hxxps://mega[.]nz/file/Wu53SQSS#GDzVmqq55noToHQUyt_jdDTPOWaRnjs_bwvmN5Ahaw0

Analysis

user interaction
yes
max time kernel
184s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/Wu53SQSS#GDzVmqq55noToHQUyt_jdDTPOWaRnjs_bwvmN5Ahaw0
Sample260925-nrtbdavdnb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Project_Lust_Simulator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Project_Lust_Simulator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Project_Lust_Simulator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Project_Lust_Simulator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348099172421167"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{24922D27-BCA4-4F38-94E7-7D2E1FDAEDD6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5928	msedge.exe
5928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	960	7zG.exe
Token: 35	960	7zG.exe
Token: SeSecurityPrivilege	960	7zG.exe
Token: SeSecurityPrivilege	960	7zG.exe
Token: SeRestorePrivilege	5868	7zG.exe
Token: 35	5868	7zG.exe
Token: SeSecurityPrivilege	5868	7zG.exe
Token: SeSecurityPrivilege	5868	7zG.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
960	7zG.exe
5868	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4328	Project_Lust_Simulator.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1804	2000	msedge.exe	85
PID 2000 wrote to memory of 4552	2000	msedge.exe	86
PID 2000 wrote to memory of 1280	2000	msedge.exe	87
PID 2000 wrote to memory of 1280	2000	msedge.exe	87
PID 2000 wrote to memory of 1280	2000	msedge.exe	87
PID 2000 wrote to memory of 760	2000	msedge.exe	88
PID 2000 wrote to memory of 760	2000	msedge.exe	88
PID 2000 wrote to memory of 2408	2000	msedge.exe	89
PID 2000 wrote to memory of 2408	2000	msedge.exe	89
PID 2000 wrote to memory of 2408	2000	msedge.exe	89
PID 2000 wrote to memory of 4336	2000	msedge.exe	90
PID 2000 wrote to memory of 4336	2000	msedge.exe	90
PID 2000 wrote to memory of 4336	2000	msedge.exe	90
PID 2000 wrote to memory of 1104	2000	msedge.exe	92
PID 2000 wrote to memory of 1104	2000	msedge.exe	92
PID 2000 wrote to memory of 1104	2000	msedge.exe	92
PID 2000 wrote to memory of 3804	2000	msedge.exe	93
PID 2000 wrote to memory of 3804	2000	msedge.exe	93
PID 2000 wrote to memory of 3804	2000	msedge.exe	93
PID 2000 wrote to memory of 4980	2000	msedge.exe	100
PID 2000 wrote to memory of 4980	2000	msedge.exe	100
PID 2000 wrote to memory of 3404	2000	msedge.exe	103
PID 2000 wrote to memory of 540	2000	msedge.exe	104
PID 2000 wrote to memory of 3404	2000	msedge.exe	103
PID 2000 wrote to memory of 540	2000	msedge.exe	104
PID 2000 wrote to memory of 5092	2000	msedge.exe	108
PID 2000 wrote to memory of 5016	2000	msedge.exe	109
PID 2000 wrote to memory of 5016	2000	msedge.exe	109
PID 2000 wrote to memory of 2660	2000	msedge.exe	115
PID 2000 wrote to memory of 2252	2000	msedge.exe	116
PID 2000 wrote to memory of 2892	2000	msedge.exe	117
PID 2000 wrote to memory of 5424	2000	msedge.exe	121
PID 2000 wrote to memory of 5432	2000	msedge.exe	122
PID 2000 wrote to memory of 5424	2000	msedge.exe	121
PID 2000 wrote to memory of 5432	2000	msedge.exe	122
PID 2000 wrote to memory of 5432	2000	msedge.exe	122
PID 2000 wrote to memory of 5688	2000	msedge.exe	124
PID 2000 wrote to memory of 2060	2000	msedge.exe	129
PID 2000 wrote to memory of 2060	2000	msedge.exe	129
PID 2000 wrote to memory of 5928	2000	msedge.exe	134
PID 4328 wrote to memory of 5736	4328	Project_Lust_Simulator.exe	140
PID 2000 wrote to memory of 3528	2000	msedge.exe	144
PID 2000 wrote to memory of 996	2000	msedge.exe	143
PID 2000 wrote to memory of 3528	2000	msedge.exe	144
PID 2000 wrote to memory of 996	2000	msedge.exe	143
PID 2000 wrote to memory of 4108	2000	msedge.exe	145
PID 2000 wrote to memory of 4108	2000	msedge.exe	145
PID 5736 wrote to memory of 5668	5736	UnityCrashHandler64.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/Wu53SQSS#GDzVmqq55noToHQUyt_jdDTPOWaRnjs_bwvmN5Ahaw0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fff5d40c188,0x7fff5d40c194,0x7fff5d40c1a0
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,207574335166527160,17475999086117369609,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,14517052164287221859,15642856926710709699,262144 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,6252013960431009715,3410599177277903666,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,9640083223127818199,8730248210231257632,2097152 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14317818749441077692,992832349692576949,2097152 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,13233379423688451284,2594209004630017445,2097152 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4167906812697324459,1296837974118400955,2097152 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6793649473099204948,10830266369256732833,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,9076971925052499788,17086289271164827599,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,17261635754715223957,2549620198196154619,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7972122973903218330,1177830222249596986,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7972122973903218330,1177830222249596986,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,2966231735593547771,12664120588612016482,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,18299867253826070051,10286940940989180848,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,16757150663896402547,4484040667921913090,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,9140536865945902065,1572722630654137109,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,18398889781595052366,4148165199857961053,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5352,i,7675340420213482040,7769449725709332805,2097152 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,1077818420703068593,8082355869345809074,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,4809686067061606154,10307828829929774951,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,15042562375562984447,11827418544105642771,262144 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,18167354014252529351,16370498683122514400,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,274614111349659701,7059275696123595733,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,18200623442285868348,8706331081371500455,524288 --field-trial-handle=2248,i,12857191845679173293,8811491007011330164,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5356

