hxxps://mega[.]nz/file/9qwVCQqL#zCp5TlsFwzDzm_ieXWCYoebellCktFjcj9QqKXu9Jqw

Analysis

max time kernel
899s
max time network
736s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/9qwVCQqL#zCp5TlsFwzDzm_ieXWCYoebellCktFjcj9QqKXu9Jqw
Sample260925-vtc6hasalg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5032	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{8A2386DF-8D97-49A5-8642-56568E86FD6C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2792	1220	msedge.exe	87
PID 1220 wrote to memory of 5032	1220	msedge.exe	88
PID 1220 wrote to memory of 4064	1220	msedge.exe	89
PID 1220 wrote to memory of 4064	1220	msedge.exe	89
PID 1220 wrote to memory of 4064	1220	msedge.exe	89
PID 1220 wrote to memory of 3848	1220	msedge.exe	90
PID 1220 wrote to memory of 3848	1220	msedge.exe	90
PID 1220 wrote to memory of 1556	1220	msedge.exe	91
PID 1220 wrote to memory of 1556	1220	msedge.exe	91
PID 1220 wrote to memory of 1556	1220	msedge.exe	91
PID 1220 wrote to memory of 5044	1220	msedge.exe	92
PID 1220 wrote to memory of 5044	1220	msedge.exe	92
PID 1220 wrote to memory of 5044	1220	msedge.exe	92
PID 1220 wrote to memory of 604	1220	msedge.exe	94
PID 1220 wrote to memory of 4344	1220	msedge.exe	95
PID 1220 wrote to memory of 604	1220	msedge.exe	94
PID 1220 wrote to memory of 604	1220	msedge.exe	94
PID 1220 wrote to memory of 4344	1220	msedge.exe	95
PID 1220 wrote to memory of 4344	1220	msedge.exe	95
PID 1220 wrote to memory of 4300	1220	msedge.exe	100
PID 1220 wrote to memory of 4300	1220	msedge.exe	100
PID 1220 wrote to memory of 1416	1220	msedge.exe	101
PID 1220 wrote to memory of 1416	1220	msedge.exe	101
PID 1220 wrote to memory of 4612	1220	msedge.exe	102
PID 1220 wrote to memory of 4612	1220	msedge.exe	102
PID 1220 wrote to memory of 3140	1220	msedge.exe	106
PID 1220 wrote to memory of 2692	1220	msedge.exe	116
PID 1220 wrote to memory of 2900	1220	msedge.exe	117
PID 1220 wrote to memory of 3228	1220	msedge.exe	118
PID 1220 wrote to memory of 1620	1220	msedge.exe	121
PID 1220 wrote to memory of 1620	1220	msedge.exe	121
PID 1220 wrote to memory of 4316	1220	msedge.exe	123
PID 1220 wrote to memory of 1852	1220	msedge.exe	124
PID 1220 wrote to memory of 1852	1220	msedge.exe	124
PID 1220 wrote to memory of 3136	1220	msedge.exe	125
PID 1220 wrote to memory of 3136	1220	msedge.exe	125
PID 1220 wrote to memory of 3212	1220	msedge.exe	126
PID 1220 wrote to memory of 3212	1220	msedge.exe	126
PID 1220 wrote to memory of 3776	1220	msedge.exe	127
PID 1220 wrote to memory of 3776	1220	msedge.exe	127
PID 1220 wrote to memory of 1960	1220	msedge.exe	128
PID 1220 wrote to memory of 1960	1220	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/9qwVCQqL#zCp5TlsFwzDzm_ieXWCYoebellCktFjcj9QqKXu9Jqw
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb8753c188,0x7ffb8753c194,0x7ffb8753c1a0
