hxxps://f005[.]backblazeb2[.]com/file/sayon-1988/uploads/Elektronna_povistka_do_sudu_31[.]08[.]2026[.]IKCJ6S[.]rar

Analysis

max time kernel
298s
max time network
283s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/08/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://f005.backblazeb2.com/file/sayon-1988/uploads/Elektronna_povistka_do_sudu_31.08.2026.IKCJ6S.rar
Sample260831-p5ynpascrg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3212	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326545407013543"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{C359AC95-AAF4-4FC6-BBE8-2D2B8069A49F}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Elektronna_povistka_do_sudu_31.08.2026.IKCJ6S.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 420	1552	msedge.exe	80
PID 1552 wrote to memory of 3212	1552	msedge.exe	81
PID 1552 wrote to memory of 392	1552	msedge.exe	82
PID 1552 wrote to memory of 392	1552	msedge.exe	82
PID 1552 wrote to memory of 392	1552	msedge.exe	82
PID 1552 wrote to memory of 5004	1552	msedge.exe	83
PID 1552 wrote to memory of 5004	1552	msedge.exe	83
PID 1552 wrote to memory of 1212	1552	msedge.exe	85
PID 1552 wrote to memory of 1212	1552	msedge.exe	85
PID 1552 wrote to memory of 1212	1552	msedge.exe	85
PID 1552 wrote to memory of 4812	1552	msedge.exe	86
PID 1552 wrote to memory of 4812	1552	msedge.exe	86
PID 1552 wrote to memory of 4812	1552	msedge.exe	86
PID 1552 wrote to memory of 2512	1552	msedge.exe	88
PID 1552 wrote to memory of 2512	1552	msedge.exe	88
PID 1552 wrote to memory of 2512	1552	msedge.exe	88
PID 1552 wrote to memory of 3360	1552	msedge.exe	89
PID 1552 wrote to memory of 1700	1552	msedge.exe	90
PID 1552 wrote to memory of 3156	1552	msedge.exe	91
PID 1552 wrote to memory of 3360	1552	msedge.exe	89
PID 1552 wrote to memory of 3360	1552	msedge.exe	89
PID 1552 wrote to memory of 1700	1552	msedge.exe	90
PID 1552 wrote to memory of 1700	1552	msedge.exe	90
PID 1552 wrote to memory of 3156	1552	msedge.exe	91
PID 1552 wrote to memory of 3156	1552	msedge.exe	91
PID 1552 wrote to memory of 2300	1552	msedge.exe	93
PID 1552 wrote to memory of 1240	1552	msedge.exe	94
PID 1552 wrote to memory of 2300	1552	msedge.exe	93
PID 1552 wrote to memory of 1240	1552	msedge.exe	94
PID 1552 wrote to memory of 2504	1552	msedge.exe	95
PID 1552 wrote to memory of 4848	1552	msedge.exe	96
PID 1552 wrote to memory of 2504	1552	msedge.exe	95
PID 1552 wrote to memory of 4848	1552	msedge.exe	96
PID 1552 wrote to memory of 4848	1552	msedge.exe	96
PID 1552 wrote to memory of 992	1552	msedge.exe	97
PID 992 wrote to memory of 1600	992	msedge.exe	98
PID 1552 wrote to memory of 952	1552	msedge.exe	100
PID 1552 wrote to memory of 4708	1552	msedge.exe	101
PID 1552 wrote to memory of 336	1552	msedge.exe	102
PID 1552 wrote to memory of 3192	1552	msedge.exe	103
PID 1552 wrote to memory of 224	1552	msedge.exe	104
PID 1552 wrote to memory of 660	1552	msedge.exe	105
PID 1552 wrote to memory of 660	1552	msedge.exe	105
PID 1552 wrote to memory of 2788	1552	msedge.exe	107
PID 1552 wrote to memory of 4592	1552	msedge.exe	108
PID 1552 wrote to memory of 2480	1552	msedge.exe	109
PID 1552 wrote to memory of 4592	1552	msedge.exe	108
PID 1552 wrote to memory of 2480	1552	msedge.exe	109
PID 1552 wrote to memory of 4128	1552	msedge.exe	110
PID 1552 wrote to memory of 4128	1552	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://f005.backblazeb2.com/file/sayon-1988/uploads/Elektronna_povistka_do_sudu_31.08.2026.IKCJ6S.rar
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffc5647c188,0x7ffc5647c194,0x7ffc5647c1a0
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,10321767756778975253,15181993276660166203,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,16965207090950155543,4952997555119984717,262144 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,14987610644034901677,15131502012838955615,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,10980463646570981212,1024719761505154066,2097152 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,15167454554567529439,10874618122406589333,2097152 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,7695696435630848547,16622433274961406605,2097152 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,7216432148124069017,2946769702059606596,2097152 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4200,i,14527653858083193709,16605689980322263702,2097152 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4224,i,17691254742874351318,6163950023775555454,2097152 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13694713631696331878,13555596482216414996,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,18388343578870660883,2567285911599622888,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,3628819917749453316,1238591850310545305,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5808,i,2358010759387818870,17312179142995406262,2097152 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,11128444843081174519,10827343573652336141,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,4817625082314824017,8970462836743425771,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,4817625082314824017,8970462836743425771,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,18383463527524471625,9401545769922881296,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,6347743683825342607,8782401231496588531,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,10345867191678339854,3478683599465977891,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,6726015109275965463,18220269685104222025,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,6598095507188308874,6104473550038345385,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3372,i,3412178418047592159,11606947264261353497,262144 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,10522753557891114344,17578711804234455108,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,236780405317960239,16530198830898698024,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,1259225734249140002,14400932962817133763,524288 --field-trial-handle=2032,i,7206550946134761141,9657600445560177142,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 cad749622f1153560711f0e407c96fcf69d6787cc5bbf08d5483dd0b266eaa4d
MD5 5e33cbb18a37b07f1429c157c2e78f5a
SHA1 79ea7553713baa583642a29e155404f83de937a0
SHA512 943770380f80991d8c25d59a6227ff2f8f01f44c98ee856572fddc80848e38a9476a12c988dc1fcf99e3add56269c19c1b7105084973affcf9f931f72e401cbf
TLSH
T191F08B4552F0CBEB4B01E5CB9558631A8069764BFACCD81F73697CCC340010A9A993C5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb2549f033ac93e4777caae56951fa67acb7972656642022742cb8c492205b81
MD5 86627f9066cb9bf9fcc0648fdf697972
SHA1 91de2742f826a2acb3e591ad17953013b13791a7
SHA512 6826c459d1bcee5daa8a00a2ba653f124cbc73eec5e01a7e8c528ee9fb8d5a67be75373cbcec30c9a2709156ed97bf287a9e8b3736991aeffacd7e24ad3f43a5