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap5836:124:7zEvent31899
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:960

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap27687:124:7zEvent19773
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5868

C:\Users\Admin\Downloads\RJ01436394_V1.10\RJ01436394_v1.10\聖職者とカクテル-ver1.10\Project_Lust_Simulator.exe
"C:\Users\Admin\Downloads\RJ01436394_V1.10\RJ01436394_v1.10\聖職者とカクテル-ver1.10\Project_Lust_Simulator.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\Downloads\RJ01436394_V1.10\RJ01436394_v1.10\聖職者とカクテル-ver1.10\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\RJ01436394_V1.10\RJ01436394_v1.10\聖職者とカクテル-ver1.10\UnityCrashHandler64.exe" --attach 4328 1842457546752
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Users\Admin\Downloads\RJ01436394_V1.10\RJ01436394_v1.10\聖職者とカクテル-ver1.10\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\RJ01436394_V1.10\RJ01436394_v1.10\聖職者とカクテル-ver1.10\UnityCrashHandler64.exe" "4328" "1842457546752"
    3⤵
    PID:5668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3e4 0x2f4
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\LocalLow\DefaultCompany\Project_Lust_Simulator\Unity\local.765fb682a3ca11c4ca53ec2afb75c784\Analytics\ArchivedEvents\179033648800002.f2ffdefe\c
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\DefaultCompany\Project_Lust_Simulator\Unity\local.765fb682a3ca11c4ca53ec2afb75c784\Analytics\ArchivedEvents\179033648800002.f2ffdefe\s
Size 464B
SHA256 bcc55ba928f630a0a821ee54a6515fd59dad5dd5651bbd445a5c28c9625a3eff
MD5 3640f9933371288565aee87e9ff70f56
SHA1 b4c3d707ce382a64540ff9a7c805263aa6354534
SHA512 ce24410286fc6c8a4137fa765ac3809a4cce48d958c51049900e34828b9221ad483b91cb836b370209a96e83302d096357b5aeba6be909adc1cff456ad5cbb48
TLSH
T18DF0DC33621EA93E2DAA555F253D103119363090790CD9FF87F8B88C55EBA0A93038B9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 291B
SHA256 5587d547226c7cea5c1c2119cc964bc0501b9160b5577767d91940180002ca77
MD5 f5688e7d20822c5bdd61da5bc0c86fd4
SHA1 f8df33ae484d23046a701ed4546f5edb30fcee0c
SHA512 d4262e072f3bd2c7971ef8794be0262697f800f89528829772bf518a59198bd1b554d538fb7e57c59c78a2313af443ea3d5b783866d3e6a6a2154e46730e96e3
TLSH
T1E2D0C28984C1C26A5341A5EB8128970EC698234BDBC9BF0E0B08C8487087888E997AA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 097823a4cf377327cfec427ac3df848dba825ebe966317fcaf6fe14d99d0dcb1
MD5 1a22da7930ac8b6d81578c977a164f7c
SHA1 de913e9fe451e83f3eff9aebde37dc2aff4b6275
SHA512 128822e82c728c8e1b1279c83cb1941fb1781f1c7d6da53bd660397f8c88c697d185a1864bd9dea2c009fb1891b14951afa89ff108f895bdd28f91b164c1b818
TLSH
T1635154CF97D15450F75A7AB481DD7E8731B759C24A8BBFC22494C9B71807F148826C98
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595431.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595431.TMP
Size 2KB
SHA256 1388989bd0f6bbed83a5f20b962d118d7360127ae353671afa04f028709b53fd
MD5 418d32d738446121cd63281abb314f10
SHA1 19838ac80f03652beb8a54b1f80bdb17cdc74e70
SHA512 6c853a3313c000ccd6762a54684e0b7509eb312c94c0cc1a9fef620c24d8c37bea339ea6968b57af056e0ac30ca00078b7f34f5ce254d1a601c19c846feff13e
TLSH
T12C5174CF87D24490F75A7AB481EC7E8B31B759C24A8BBFC12484C9B71807F048821C98
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\00\00000000
Size 4.5MB
SHA256 2ecea1c96ec78ce333facdd90ccb2e0a5b16ca39d34892c71a3000898952bd80
MD5 ac26fdbb0dfc0e3fd063dadbeb8372cd
SHA1 ef87fc9f57cefc955a10525cc97a08e0161f9310
SHA512 9a784ef7a3281eecd563cc9a34ae664f5bf8ebe4e78e69c7fa4bbbfe135a9940fc9d2bfbe2af2fc684f225b82642162f98efb8dd7a88ea56093b8baae6ffd11c
SSDEEP 98304:cf7e1IDkv1GWkhm+4SIGzjvFt0KThAicK9OqkKaiMXWUw+jB3p:23DkMWk4tSN3vFnThAiXsLiMGB+d5
TLSH
T1DD2633BC944225EF529D13F2E271185479CE3607BAC3BE8B579BB70876508F84A9039F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log
Size 22KB
SHA256 2dcab42d60364957b56f6a390c3c92dfa012e097b6ea2b89680e18e72bbafc95
MD5 dd30322a62bf4f49715d4970e17ecdcd
SHA1 35179d6b3c929bc54bae03a614e2fbc8cf7f16ac
SHA512 88209faa5e58330f24c91a4684d4afe87ba3612bc0c637cba9096afca7d6766786b8d4847cdc1a68db8ae33af2e2c2dd7021082bad70844394b52d77b1a4b173
SSDEEP 384:+Bx/xzNA3RGfIOURGfeeRGfCRGf88RGf2RGfCHRGfIRGfA+RGfA:+Bx/xzNA3swOUsmes6s08sus6Hsws4+F
TLSH
T191A20CFEF8609D11EB144C3135336E1261B2CDA4B48CBD8DF285BAF9417C6AAC79117A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 f91392dc5a5d1cdf2e80b38ebf98f5b178346ccf4fef42b8199869e4a0665adb
MD5 7e5dc0bbae7ef038a07982a607ad66f3
SHA1 b5253f51c7e514ddb2e757b055b19702699662c7
SHA512 be419186a3b366a475fb1d7d5b67e52545471a19e9c2be8f5b3ed469431215c4f34236fd08a8050f415195c8edd7309d33ea3200812a4b649b484c2b95f26832
TLSH
T18CE0226881CEC29F76462153812CBF8C9BA7778FE78E7E812B40C810B882864A56B552
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 595550a01d692058f59152abff2c01906f63412c0af84720425aace9822dcf9b
MD5 aa829d9533a101ac8f58fcc7514db08e
SHA1 fd62c4655d66ec49f581f7a22ef5848f31eafc63
SHA512 e784022f2bcb92eb81b90abf03257cb454d520fe5f348d05226a8df7454473c09f3662230e2f2e679368c90be9f59f30d3cbfef7bef3d40ca29eea4bd30addc4
TLSH
T1E3E0926884CDC25F76552573C12CBF8CDBA7778FD78D7E812B40C868B4C2054A6AB953
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 667c3c4e2894ecef514527799855322fb72d620067111499e8b097e330fff4ad
MD5 81c89b74586ccbfce582a4c77bb5bae3
SHA1 5ed63fb1cea57749b0ebd09281df3c06c90a8f8b
SHA512 25ed6ec8326a16548a18becbb718ff8edd506ed3847eef072e03e30d996bbb2a86de571f2082bb817f12abbf7283d518ca14ea576a90eebff550070383b966a1
TLSH
T115E022A880CDC26F73442257C579BF8CDBA3374BE78D7E816B49C891B442254A16B6A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 f88220c9dd3aabe685f577bb7dac9b7007bbe9911ed639ede0d0fbf800182ed6
MD5 6795045e8ccf7ea541cbcae061c376cd
SHA1 ffce769e0461dd765efa5b679f2f468158a34597
SHA512 de5ba85748ea19f061ad26203913c804bfb93d488471b60ffa79dc8803c55c22a06e15ca77f215065ca373ec27a6d45ffdd8c825c9e4fbf9b1c24299f902b9bd
TLSH
T128E0926884CEC25FA2142257C12CFF8CDBA33B8BD78D7F812B44C874B483058A66B751
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG
Size 375B
SHA256 53bf48da677f120fb6229a6dca949101baafb501ca1ed3df2720471f72561a9c
MD5 4e6ac5d904bd0eafee6ef49ed7d049ec
SHA1 60f653ed26d794c6c88b7d42a22d31ded872e45f