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6200481049128194768,1962768065133069899,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,15774389360684360939,11639012854243183293,262144 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,15957595176184613567,8695846558100099151,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,4186630841388494304,6625384849427470698,2097152 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,12620157488855704510,4862083392476809286,2097152 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,7331543025752376879,10357620464549056345,2097152 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,6398701502197897885,3824077391774071203,2097152 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,5097432718679355596,10191073095154949396,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5653425778812544848,12511842255454850449,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7400662724908050812,1835571570427733642,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,16752908738010730054,9500813006115854794,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,16752908738010730054,9500813006115854794,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,17174350896379657522,16169607100560341329,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,11977000773524933979,13778444383887193135,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,12132224971318004258,13879063786653437974,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,18174434461712361432,15561746934982940674,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4212,i,5856978299496302243,8586154477438061822,262144 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16952700745181499965,747517251804984823,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,9919105556523213033,704722179504731397,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8247667466034064378,9957052270254019268,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,17411323554538972212,10212192354258921707,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,6829504479128286906,16017550614405292358,524288 --field-trial-handle=2144,i,201912456742629547,7865786017387678583,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 196cb44f8a3369daed1884eab25efc1c7e61d68a0b954b4f70d6182c7067db23
MD5 2aa0dcb28bbeb541b0bb38007e835f3f
SHA1 0ba19cb08d5f542ff6df3f8c470aaa5fae9f7674
SHA512 88eb5637d72d59e6bafea896fc47d9d221406115cd2d26ef6715e8aacd4c2c0b937be3c9cbc3d22e41a959031e2bdaf5e3bc55599c8eb110ea39dea373c5b070
TLSH
T19DE020D854C5C75DB700644B525D6B4C93D03B0BA3CC6E852B0489C97543450E681BD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 300e38d3fdb37009bc13d23bf124d84106e656d03d0d1407f37708337fbfbdaf
MD5 7d0b57a26ae24cd3b4522387e26e46db
SHA1 84a1d25910b208b9f8ac7f0d45458127b7b8de39
SHA512 791f2750cd0e2eee28320061234822be999df533985c3473992b17b59306a062247fe8cc5ecda755c5b8a060312759bbfab80a2577f04a4d065cff3ee0074acb
TLSH
T13BE020C815C4C26D57107887537C670C8390370AE3CC6F563704C9497442A857AD1B61
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 506962bd4d41a1740829c8a88945f9172e43d305399a21136b1af05b5d7ac4b8
MD5 2fcc9f1857ff046043e39f8732ddce49
SHA1 0cf15317cf2f3b7d7bac0da3a41a7dd81dab74f8
SHA512 9ede48f79554744f103d0d624ab62b3ed6ddeeb6a7d171f811b43964fc33b37fe7867c3d2697954a0b91b27b382ea41e0b7943d4cbcd1cb707d0a122aecc50b2
TLSH
T199E078C908C5C21D7751644B836C574C83913B0AE6CC6E4537048CC9744114076C7953
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2246ce7e78fcfb3499a560a79c8db0a4abd5e227f77557d1cbfbf2aa0f3f5f90
