hxxps://melonds[.]kuribo64[.]net/downloads/melonDS-1[.]1-windows-x86_64[.]zip

Analysis

user interaction
yes
max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://melonds.kuribo64.net/downloads/melonDS-1.1-windows-x86_64.zip
Sample261017-b2evhsfx5r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4316	msedge.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	melonDS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	melonDS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	melonDS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	melonDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	melonDS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	melonDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	melonDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	melonDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{BDB4FC7D-10E2-4C35-887D-130187A430DD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5244	melonDS.exe
5428	melonDS.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
3888	msedge.exe
3888	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5244	melonDS.exe
5428	melonDS.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5952	taskmgr.exe
Token: SeSystemProfilePrivilege	5952	taskmgr.exe
Token: SeCreateGlobalPrivilege	5952	taskmgr.exe
Token: 33	5952	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5952	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe
5952	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5244	melonDS.exe
5428	melonDS.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1564	5000	msedge.exe	87
PID 5000 wrote to memory of 4316	5000	msedge.exe	88
PID 5000 wrote to memory of 2064	5000	msedge.exe	89
PID 5000 wrote to memory of 2064	5000	msedge.exe	89
PID 5000 wrote to memory of 2064	5000	msedge.exe	89
PID 5000 wrote to memory of 1308	5000	msedge.exe	91
PID 5000 wrote to memory of 1308	5000	msedge.exe	91
PID 5000 wrote to memory of 4884	5000	msedge.exe	93
PID 5000 wrote to memory of 4884	5000	msedge.exe	93
PID 5000 wrote to memory of 4884	5000	msedge.exe	93
PID 5000 wrote to memory of 4280	5000	msedge.exe	92
PID 5000 wrote to memory of 4280	5000	msedge.exe	92
PID 5000 wrote to memory of 4280	5000	msedge.exe	92
PID 5000 wrote to memory of 4788	5000	msedge.exe	94
PID 5000 wrote to memory of 4788	5000	msedge.exe	94
PID 5000 wrote to memory of 4788	5000	msedge.exe	94
PID 5000 wrote to memory of 2112	5000	msedge.exe	95
PID 5000 wrote to memory of 2112	5000	msedge.exe	95
PID 5000 wrote to memory of 2112	5000	msedge.exe	95
PID 5000 wrote to memory of 4892	5000	msedge.exe	97
PID 5000 wrote to memory of 4892	5000	msedge.exe	97
PID 5000 wrote to memory of 4844	5000	msedge.exe	98
PID 5000 wrote to memory of 4844	5000	msedge.exe	98
PID 5000 wrote to memory of 3840	5000	msedge.exe	100
PID 5000 wrote to memory of 3840	5000	msedge.exe	100
PID 5000 wrote to memory of 2148	5000	msedge.exe	101
PID 5000 wrote to memory of 2148	5000	msedge.exe	101
PID 5000 wrote to memory of 2148	5000	msedge.exe	101
PID 5000 wrote to memory of 3812	5000	msedge.exe	103
PID 5000 wrote to memory of 4032	5000	msedge.exe	107
PID 5000 wrote to memory of 5592	5000	msedge.exe	122
PID 5000 wrote to memory of 5600	5000	msedge.exe	123
PID 5000 wrote to memory of 5612	5000	msedge.exe	124
PID 5000 wrote to memory of 4500	5000	msedge.exe	127
PID 5000 wrote to memory of 4500	5000	msedge.exe	127
PID 5000 wrote to memory of 3888	5000	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://melonds.kuribo64.net/downloads/melonDS-1.1-windows-x86_64.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd967bc188,0x7ffd967bc194,0x7ffd967bc1a0
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,7172723856594248765,7472197978683463229,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,3924756375667740313,12961834170544576077,262144 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,5470229284240901512,18201845949729507514,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,16249482190927682434,10227716677572761559,2097152 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,18357194595641173519,11088203215967077976,2097152 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,9308551743598434303,5628168140774901023,2097152 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,11107670480318522764,772693618739720662,2097152 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,17382594744954286087,12744127152006697503,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,15108719395298779681,18390579265058853998,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,4026221689345103197,18190895206225755136,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,8858640550325485564,17544251559176321028,2097152 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,7035465050914454587,8863072136351954966,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,7035465050914454587,8863072136351954966,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,8598854435776653127,11149433352622325236,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,11760614222035305119,8217258671586934393,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,10154402799897716507,1365056862747795143,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,15359290765597334407,9621147704126151857,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,222459070195802745,3411586377426496496,524288 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5160,i,16450710927485528840,16843762478992926891,262144 --field-trial-handle=2308,i,1539060393764892382,10351299171221193601,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2272

C:\Users\Admin\Downloads\melonDS-1.1-windows-x86_64\melonDS.exe
"C:\Users\Admin\Downloads\melonDS-1.1-windows-x86_64\melonDS.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5244

C:\Users\Admin\Downloads\melonDS-1.1-windows-x86_64\melonDS.exe
"C:\Users\Admin\Downloads\melonDS-1.1-windows-x86_64\melonDS.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5428

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1dd5dea1-d63d-4571-83ac-53f0b769009c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1dd5dea1-d63d-4571-83ac-53f0b769009c.tmp
Size 18KB
SHA256 cd9d94d155c44a37a7292992bd51cdeb95146b40b083409e7a9a31425dc369e6
MD5 d324423164e548189a8a96868b15c231
SHA1 32b0ab33aafd05e4c24664b16bc96bf47eef4170
SHA512 ff7ac460817f1c0f798e3d0a6d90d27aad9fda2b5bb664be1a26a2f2d36dc9307bca17fe9082e1d9046457dd68300c8c69a36ca6d303842da0a68a1784845829
SSDEEP 384:xQkUSvFsNjYs1Ob4IuzIGmYMoULMXXvih4MTvIIlQ:jFOn9HMXMnviuMTvLy
TLSH
T127826C366C74BD6B4AA3A510F15E3A17AFB4811BE6C81F50E5DDAB1C01CB29C230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4844d7a3-e78d-4efd-95d2-3f6dcfc5947c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4844d7a3-e78d-4efd-95d2-3f6dcfc5947c.tmp
Size 8KB
SHA256 a65f8ed88c3bfc79f21ab0cf92d8fbdae13b817b74be84a7de4241b2b8b492e7
MD5 43e80518d2b26ac7d763b70d396a0bf9
SHA1 54f73b1e1b8dc379618fe1218f35eed7ed218743
SHA512 a6353c21d68352d945000c716a242c23f48ad80bf4d5968e7ed0a87e3a21f2ef54e33061394b9c2919e1b470dfbae7538cf1ecafa3a83978b637d19d88e71a63
SSDEEP 192:aONg6IE7QmiUyj8TPuIGmYMgjzoFGtC7sykU6:aONg6DtbPuIGmYMoUVsrU6
TLSH
T1A4020A35AC787C6B9FF36E49F4466B236FA5112BE5952F84EAE81B1C00D725C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f8cd581-823a-4c17-b6b6-4d84f1a0e852.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f8cd581-823a-4c17-b6b6-4d84f1a0e852.tmp
Size 8KB
SHA256 99d68f35a49c7a6dd3713814194c7ba135df617d1ad4891b10bd2af9a0d09d97
MD5 8a3b049b2dde1492294c527024bde486
SHA1 c6cfafa0f34efbf5eb37aab334121e6ddc145f74
SHA512 fe5a61c1e150ea838a32ba35c0f5c4e65585f2002fd959faed7b80c58d7cd28f4a019c152c07faaaa7146b9b0d740456f8bc5bf9e99dad373bd3174bb75f7480
SSDEEP 192:7ONW6IEJQmiUy98TDuIGmYMgjzoFG8MXXxeUp27HYqz4U6:7ONW6DnhDuIGmYMoULMXXcHh4U6
TLSH
T107121B36AC78BC6F5EA3A944F44A3A139E654217E6897F80E6DC2F1C01DF258130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