SHA512 f7e12547cf272e9e020ab81899e6f2e4b89c15ecf559c43930e718f73e2cc3ecc1d689e5fb1b9c31a57f291dabd83fae0736bf9c94a28559b6a9bfa623a31d2b
TLSH
T145E0226880CDC2DFB6452153822CBF889BA3776FD78C7E912B44C820B481144A66A663
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 335B
SHA256 785cdcf09baac1b1050fa7ef6b170fcd61f093d6f0998a664a34e2b00636af72
MD5 7446d3af8bb0a1aa94385f2a6b376c82
SHA1 083b227e6fb08118a70e33845f133ff8063c2a6d
SHA512 0506060cf48b11f01e340219ae9009f11411f13e82e1e4c8a99aa09e741bacf63c38c101a8b38d1ef2852836ab086cdc7b5ac7b4c33f02bebae8fad76cc6cbbf
TLSH
T160E02024C4C9C25F735651D39528FF4CDA9B668FD7897E851F80D8147483048E06F5D3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 375B
SHA256 403e56f8668e8b7b46cf348182898ae4fd0ab52d550b5876f241efd63897f541
MD5 4c8ba6459f3acceb5221d402d3c6bbc6
SHA1 399259f3e91146d62e1a0eb1ce734fa05d82f361
SHA512 06b6bfb4facb538d3187966f5d589d49a3c529b4e37ca420bc5a5832ec116291d42655bf9b4e8d4d6681ed0465820fe97fc97d6ba47372125355f02073a1eb0e
TLSH
T1D6E0226890CDC27F66A52157812CBF889BA7B7CFD78C7E812B40C820B882044A36B552
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ba03352d57270b974473aa4aa97ab13180af2ac1ffc3ac183ca4ecf1f1b40c11
MD5 bdd94d91406ffe867e3c9a8338422236
SHA1 17b55a91b2493f44fee36064b650e6b32100eeae
SHA512 b8cfc1d61c6e88493558a1b1f1b13261fe5deb0c0572fdd2cc396d4c5414ff86d0f2ce9ed3664b515619c8b67fc98caf378358ac73179c111388711e20f8cf94
TLSH
T1D0318DF783B185AEDA1156F09A04AE2BCE5C0116539C3C5986D4AF1793F3471E112A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a8b793f07d0416f28a3b5bfdbcdef3bb2dad731f0dfa5282cde50b765d4d8ad9
MD5 8b5f66ef0acec2f91fa92d2e3455d6ff
SHA1 8ded4d286587c1747074c4fb6d414a3ab9bb2080
SHA512 a0a99f30c1c9b5023fc66d9563f33545fa75b4c0ebe4596716d8f55c8c2425e6548269c31bf147df182ded373879f67d74c961acc761644fd29fda4777993e92
SSDEEP 192:sxZTRmncr/f3sLhMIdpp6HW6+WNQet/Y36ygqfIg55J:sxZTycr/f3sLhVsHb//XcN
TLSH
T1EC32D8566E28693B8CCBE20DBA15BF53E6FE407251D01E58AAFC861C05F66DD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f29e914c7c4576d063ec0c9628e33ebeb37af1680e8db422158e833fcecb0936
MD5 4e4f2b16b3019461702edb356bf06abf
SHA1 32175240df416b904f120e4167017289d8c1ff5d
SHA512 eeeb719f89cb049f2754009e4ba50885de974e01d28a8c67d9e4d68309aab0c8d27f334d0f57da8ff201cff9e86e69f8ebc10df282e74cdcb6d312b712d41813
SSDEEP 192:sxZTRmWcr/f3schMIdpL6HW6+WNQet/Y366qfIgrJ:sxZTPcr/f3schV+Hb//X39
TLSH
T1B922C8566E28A53F8CCBE20DBA29BF53D6FE507251D01E58EAFD861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 718ac0a7b12d4b349e83ca1c61d15e776985a6ba87d6985a706065e270e0c855
MD5 7488729e5b61046be8f69b892214cd93
SHA1 9b187e6f4d7122fc3b32c8fd32239fd6a9a77e0a
SHA512 14ba302286eef092670f2cbcb6e66635f72d349673cf0007ccd8c38ea4e9cc0c5950246161326ed3b467090590b879d7f5e9c7ab7c75fbc71c1c5b2c4521c300
SSDEEP 192:sxZTRmWcr/f3skhMIdpL6HW6+WNQet/Y366qfIg5bJ:sxZTPcr/f3skhV+Hb//X3L
TLSH
T17C22C8566E28A93F8CCBE20DBA25BF53D6FE507251D01E58EAFC861C04E66DD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c5480d613eb2b56e16fc12778a65090f1a07f9a0f02433f00a4977d5292a12e7
MD5 35fc6ab45c831398c1536b03ef390518
SHA1 c01af8efe1e091cf0b8d069ef6fe8f56782a88b1
SHA512 6dd43a8628db85f4bfcca9f3128eafc531b6e335f409d97015bb5496d0df0b4c4bb87ad993bda089bb255e63eb6a84f13674b0cf27ccd273b878540a3ff375d6
