A34A97BCCDBD20DFA557F53D6F91422A2900E8499FCCA1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d71e9fdc689148f4d66a259a78c5d3f8fa808f2f06f80fe9045dbdf66b4c3d11
MD5 0b02070e3e88dfda394efebf064616bd
SHA1 85464b31e5cf5e0903ff238e5cdd2b7cece67855
SHA512 21c885b6f065873a4ab2b1d50f2235cb00e5b5bb58c8a7b372a604d06c00c0763826af91fa60ff5ab837713bf04e214e959a71a6087f403cbe11f30ddd7afd2f
SSDEEP 768:lq4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dgrohKcHgaK:lq4jeXmWvmKLEu1jacPLZQdrDm
TLSH
T199D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8f78d1e179c94d989d11dbeb8b5e8c1f0b152408759c48163dbcdf65177d6e61
MD5 b211669860977a13d0ea689b27d29b74
SHA1 0c7aa8a235e8db2003a0575cacdaa6e25b7ad7aa
SHA512 e65eb08c0c731e421632fb291f52a1c9e17f10070d76b0c1e3bdaff5d7d3c34048b4ad3be0da7f0e538374c44d95b6d3c5a7cc9c0c3ce56d54e80ce1bda2c6ae
SSDEEP 96:K8mQKjiWe9eKmw7c5S+ciCx/evsxmxKJ4x8xdkMXmCSWlaKmcH:uLFKc5S+ciCdevSmo4x8HkMXmCShC
TLSH
T1C6B1455571FB42122C3E6A4C8564862B6E81B1A33468B86F7FAC00721EA7E51CDFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97f004d0fa8e54837c1e6e6afd78d30e75e6a4fbc9f9e6253c56cefccd10291f
MD5 6a0d899132288f12aa6fafe32ddba25c
SHA1 f04cd996e4482c6fb4b7a464fc5df69410aa6f02
SHA512 6f852e530b27b760656f55429d65c201b286529ad6e6c2709b5472fc441bfbef8c8be8a2c70e0edf4f197d1f35364b85d497bb39ddd649dcaee3a821abf96396
SSDEEP 192:EONl6hZ0QmiUySkpc/+jVWjzorGYW5wOZelnU6:EONl6oSpu+g8GYV2YnU6
TLSH
T12602EB35AC787C779EE2AE46F48727235FE4112BA9952F84DAE81F1C00C779C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a46566d13b81d8b28cf579bac072fcf07c866f784d6e00a9fc1572f6a32a5c4d
MD5 fb91e3935b3ce89852e678c8ab33ce7c
SHA1 7f01cd2749b5b7a97f891b6da2b3dc3d88f6a12e
SHA512 7e57292eaaee5474e917e66afb10ef2cc117a6d343d8be3f8c4dcf64dcd1cbd47877f4a0faba1e52a825ff8f56c83ae9be151e187553eb2e26f73ecab63bba41
SSDEEP 192:UONt6hZ1QmiUySkBc/+jVWjzorGYZX4+2fk5cOqEqjoU6:UONt63ABu+g8GYZX4+2fX9CU6
TLSH
T1C712FA326868AC675DD2B641F48731235EE95117DEC57F84D6EC1F1C00DB6AC230E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 d98b78fce717c2ad761fd7c1dc9e1691755098208a146d8f389017d0e5bc3577
MD5 893fb8d0be7f17d1f167502b440cf842
SHA1 f60cbd52a2c633dfb8ef97f98acea90db894ac48
SHA512 436530569aac3919353d33c433b3aed62686d500d40debb0eec4f4bcefbc8e01aae2e92026d90eed1f375cbb3fad7da14a696a7e3458359475ba80eade209883
SSDEEP 384:QsNswS92mTf+g8GYZX4+2fZFBLA8tJ4loAQX96M7U8:QrpDU4lrS87AQX9h7U8
TLSH
T171720970D8A85CE784E1EAC5A507E5136EF8053B89995E5CE7F87A38309F5FC2316822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2a775a77d8960eaab43c5aab2ba023cbd17f0bf9547e532a9c728622db91400d
MD5 50fd95e413a1616140ab2dce2bb29cc2
SHA1 43ba8b8067ce00c9b7d8f028f5066ccf47448788
SHA512 6636e4848b0e8391ba7bd5bf57c1d8df1d42b5d9f2cf5b58bd7fe59812bee9d44704c2e365f45b906cf8b1400759f6f2b898fe2d5da10a6f8c19fad81ff70ddb
TLSH
T17241295CB6FA0108B377AF4A5BF7A96E447A7D772E0AD09D10110E4E0A23A00D962B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads