hxxps://mega[.]nz/file/lyfhqa7a#qjvaesg4jboo3plzyyt9f-4d2zfsqhib9dtracalvy0

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/lyfhqa7a#qjvaesg4jboo3plzyyt9f-4d2zfsqhib9dtracalvy0
Sample260930-sb3mbsvs9p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{F9D1BD9C-211C-4F72-B13A-E21C6333B9E0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 5108	3988	msedge.exe	87
PID 3988 wrote to memory of 2348	3988	msedge.exe	88
PID 3988 wrote to memory of 3804	3988	msedge.exe	89
PID 3988 wrote to memory of 3804	3988	msedge.exe	89
PID 3988 wrote to memory of 3804	3988	msedge.exe	89
PID 3988 wrote to memory of 560	3988	msedge.exe	90
PID 3988 wrote to memory of 560	3988	msedge.exe	90
PID 3988 wrote to memory of 1636	3988	msedge.exe	91
PID 3988 wrote to memory of 1636	3988	msedge.exe	91
PID 3988 wrote to memory of 1636	3988	msedge.exe	91
PID 3988 wrote to memory of 1616	3988	msedge.exe	92
PID 3988 wrote to memory of 1616	3988	msedge.exe	92
PID 3988 wrote to memory of 1616	3988	msedge.exe	92
PID 3988 wrote to memory of 2736	3988	msedge.exe	93
PID 3988 wrote to memory of 2592	3988	msedge.exe	94
PID 3988 wrote to memory of 2736	3988	msedge.exe	93
PID 3988 wrote to memory of 2736	3988	msedge.exe	93
PID 3988 wrote to memory of 2592	3988	msedge.exe	94
PID 3988 wrote to memory of 2592	3988	msedge.exe	94
PID 3988 wrote to memory of 2188	3988	msedge.exe	100
PID 3988 wrote to memory of 2188	3988	msedge.exe	100
PID 3988 wrote to memory of 1072	3988	msedge.exe	103
PID 3988 wrote to memory of 1616	3988	msedge.exe	104
PID 3988 wrote to memory of 1072	3988	msedge.exe	103
PID 3988 wrote to memory of 1616	3988	msedge.exe	104
PID 3988 wrote to memory of 3152	3988	msedge.exe	106
PID 3988 wrote to memory of 700	3988	msedge.exe	114
PID 3988 wrote to memory of 1084	3988	msedge.exe	115
PID 3988 wrote to memory of 456	3988	msedge.exe	116
PID 3988 wrote to memory of 3124	3988	msedge.exe	125
PID 3988 wrote to memory of 3124	3988	msedge.exe	125
PID 3988 wrote to memory of 2008	3988	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/lyfhqa7a#qjvaesg4jboo3plzyyt9f-4d2zfsqhib9dtracalvy0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa7632c188,0x7ffa7632c194,0x7ffa7632c1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,4425386608591736848,16670999812587011852,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,2829505051356891172,14895833407330335578,262144 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,10831187753206301621,10889628951276160923,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9162332805298524115,2755828738723109631,2097152 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,8186795156931445738,8622809744873968835,2097152 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4839641480045721361,7494859561207476850,2097152 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,13464482657515656831,17241066577382618450,2097152 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,794182313160389676,2692251197716934083,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,15479671197596761415,11955816426385954440,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,12882692109061741665,7022953179795607683,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,1601222772729265972,14361345366189566302,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,1601222772729265972,14361345366189566302,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,12255711120237160945,12600484924074404015,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5461400728730953486,2975197965697009469,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,14447164239703970085,15196898492604832935,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,222486877672784489,9130651021692414728,524288 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5828,i,3565443009167181867,2027554256940381959,262144 --field-trial-handle=2296,i,7793163728035363048,12344143118352083916,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a3bafa3f5f24311f22aec54d908d6fe73dd4eb73b85b9bda3bfbf605ed643a3c