SSDEEP 192:sxZTRmWcr/f3sLhMIdpL6HW6+WNQet/Y36KqfIg55J:sxZTPcr/f3sLhV+Hb//XnN
TLSH
T17522D8566E28A93F8CCBE20DBA15BF53E6FE407251900E58FAFC861C05E66CD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5c60bed58f74dd2d27f96b57ce6b42bfd1d0fadd8910ea7d50bd0fc1474edf7b
MD5 6a00c670646b074931c03ef1d27dfd61
SHA1 ba884d9caba3f13dcffbb4fc4f3544f7e9ab1d67
SHA512 e2d77b70c6af50d27c416fe5b94ff318292b852d6e6971c1fe5fe787795d113cdff63ba34ccec9546a4b6cc4d54530436759993f03d402829b6556d48fbf966b
SSDEEP 768:TDKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Arobi:TDKlm7QWvUYe0u1ja8/L/E/Lbi
TLSH
T168C20A3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4087FA984C02C77EA51274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 9KB
SHA256 1b071a438abb990123bab5537cf27aa72795ea474aa5490682fee4c4fffac1ee
MD5 bc671c4b113a9aa8a61a1337e491809a
SHA1 f201925adf8f8d8a2a12f5a1dcbad3c587db7092
SHA512 569fac18ab22a946e1e3af413de087dcb9d32331602d3229887ace09338148fba4f92efab5c0da437e1b74dd4ee5c31110459e044d6f44306b4f989450310337
SSDEEP 192:xlWh3gi6qTDy45eyHLhq/c1pnKA8LnsQkZ9d7g6i6Ixobv:alJKAknsQy3iEbv
TLSH
T118124C4EABB5303386236A36CB9BF0123E37510B2456B909BCCF53685FC437187A9764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 4KB
SHA256 aaceebada2e6fe15aa38c6d555d253289b4c18fa8c32180257f8d68143d27c08
MD5 2f443e7d9b5072b5b1b2da8966b8a935
SHA1 f64da436361b05022fb83154e02d8bc6a6a26357
SHA512 9c909b381ec2a054ca0ed846dec24514e4cfdd01335340316e9a33e3c9a027ec7fe7c2b784471ace531a00a64c0cd8d3d2155cbe75fc19318a957bf55cc51dc1
SSDEEP 48:xEJFB0ZRG72XCB7HAOEQxHvmk2K6PuNGS5ZDiDwI9d5MZmEg7iDHj6XUFRYY4SfT:xEB0ZSsdK67Tw5Hj6SnErSWWxS2jLY0
TLSH
T1D6A1946183A13927CE2703FF95A6452633B548093FC3C35A649263645C323F75B9AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a56380176488d340137e281b351055736675b73c48dc1b3c030ccedbd0173156
MD5 21ea5807294b1bc814e4dff6b689587b
SHA1 824adc8cf3f1cbe947d47ff25680b891506050b0
SHA512 b5e0e96d13aed49d006f817eebfbc6bfcf7f9c0758aca9475143e4bd6da303fd39cc20f72a808f7eb57f756170e7e243cce4fbc72499563d46559e094f032341
TLSH
T141A00221195590B5CD110270D6734A98227488190625235151E901A48E91554C25203C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595663.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595663.TMP
Size 48B
SHA256 2664e93f46c5e005213906bb1bbc27506b1df981adeb20d055877585f0fd5aad
MD5 48953a18eca37e7a21af3ecdd1bb5bae
SHA1 6431b2133ebe5d49da600f8f3ccdf790012c2908
SHA512 f7297bbd8a56cb8735169f1602674469d765ec51eed92f8d4ec08db808602ec950a30188b9f4daacd9daa95b0126565be8c77e07b0156af645b442cff8d5912e
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e49a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e49a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 12fb2fbd9e6022ff51c6633cc511ba1d22f272e9db3a28c9fb8c5dea39dd0f00
MD5 cab98d5f12a0d0264a30e80692c3497e
SHA1 c18fdd2d715cb30df0de5a5637f0dbc2e1d86f42
SHA512 f6919b4c112cc68554bf40b991b077add645485dcdb6a90b51c964efb85735a490994bd6065adf08ee5094f9de25f5dff8efbbb7ff884ed752c949d33d6f4978
SSDEEP 384:KiFiZcIbYsN18TUNTUlIlxfHibEK+h//RjV2AtgOIwZOy9noB:BFQcMwgnGe/H2AXskm
TLSH