TLSH
T1766129F605D26759F3F05F72E1E00B7034BD58A8095F1AAF024098BC1A3B771C3251E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5890b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5890b2.TMP
Size 3KB
SHA256 153c5b248a42301c0f929f3387515230868769c312785076b3977bb65fc6b490
MD5 f1a44ea5aae457e1000aa1c2501316d2
SHA1 3650224d5b66d9cfd52dde5a5a136394fd243d94
SHA512 0c1f19b51b5569270ff1bf72ebb634762600cb1f64491d1838cfd45b3c674841514ff32904d5d5043835ec14f3d2604be940199251ae29d6a66b760add90e18c
TLSH
T14A6128F606D26719F3F04F72E1E00B7030BD98A8499F1AAF024098BC1A3B771C3261E9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ca83501b-44d9-4354-a297-7e2449c07a0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca83501b-44d9-4354-a297-7e2449c07a0e.tmp
Size 949B
SHA256 b8fd64442f2ade8a5be119847e60bfc1f83a14104d8ab717892a763aaf800b00
MD5 d19f9df3c60d737032264c2a8e10a70d
SHA1 58bda5369ed955fa20aefff015dc0bb0749ed016
SHA512 bbc2b406b69448f9d5a6f1168e4ff1ddbc90b397b6ab31fceacc919ba3bbfc648c7ced81d6e19625d808c3f73a4fda1aa7f9ffa5a71acc01641b8279535f3801
TLSH
T155117DF3C3D585AFCD0116F0AA24AE2BCE2D0606421C7C19C5D4EF6B93E3075E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1285eac1803946e199a48dca9da492462a0aff649396a99e74d02105a043e872
MD5 c04d1007ab181c337cbc98f865bd1004
SHA1 ce54a38e0407c057af439b15e189ee7c9968e812
SHA512 088076902248ccbe22dcaa4f636f19df17d5f03943a7d57b026946b4ac7ffba54728e33ed588f797dff7903a199860549fb477689fdfbb47758f207d760f63bc
SSDEEP 192:sxZ2RcyM/jK1Ml8UQ3o7/fUs6LOIdpW/W6+WNGY0aw22nIg58J:sxZ2OqY7/fUs6LfW/bG5tq
TLSH
T11E52F805AA345A77CCDBD20AF9557F53D6F8547392910E48AAFCCA1C00E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 277e2f5e03fd2ec5bc7d2685ef7e58fe0eeb9587bd45efaafa6789a282525dd6
MD5 1b0ed7a29da6437e0843dcedacbc403d
SHA1 99eb7df6a7ca74edb37bd04a14951f70a3850c54
SHA512 d5b09c4eb5cc2caed68fed465dd80ab79aa2556f6c907d7c5f60d05ace1c2266bd53112691ffe3d9b157686a94d0b9b9f668ddf04a84d6bddecafc8dfa7a1024
SSDEEP 192:sxZ2RcyM/jK1Ml8Mo7/fUsCeOIdpM/W6+WNGY0aq96nIgrJ:sxZ2OQ7/fUsCefM/bG5U9
TLSH
T15E42F801AB346977CCDBD209FA557F53D6F9557292900E48AAFCCA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 a020b24511bb2597719a1929fcd1583d541c04bd1b106494bcbf05ede0d94fc4
MD5 0d8614c78c4b376f209538a78c185d36
SHA1 2742777cecf50dc481110d72cdcb47d221730c38
SHA512 b942663523b1f42bfabe41e4aa22786c754c8f87e7b382380594afdaf19327f9e91d1aba6c6958df293c0931a15d1d2c0ad160367f9f059ffd9c4d268bf697da
SSDEEP 768:Ta/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VO8roAV:Ta/zh8dF2PkWRmEcQXwu1jaKWjLp2tVb
TLSH
T194E20A2F280CCB7E4F844E9CEC266F976EE801CB66684D5447FA494C03C77DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 099342fc92f32bbc542e26dcb0f0b1f712bf8dd7e6b54060daee7d9b20a9181d
MD5 3a38412c0174360218674dc16e336627
SHA1 07a261dafc5b3c372bb01fa405c587898b814823
SHA512 73e3ef6a17e1285edd6c0121bc5fc18a384e916c67f4a05792913db60c216e1e42b295ed96289e00fea09a479809832027554fe2b4c1fd8ca8ed51ff38a11721
SSDEEP 96:KEWgKvnxaKqU6iyYKryiKUwKlSl1CXz16:2qdPf/A1CXz16
TLSH
T16CB1024671B712413C7D7A48A26487265B8275B73224B52B7BBD00B20E67E385EFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592f53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592f53.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 34fe5a22709a1aadbc84b463c4c8d324ddeddcbdc739017b524b312e44bf76c2
MD5 f836a1584105b463ee78457a09a3dc1f
SHA1 fee040f7abbae187816e26462fe7b3e616934266