MD5 1c30432f82f50ec6216bd440873cf550
SHA1 86ab2bd4be30c0188bed147654354003d052537c
SHA512 9e41469b6e19679ec5ca0593b28286039adaa070e8883fe6be56ad351303084dc9731792e1306542d1da548cc08d6770b8e8804ef4b54fa7ec09575868248f71
TLSH
T1F261920464A07B9DFF68873798D42D8B7F348DF319835F290968D87666CB37550E03A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a207.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a207.TMP
Size 3KB
SHA256 613bd1a52408146598ed1f128a4114943a7b4a29937caea84edd1e0c000261bf
MD5 800caafa364757ecef6d9b18cb7ece32
SHA1 c5b020b14d1d6574c022ab29b0328c2763124049
SHA512 587f0f14f88f18d46fee4ac85ca36cab7a7ed33d0ccfa3140fcefe917552c7381123954bce061b0ad7b369442942f09743223cd181d18cd49d869d8b485e9cb6
TLSH
T10161934465A07B9CFF68873398D42D8B7F344DF319835F690868D87A6ACB37550E03A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ac1dd3fc426f336e400e5fa7e883c15ea6b65c0fc74f8bbe86a5d22c58d4f4b3
MD5 83654e2497fd3afc5afb1d711ce4ae69
SHA1 f3a3035f3c377751a9108bfd50c3e4ff1a9bf0c9
SHA512 5b963adafb20af61b1e04ca79656eb982077ef4bad4a983b181747a92a8590a337d4def0201a7778fe5419ec6c0edc580add98ac46227b4043664ec4f8c428ef
TLSH
T129318BF783B185AEDE1156F0AA04AE2BCE9C0116539C385A8AD4EF57A3B3471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 54b57953c413b02345529c3eedb3bc5ca90e8dfbb869bc14f2e1cf9edfd3a138
MD5 3630185d2e094fda8bf8b72e42e9a636
SHA1 0374f661f95eb625f32b06c0d71ff9cb69147466
SHA512 4b4dcf7f0eb18bef69ee6de3efd5deea51454a9032b750155cf207ba94b8372d1cbc3b0657cb5d34fa198bc26fbc1cbf52df5530d3ac2ba05b5f167b0e8cfbca
SSDEEP 192:sxZIRgWl/f0sSgIdpLGHW6+WNQXk/YRP6RgIgrJ:sxZIJl/f0sShKHbr/mN9
TLSH
T18422B9136E28A57B8CCBD64DBA1DBF53E5F9507391941E9CAAFC861C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5f7604db1bd9e2eb4d166892c67d21113b3bf99f05acea24d3353245b9054820
MD5 ea7919d1936eab71f81ae9529f86ca54
SHA1 5f31921444f35843ef1282cd755fec3886d9b643
SHA512 0ce54be1feded9f161df651b8e55d3614bdad76c05d4051241c3d93783ede9b04168e1cb31be403ef0a17a5a9b5d22b882adee02cdd6973d58022f903930580b
SSDEEP 192:sxZIRgWl/f0sjgIdpLGHW6+WNQXk/YRP6RgIg5VJ:sxZIJl/f0sjhKHbr/mNl
TLSH
T1A822B9136E28657B8CCAD65DBA1DFF53E6F9507291901E9CAAFC861C04E67CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5f044b10305e955c69197156642777267e8a9cf8af2e959d5131600cf908e127
MD5 48a6bb0b8e0cc1aa4fb8f4cd3c40ab9d
SHA1 d13427c43c7ed79d382b5309b035bcbcc74622d1
SHA512 d90ac94c23cbe5245f030e00df933805fddc55e06865adf319039b85d513218492b73a6c13589740196a61623e76d1b77209b7356f17d2eae85bbf17dd721634
SSDEEP 192:sxZIRgWl/f0sLgIdpLGHW6+WNQXk/YRPgRgIg5/J:sxZIJl/f0sLhKHbr/mHL
TLSH
T1EE32B8536D28697B8CCAE64DBA19BF53E6F9407391901E9CABFC861C04E67CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 839beb49ceb8a826caa54fe1780b58458a5bb1f8ece9d93ae4b3cefec6aa6739
MD5 185854df98b2ff7763ef5d799abdf6aa
SHA1 f254e790c37985ea3e4f9669f314cbec7233f325
SHA512 e06c98b206401e9c22af257e60dc3223b451b2899cc2c785563e81bedbfc6c6f6bb5251d68b562a7b95b9fbcbc8c24d4bbb341cf9838b169644f3123cad6850f
SSDEEP 768:X/K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Urob+Ll:X/K9uzYWvcQWsu1ja0HL7Q3/b+Ll
TLSH
T189C20A3F640CCB7E5FC01A9DDC5A6F973E9802D7A6688D4047FA944C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b8ebb7996f1378585d0b93b422bffa5ad89a137add33516db23218db5c399bc6
MD5 61f28f823fc71719691483a1c5c7391c
SHA1 4e527705d78c16a7f79f6e456a411a24ad687748
SHA512 31aa911a1d711b03cfb04e45904171e00ed56d2b38748ed6eaeb39b4eab4fc28f5fd0257070cdd7867b731a66e62f84c2e73ecff5395f7a553648e6a962a2f1d
TLSH
T122A002121D549471C041167196A7068422648C104A05B751A3E8407C9CB4586432607D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a5e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a5e0.TMP
Size 48B
SHA256 5baed8664aaefdbeec7fae9618cabef03157a5e4b02287001857d9e3879ed8c2
MD5 9821f10b8d25ec3b751fd453317510bc