MD5 6d7153293ac71263a474ece388fd4c76
SHA1 f3bdea05d04e6f90571effbf2586a0d76499295a
SHA512 f0bb4259feeaad219562ea7848bdfe2ea58e6395d5fd21aabaf0c6308080ada8d418963e423e2cfdbdd4ba0157e06a6acaf651c02adb96781f6d42137862b198
TLSH
T1AE512AB1F6ED74C4FB9C943997E401933F34B6C19AB32E5A1EE4DBB549CA70D800029A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c10300de6c131244567ccbc08fff78ea651d4872e1c4bd3f3cda5734ed1fbc7e
MD5 867d414a178710b6dc640f0a911c9b0d
SHA1 ca620551306e9b6b92c9ad1dfbd721f85de4cc07
SHA512 a293cb6a355fa8a18280697ab300a6b225d1eb08647bb4cd4a11e5b29cc0065389a90894ec910ceaacb73fd15398878a5712a5ae0b5c4ab2750f5e401b7930e8
TLSH
T1F531ABF783B185AEDE1156F0AA14AE2BCE5C0106439C3C5A8AD4AF57A3F3471E101E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fd6117eda4f79c1eee38244b46645727d806ebd6e13c26a58bfd625603c6303b
MD5 9e893d6b3271d0e6b51343500dea706d
SHA1 e083544dccd380ffb39fa25e5d219e4b57448950
SHA512 29cecb33bcb1fab9ee6553d41b2b10f40fb260036e9cfc34a90af186f9198376c1a0e85910054fe8c3676597c5e8f8d773a6c51674af6dfde592d0f8eedc4aae
TLSH
T1F6319BF783B185AEDA1156F0AA04AE2BCE5C0116439C7C6A86D4EF5793F3071E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bd281f0a76b288eb5f1aec2941dcc667fbabfbcc32bd6591f151446fd4911f4b
MD5 676a5efef0adbfaf63dfb51bd00f3065
SHA1 e832bca33fecd9dd7fdf6fdd17f89467f99a4b5b
SHA512 35589aa37497c0c84d1fb71eaec2b6ebab581d3ac7adba2276b3933bbefc326e84fec7d4d241a5968f89195d46c38d3e8215a71b32e61b8ba2dc975c9b8fddc4
SSDEEP 192:sxZECRTWm/fLs31u6IdpLZwHW6+WNQrQ/Y36RzE7ZIgrJ:sxZECwm/fLsl4yHbL/XK9
TLSH
T1F622B95A6D28A53B4CCBD209BA29BF53D6FE507351D00E98A6FCD61C08E67DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0d19b1cb0fb43ae796e8b9b94cf34eda54cb665cfd91518d41608dd2bd11d268
MD5 42156f066e3df668becee0136fcf3a45
SHA1 b6c5255f20723ed69d27e3fd9672f86d1fba8af8
SHA512 4f4bf58b4c5f870a42fcc1033296ea4f5919a4e694a721494cef415ace8b6ca6b4fbf2477c8c505a3c35729cc21028ddf91370adab8618691acfe757117c538e
SSDEEP 192:sxZECRTWm/fLsh1u6IdpLZwHW6+WNQrQ/Y36jzE7ZIg5jCJ:sxZECwm/fLsL4yHbL/X4U
TLSH
T10F32C85A6D28693B4CCAE209BA19BF53E6FD507351D00E98A6FCD71C09E67CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 7210da2edc792987be0f6287c6f2689037f74ef78223e0edaa49cd055379539b
MD5 6fc557e325324267acc693fe94e46b59
SHA1 6664c6ddcefc4db7e011c5e7de10a16cdf63a848
SHA512 54d008a496a3c10f0f154e2b83080d3e6a6520811ec2f6978d3fb07c16ec3635fc70fe5e478c611201c24a81143ef7ee1fe4eb4c5681b8e77c8ad5af027b0f21
SSDEEP 384:sxZECwm/fLsu66s8qMpRiYnazAW8pZS15posJWeT+u4wHbL/XGnU:sDwm/f34Mnc7WeT+u9Hbz/
TLSH
T120C2E609A924D83B8EC36D18653D7E33E9EC506222C5CEDE5AECCA1C019D1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 edcf505d95860afd44dae290d455f5c8b796de0a2287a59b155ac410affd12b8
MD5 91f08a17324787a3c1bec592d33831ae
SHA1 9aeb72f88ede087a80ee74e9c3cf284d2a8a7b79
SHA512 62f8a6d929fc9125bdfd53ac06b2916afa2d569530103f07ce4a83edab80804fdd3fb791ad28975c47e24c3fe5a70cb0e9b7c566c70ffec117d2a93f338e395d
SSDEEP 192:sxZECRTWm/fLsI1u6IdpLZwHW6+WNQrQ/Y36RzE7ZIg5jQJ:sxZECwm/fLsy4yHbL/XKW
TLSH
T1D122C95A6D28693B4CCAD209BA29BF53E6FE507351D00E98A6FC971C08E67DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 69c6312b4a58fcaebfbb7090ba7c7b90cad9cf5433bd83ee5969d27d0212d332