T109C229F648E7883AD9AE9743A77E2D028EBCC057B5859A50B7D85A1DCC960BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9586a2d3596cf436d5cfdc26b6b8784ea31e337ce617e3311e3a1c03f701777b
MD5 7cc187680bc14bfc84026b97d7b8461a
SHA1 9a7b56f4297e58a6f2948c8938c4bd1dda616ff8
SHA512 d91b5051136d1b8da64803c12e367f4aeac200c9984bcd948d10d44499071bda841463a127f708d6ab49be14fc5a7f70a18ed08939929036e8b6e6fbeec006d0
SSDEEP 96:KqONkWQsjpfbUmjH5ih/cIPURHl8h4otop5waD2BKP4v+Y1xf//ojduxfP7wFBCE:BONu6JUm0QmiUypmso//F7+BCB4U6
TLSH
T16702E939AC787C7B9EF3AE45B48777239FA4117BA6951F40DAE82E1D01D715C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 306e0e3b571ae86257f75f00f19997a76a64763655b1d0636a3662b86dbf763d
MD5 4f61ed717046ccc398ec506272e71e72
SHA1 a78563ea73c1989a89b14c0805df080ba6d30b06
SHA512 4ff58e885c7c57dc5aeb8bbf9a8166fa49d5fa31c576c8321eb14af5244e5cc45ddb8386291bfa2d73241799cf802221b24cb3d2dc60d53def3b0179b37bb40a
SSDEEP 384:XZcIhsNrUfHibKK+h//RjP2AtgOIwZOy9noB:fhzoe/t2AXskm
TLSH
T1E3828E3698B85C7B5DFBE240B48736135FB8806B97C9AF80D5EDAB1D00D71A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8ed5911b1cce2543ae41424dd2faa5a4a7cf93f900ec8415bca1664329446964
MD5 f8fb1fdcf8ea8fba74631886528f5c77
SHA1 13c191517ea44e198f53a5cc6ac834bbc750d16e
SHA512 3d57b4b633a6cedd63b148a1520e0fe9025918fe015921607e63dbba1430a6a1a97769e674b8edf5ff9305f933a8961ffb9f682f610eb067c0b4d8d62a97752a
SSDEEP 384:PZcIhsNrxfHibKK+h//RjP2AtgOIwZOy9noB:Hhkoe/t2AXskm
TLSH
T155828E3698B85C7B5DFBE240B48736135FB4806B97C96F80D5EDAB1D00D71A8130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 86ae7660feffbafc17232b37dd696c47356ae505dba25b812707c092370a465f
MD5 0257af2995fe04f37b62055f76c78c2d
SHA1 6b4e86526ea51c46c8f2d9d4b3f268152c264417
SHA512 892f74f4d3653d7cd73474144f17be6e277dc99a4344cb02d88dc17a72512a7bb6dea06f48f5762ceab110f0b9e545e7a97733335f8b116154f70a37b6e3381e
SSDEEP 192:BONW6JUsQmiUyFm6o//F7jfezcNx2S/fU6:BONW6+8L6o//Rjz2AU6
TLSH
T133120A35A8B8AC7F5EE39950F08336239EA44267D7C96F90D9DD6E2D01DB19C131B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1b80dc557448d01370b43e38f288008a10e1f6a13858f0c02c5ceb4fb0935440
MD5 48030c1b49255d55260f7449c348c668
SHA1 5b758f72ad5e8d1108b5e9e3ea647f5d964ef567
SHA512 589881d0f2222a7eeaa4efafe481fbf5ac68c31804079ed1e0f24429be8c1e2eaf3fc8e61ed89302cde10ab6295d0a9000c6d947ae8682f8aa73ef293ed1a938
SSDEEP 384:KiFHZcIbYsN18TUNTUlIllfHibEK+h//RjM2AtgOIwZOy9noB:BFvcMwg3Ge/u2AXskm
TLSH
T1AAC229F648E7883AD9AE9743A77E2D028EBCC057B5859A50B3D85A1DCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09b75b54-d2eb-41c7-8da7-6fd88b2baaee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\09b75b54-d2eb-41c7-8da7-6fd88b2baaee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5843d1339b13a4df1932afa381df6c1f371bc34310d29939ff4b375a963e6500
MD5 2814004baace6ea64ebd278645a44393
SHA1 6faeeca21ad1bd2728c906c1ac33125fcb7c9c83
SHA512 3d97050382b16c0197aaf309227eb002ae26426948bda9beda6c75282a085e4138e1dd46d07f4c7615faf55e4efe52bf121bc3cf647fb55095d2ac9d1dba3f1f
TLSH
T12041D85CB6EA1148B3B76F569BF7A86D487F79772E0BD45E10010D4E0A22B00D8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4328-749-0x000001ACFB1D0000-0x000001ACFB2F5000-memory.dmp

Download

memory/4328-768-0x000001ACFB1D0000-0x000001ACFB2F5000-memory.dmp

Download