SHA512 4f1d5d38d10f6ad35f8e9ef965f142ad0c6b325de623a6694fe1b1758c23344cf7a1599a8535cc6e5d7687fe407a130e1fed3f2348b07e19a2d71fe926f78916
SSDEEP 384:cZcIH8NhtSyuskHDnsldFuuHo0X1puLifoS:KHGkzslfosyLifR
TLSH
T1C5826C725C745D7B19F2E546F44636074FF89067A6C92F84A4ECAF0D01EEA9C131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a8f0d2f70b62cfb46cbe4e313d3523882e26c10a55cbf0be16a0db7c5183b880
MD5 acd3139ebaf1134d0fa248520afa09cd
SHA1 e35460cd8618164d02a9882cb4925a2e5a01d0d8
SHA512 e184aca466218b8f1397d5460ca2459c78f82e5aa7a3acd9016194f69140daa3aea7665fb905a41ff4991366e216566d69efc162e2086ba693ad999aa278eaec
SSDEEP 384:hZcIH8NhuSyuskHDnsldFuuHo0X1puLifoS:pH3kzslfosyLifR
TLSH
T129826D725C745D7B19F2E546F44636078FF89067A6C92F84A4ECAF0D01EEA9C131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 09ba968a969e7c316867e9b6b22723de9fc7b8228c76611ef3e318e1168ef8d5
MD5 49f0035de1fccf2c01085a3f2e918fe9
SHA1 16ce3e0d4bc72ef502173e1bb067dbbd0a562974
SHA512 6c229e6d4e8434de54d0c888dd1ef6c9db9d6bede3f230f0bb8d34ece4069cb65750c1a04d8e61b4bbc72cff98b977f543f8b5996bf4182cfa2fd8fd4159cac3
SSDEEP 384:+iFsZcIC8Nz8TUNTUlIluSyuskHDnsldFuuMo0X1puLifoS:VF6CSwgQkzslkosyLifR
TLSH
T13DA26C734CA8897B5DF29A45F54A32078FF88067DAC96E84E6DC9E0D01AF59C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c202df24c6714ec02b206def562d642ec22e637979fc62a7c09e8dadfd05083
MD5 9915037e51cfccb1fa13f819f1145c9c
SHA1 2981c0e6fdc8a42273a0c7ffcca3ae757d5117e2
SHA512 4659be1decba24831dfcabb219cf50af7649b6e69cf95d33f33435463c6a5887666fc60f7966dc47711bfc2a3c5900b7e56caf3605a8bb706d994da98dfd00b8
SSDEEP 192:BGNW6P2UOcQmiUykIUqqGv0a+FdFJwS3G/U6:BGNW6eXsHIlqGsldFhkU6
TLSH
T1BB02D9756C786CBB8EB2AE45F48677134FE8216BEA952F84D9E81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f0577c6ec591b6d981ef468da7ee98f593944a842296c35dbe099f680f12dd9
MD5 c2948a5fc1feb4a68275d4a13bc01f1d
SHA1 a982b085403bef160b73a064796ddf9be98c9ee2
SHA512 61a6d94888f0bf944920a748f0dab23a0dabd287149af73f173e414f9c793d818d10274e8f356ddd8b137a61cd0a6cee095441d2691d049ad21f972d004d3972
SSDEEP 192:BGNc6P2UxQmiUylEqRGv0a+FdF/GU9c0BRqZU6:BGNc6e4MVRGsldFuuNoU6
TLSH
T1A2120B36AC786C774EA2A945F48736038FE45167EE893F84E5DC5E0C01EFA5C235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 940a76207cb8f3456ae57d8884e844bf5f1e8f0e2d7e6f29fae4091acc48614f
MD5 fc2973462aff0661ac5cf46e42063bc6
SHA1 5955b944db23b9f21d531551e2f60ae70efac0a9
SHA512 0673b539b7ed0371dd5a355d32ba98db6786d35f69640b616864f54a5e1c2a20ecbc03f8e7ede033275130f05b7e6e2ce16dd13805741083e785c83104107e68
SSDEEP 384:+ZcIH8NhhSyuskHDnsldFuuHo0X1puLifoS:8H2kzslfosyLifR
TLSH
T11A826C725C785D7B19F2D546F44636078FF89067A6C92F84A4ECAF0D01EEA9C131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

196be8f6-cb7a-46c4-b501-97af8c35b15a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\196be8f6-cb7a-46c4-b501-97af8c35b15a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Elektronna_povistka_do_sudu_31.08.2026.IKCJ6S.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Elektronna_povistka_do_sudu_31.08.2026.IKCJ6S.rar:Zone.Identifier
Size 138B
SHA256 7aa0af2c0f715a1ce46d373687193f78554ccd84f582ae456757138e728694ce
MD5 a52f19fbbbe52991ee9f49f93d373e12
SHA1 08dd367faf32f155793e8d32090fc46528605850
SHA512 43a5e61cd59e9b5d5a175a025bde77d86d57e9c6f44e45733316a6ed363cf8cacdf9d301e526df6ddfb115d95715781399bc26f01ec8f83e0b2c257883e9a615
TLSH
T142C02BB3408140040DE652CB31CDF90D308E75038C442B00FC2311E5CCD54EF84AC039
MD5 SHA1 SHA512 TLSH

Submit Download