MD5 feaafa77fe9d84265e29180d1ddca5a7
SHA1 790e2fd5fa270548c275b9c45e37e61bca5e1b5f
SHA512 0a7150f8d3b078f7fa0337ccea56df7f3ab205320e2837ea399ba4de3cc82c903f69df266d729e96255ed14d380e914aaaedd56d1ce7a872f12085eddf24ae02
SSDEEP 768:MOKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/7ro7a:MOKlm7QWvUYe0u1ja8/L/E/I7a
TLSH
T159C2FA3B640CCB7E4FC05A9DDC5A6F972EA802C7A6588D4047FA994C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\be978ca3-e233-468d-9f0c-df4bbf0e10c8\index-dir\the-real-index
Size 144B
SHA256 385fe2e7d930da4df499c57b0b4ef734b85b78ce738c520af5b79bada6a87e26
MD5 b5a401575852d6ec6187dadd77cf0664
SHA1 259e2cc201489e99a27001fa6f71f412fb429ce2
SHA512 b10f734f89ccd1ecff46be21a08b98b7986aeefaf49c423427d0d81dd4c4f2b40c402aebd7780bc7b3fc9edbe1838d3f27b7508e3c292f2b18d10931b334d388
TLSH
T177C01235AE113042F89E893594FF6171597009EE6810061650FCF08CDC216CAD3BEA08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d4ae6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\be978ca3-e233-468d-9f0c-df4bbf0e10c8\index-dir\the-real-index~RFe5d4ae6.TMP
Size 144B
SHA256 dedff37a40445ba050be612f2e6434690c1f555a2c90109bad7bcf34fda46371
MD5 f2a5e2b7cc8a7cf0e7e336cb9bb92d2c
SHA1 19839047ac279fcc97cd4a97a5a68d6d48be197d
SHA512 b8f3e7b3dc9d5a2406bb406e9190496facd59ff196bff15ebf82b53e015eec892a01b380ccd37a31c96debeb35da72d98141ed60ce47d7bbe5dddb86b3a3249a
TLSH
T10FC012349E11A081F45BC67098C753325A208C19D42027A750FDB0949C57A90C747301
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 a5ff1abb34a48ac6abc619b28de915f983c840480d0bb33c4667fe16c91d523f
MD5 c4088168c659cfe590188beb8191b44c
SHA1 f730874d008255497ed0dba652e86a002167477a
SHA512 dc2258d3c21c530d68201158b1a2dc84376ea060b2c9b99dcc5e7095bec90b5bb6e37f31e34e1348a604a7940c8e290c092602474f193720b408b115f75e6ad8
TLSH
T14CE068B73FF26400ECAFE7CA203214A00000B848E418EC0EA02AC99754626196009C27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 664a58d6277dd6b63e867656bcbe79bff1a38dc7b7fe5378e5fee517b1fd48bf
MD5 4af92b69eb986034fadf8fded02dc92e
SHA1 dd4ef731fdd6f9dea0fe4b85ca9c409d34539f21
SHA512 6d6d2f6ced5028e2f8c5b2d73499401f0523171de4b053e81546332206f1d3266573e84da1f573e80109f4142d16d2c8565e1dd8d594821fb1769f10618318a0
TLSH
T138A00258094DE022D45506745577515177645825421512C14492E0ECDED1544526137D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591004.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591004.TMP
Size 48B
SHA256 50efe49be7df55a5ae58c45b23e2af91fa5e4e52ac9db8829e45d1cf7348f57c
MD5 6dcee6b3dfdf6412bac30e6b5e0951e9
SHA1 2f5c0f07361e1c74085cc9e64f92e8a82c78e5ee
SHA512 d65f7a53d9c5960fcbd8eb640a00a04052dbbe0dafd8987ef63ddb72d83951a7abfd44313dedfa313e1583a25357f40e97e48fa074ab4511d714fb0c00868fc7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3191efe2618e2dfbbaab42aa564a9e56add510ef5926937552a044a8215ab8ed
MD5 ba39f41369f3e13b6b97901107d5e4bc
SHA1 837dcef3261fc04ee2a6a5bc3b59820c3ca404da
SHA512 4c41649ba5d972fe4f6b26d06c51de65a5a814cdbddd4741e92d8f3df7cec625b287939da899c54865145decd99e710673bb74537a4c38657509a3c10eb56633
SSDEEP 48:K0wfWaAqefbWt2ISyfK9O1UfxoPYVGuuyLb5bIbVbpbzb3bLbkbb3bSbPISbBbk4:K4fSKcYwKOoKXq8KwKbiS+z