SHA1 547665d2ea0ff04dffe4943f583947fa7313eea2
SHA512 1de2119d423fb6da723ab709f87397fee320207f0adc4ef3e83abd62d252df821f81afc60a66d75b23a61f034472a836c01af92b39c0cd63192cb033683d7d5a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 babb751937f1a8334c5412e37b3f4deb6efe2c184006bde3239e3f7975743405
MD5 80c60849e1b363465ecaa6cf7b4d6889
SHA1 a4fa6a2d3d1b918d6ac91ffaeffa3ba47ded9f0e
SHA512 83ed92504059d80d738392aa40ce982d746aa35f523518b25340aa559c0b6ba98f0512ce0d011c00273739eeb84437f39e1168103be31a205e141d8cc7aa514f
SSDEEP 96:K0m5owKVmK3/yR1/hBx8VssaNxKC4afxeXvkNQyoKXqz:hr3/yR1/hBeVsRND4afUXvkNR8
TLSH
T13791FA5136BB160079BD691884B58B6F528271733018EA6F3FBC58B59E67F080EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8d13943-e436-4e2c-a463-830b33d9281e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f8d13943-e436-4e2c-a463-830b33d9281e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 093e1507c6cce43214a5088c09b4fe121c81f424c5f2e231723507022dfd666c
MD5 aa8cf727857a33c81df6c19fb2cbaf64
SHA1 204673680d6719b88abeeb6853bb91405268b0c5
SHA512 5f5bb341bb8b9d743babbab6690e59b30491db621b7941319ee8ac4ea357924b4ee23f78b0682f224277f46b15421be162324b80941935440079bf5ec4f4c9f0
SSDEEP 384:VZcIhsNtQ8wbhS2zNOOjTVY9di9raZtgOIwZOyUloA:thVflnSnZXszL
TLSH
T133827D325CB81CB75CF7A545F48F32039FB88067E6C57B9495ED9B1C01DA6A8130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c1b7c14852dc5a7868b213bdad35798c81c76cae79ae7218ca1d368ba436b0ef
MD5 1e680c101c52f1eabac0229e7c6409af
SHA1 f362b06487ea6596f5c23840f97618d052fa7c59
SHA512 45eda639722e54f77e8624f5988206f770067d92dd9690112b88d2367e8c52bc8ae3b92e45b211c25f7c77ae24770bbd88e569da3d38d6bf8b36f0d0e4720da2
SSDEEP 384:yiFiZcIyzsN38TUNTUlIlR8wbhS2z41OOjTVY9di9r2ZtgOIwZOyUloA:5FQaCwg34lnSBZXszL
TLSH
T1D7C229F248E7487AD9AE5743A77E2D028EBCC067F585A690B3984A0CCC961BFD306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 98470ad6d74c89ebed694a0533f658d74b97b557327b3389359e6ec2c4bb8142
MD5 ade1cb39cd05deb9bd19e22700a42ba1
SHA1 143614c1622fd5bbe66a5c7dcb54f1cd14961b69
SHA512 9062cf2bd52b6f8a1d90a48ddf1957e8db56317174b6c94be47cd93360e285b3180f6892d0f623196c52b02f34a849ef6bdf66b1505ca249caf1b557057f6729
SSDEEP 192:SON06ygpQmiUyDotOCTVgLi+FdVsLzPNVU6:SON06lHdtOCTVY9diP/U6
TLSH
T1C502C735AC782CB78EB3AE05F48B37179FA4117BDA562B84D9E84E0C00D766C2346D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a7fa67b5d9688c813d2574c6888acecc560061e248bf563a634204ecd26a0ce1
MD5 8554e9c4339e3b3ab7d52c4ba4b00954
SHA1 c9c44b0b193aacf950858c07c10c221f64f56c31
SHA512 4aa71d92ce8613bde435937a9c8924300197e64b93383d093edf732befea5d82f8f8f7e5b8e15afba4ff5bb46d0d68bd48412f2934f365e489fffb85b84b5df6
SSDEEP 384:IZcIhsNtR8wbhS2zNOOjTVY9di9raZtgOIwZOyUloA:2heflnSnZXszL
TLSH
T188827D325CB81CB75CF7A545F48F32039FB88067E6C57B9495ED9B1C01DA6A8130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a755c1ab6dd978c19f76d0e6b410d6f326a80d8e1c905383a1c5f74b0f7d2b8c
MD5 45b8ba9c89d695fd0d851e1d2f439a67
SHA1 302b1f296a4475d0f348c5e7ba516fe4fc63e5ef
SHA512 558208f98b646d4cd2357edceba7adec768f3dedfd52b38b75a8b24d8000dd8016e25bdd40b087287b587da85f4ebee8c02bfeea19ca98de3c316788d7ff4822
SSDEEP 192:SONQ6y5QmiUysoqOCTVgLi+FdVs9mQN/3ULqOU6:SONQ6YgqOCTVY9di9rMZU6
TLSH
T196120935A8786C778EA36541F08B36179FA48167DA8A7F90E5EC5F0C01DB6BC2307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

574ec49f-23a1-4eb0-8070-b214e1830f75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\574ec49f-23a1-4eb0-8070-b214e1830f75.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4e48f0800da0f1f5d1ae5e6e2fe70b870ac76969373562bec1ec4f29825c11cf
MD5 05423dc906957ac79313d6d2ba400a43
SHA1 802e6bdb3984584af647f2a5cfe0a3f17fd45706
SHA512 2bc57b1abbec0f7155bcae856901c3c3d9e364452780a3aff89087c6c45dbafd25961b120b0630f1bdbe70305e8df814a4d24ff9b974692f8830b3449697a513
TLSH
T1AE41184CAAF91108B3B7AF1A9BF6686D847B7D772F06D46D00510E4E0A63A40DC61B37
MD5 SHA1 SHA512 TLSH

Submit Download