TLSH
T11091FE0171FB0601397D294985B5A62F468231F23069FA3B7FBC50E14E6AE180DFEADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

239430cb-73bb-42c1-9ce8-87a53d59f051.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\239430cb-73bb-42c1-9ce8-87a53d59f051.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9e0f037bfd07160471c565ad68a8720434216ff3614785b2d50db178a78cbe4a
MD5 6be95f31a4e3f8b580a028080e475ec5
SHA1 1d78cad6c59dc0429d43b0fe0c1d0290f5f31340
SHA512 d5ec8c90d59328b93834c9d631caa9f1537f1bbe9f0c1d1cd2e6645633b31c3867dd543ccc3523243ddec3533e53fc20040b22d1b071cf08ea5458a8846e794a
SSDEEP 384:hZcIhsNKgHGbJmth//2wFsRtgOIwZOyrtoT:phMT/jsRXsYk
TLSH
T121826B3668B8AC7B6DFB9144F18737035EB8807797D56B80D5ED9B1D01EB2A8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5c994acba99a13fe7e2f7490021b2312d5be3caae8661e06936d1d82232e5100
MD5 2baa1c4e4a6ac43f03a45f4a9b06d47d
SHA1 17b0bc1f35539c40525106b783f02ea9c4a1c4b2
SHA512 cac6dfbbd1ec52494c134c24967957aa04887fe58d96bb683f1a65b018cf40cc00325204be0a5b30e4e063ef75c379ca935c289b8c30262fe8159065b5553be9
SSDEEP 384:UiFiZcI2zsNS8TUNTUlIlnHGbJzth//2w9sRtgOIwZOyrtoT:vFQGDwgCT/vsRXsYk
TLSH
T137C21AF648D7883AE9AE4743A37E2E034E7CC067B6905A90B7D8461DCC961BFC306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 caca1dd880aee85b98aa4f4f685e265a728422435d258b536f7fef6701860f61
MD5 b49f226498b6636d426be7401241c98b
SHA1 077e91acf56de0a31a8187d38a90024a6f496863
SHA512 de36c29c813ae019b2cf0efeaa1ff70d417f2fbc76a673e51860236755045f4af6ac1a279a001dad859de1b1b17b0d8d18fb5be0ced432443a23b2a0bd1fa9e7
SSDEEP 96:KqONkGQsjpfbUmjH5ih/cIPURHl8h4otop54aDuBKP4v+Y1xf//ojdnx/yw8eBCW:BON+6JUm0QmiUyxOso//aywNBCZ6U6
TLSH
T11102C739BC686C7B9EF3AD45B4477B139FA4107BA6915F84DAD81E1D01D725C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8f3762b01c88f44907084e59fb5e74687c9a60b8ccc8b5e468aa6f9799af98ae
MD5 3c1e6d825f2d88bc489cfa402f034991
SHA1 0e4923d6958194f95f5994dafda1bfadbe7e9495
SHA512 5afca8e1c2ecf83145de0829d7b8079deddc5f17ffb72813723593dfcdb377a3c5f0e79676c27688ac5082f66188304f08851b4fd0560f7b5081ea44a6315f0e
SSDEEP 384:8ZcIhsNKnHGbJmth//2wFsRtgOIwZOyrtoT:qhPT/jsRXsYk
TLSH
T1B8826C3A68B89C7B6DFB9144F18737035EB8807797D56F8095ED9B1D01EB2A8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 07a505b85f58baa0f83b62ac2156fe83c7fb94256a8e15dd76a5688baab5f870
MD5 4ce1415c58f490b608c8cec41d5f6bdc
SHA1 afdca69142950279264e78bf1505d676c05379e3
SHA512 e8a991b0e6a274c2b390de10adc27d0386939c2362acb750bcb1154e40c1cd7841bad94428d29a0e81eca1cff0ea9794fa3c0f14601ba463f3570fca9231780c
SSDEEP 192:BONoE6JU9QmiUyCOvo//aywwWNx+/nRU6:BONz6+78vo//2wksRU6
TLSH
T17012F839B868AC7B5EA3A984B08737139EA44137EB856F84D6DC1B1C05DB25C5307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 76d95c0a2ffc0e85792ffe4824f0050fe3e64bd35840147924e270b0e4d34637
MD5 feb3b2a3418eabc45b6aefeb05cbf0c7
SHA1 80871a8599a977a158e2bac9a3dc25d06698bd25
SHA512 0ee60abfda0c931a48c245ddd78b46dc10c158220a15b4b2c6937153cfa4cbaafd6f6ddeb751a520dcc8c9e0d3e7c9cbf7100b350d610d3805c8586b710d207a
TLSH
T1DB410D5CBAEA1148B3B36E56DBF6A86D487BB9372F06D55E00010E8E4A72B40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download