649cce95-2bc8-4517-9982-77705b0eac97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\649cce95-2bc8-4517-9982-77705b0eac97.tmp
Size 18KB
SHA256 ec4acf48703e24dc4d5112f52fb0afa3bac9d906e2a8abe37d28a9f7408decb4
MD5 c76dffaca960550595100de605eeaa9b
SHA1 ce24affe7d40347c7efa35f2aa675d4e04797afa
SHA512 1386bfb9a846eef9c7dd5b578ec386e60cc5da3944e742d2e6bc44f37a44e8f1b964aa644f75a92e929f07239bd5a9d0166253651d673b3d01a4afab9af80e31
SSDEEP 384:RQkUSvFsNjds1Ob4IuzIGmYMoULMXXvih4MTvIIlQ:DFzn9HMXMnviuMTvLy
TLSH
T16D826C376C74BD6B4AA3A510F55E3A179FB4811BEAC81F50E5DDAB1C01CB2D8230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b9dff19-ff33-4389-ba6b-398e1beca3b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b9dff19-ff33-4389-ba6b-398e1beca3b7.tmp
Size 21KB
SHA256 0fb8da88f96bf8b2dbc10b07979b680b405ee3274a669bd8592c48d5198f1b60
MD5 f0748daa493b21fc7c83eb02e266dea7
SHA1 19549df27bf28b25d27a612093c8c5daee265181
SHA512 7ff0e8d2cadc6e477b8579acc89ce4a09c61b06e97a9a14c536d631cf3eef7f1ac8758c193d8cc1ee3d049381b195111eabcabc79faeff0ae7012b98cdca6c8c
SSDEEP 384:UiFqQkUSvn2sN98TUNTUlIlYs1Ob4IuzIGmYMoULMXXvMih4MTvIIlQ:vFS2cwgLn9HMXMnvMiuMTvLy
TLSH
T1A0A25B379CB4A97B9EA39A44F55E3613DFB44127D9C46B90E6CCAA1C01CB2DC130BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

2ffcc339-2dca-4a50-b87d-6d54b69b3eb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ffcc339-2dca-4a50-b87d-6d54b69b3eb2.tmp
Size 10KB
SHA256 25f0adb31a3ce62a40469c02402b2aabc1e17e40073cbeabc6a9e2a1419ea473
MD5 01974758bfa43d1f641df1f5f6f86343
SHA1 471b71b3438f5e7d69877b0bf284f42ff63f9de2
SHA512 dde7c2458ae1d82f7d65ca848a525c57db152d0b96da5e7267b81524745da61347688a70f79929595cb09093b8e881ea56ac2a01b7ce84f2d32559c5375c8380
SSDEEP 192:sxZ3R8n5/fssTIcjIdpLHW6+WNGYaphZqygIg5tJ:sxZ3c5/fssTIjLHbGPml
TLSH
T15D22B8526E28A57B8CC7E20DBB55BF53E6F95032A1D01E58EAFC861C05E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38f294ab-af3e-4038-8a4b-adac65f4d390.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38f294ab-af3e-4038-8a4b-adac65f4d390.tmp
Size 9KB
SHA256 34fa54699f79a3f4a502b366e9f5ab66e3b6f1d4615c48f17d52b9ae875e8336
MD5 34865d2b2f456d81a82a6e1d401baac3
SHA1 cacead3889b70342c55fd8409558d6cb8fae8417
SHA512 14b6da91393d3c0c5bd8b7228e804be56decf9d2dc392f71b859c1825bb9a3861f871fd650bb3754019418130b73f129df9532a71f38b3792802eb68692a21a7
SSDEEP 192:sxZ3R8n5/fssQIcjIdpJHW6+WNGYapJnygIgrJ:sxZ3c5/fssQIjJHbGd9
TLSH
T16512B8526E28A57B8CC7D20DBB69BF13D5F91032A1D41E58E6FC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56120e03-367d-4dd5-b939-22c7ffdb9bd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56120e03-367d-4dd5-b939-22c7ffdb9bd0.tmp
Size 9KB
SHA256 61507c87d6549930b666d8c80ef57a6ea71a9b1f30b46e2034ce3e4e5cf9cdab
MD5 18fb9bcfadb34f1a3c469621c7935829
SHA1 791e441470ba620aa4001904ff231d335b8c9a08
SHA512 a37ebb049fc7620e7a109f6039348d3142bc43a8760d6f982e04db3f39699885f88bcc4c7c5dbc9879ed35069d15149f17fbd412843df5bc8f7e29399cc99e7f
SSDEEP 192:sxZ3R8n5/fssjIcjIdpJHW6+WNGYapJnygIg5PJ:sxZ3c5/fssjIjJHbGdz
TLSH
T12A22B8526E38A57B8CC7D20DBB69BF53D5F91032A1D41E58EAFC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ba79a2c-25db-41ab-af26-45e49de5318e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ba79a2c-25db-41ab-af26-45e49de5318e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c603d7e407547e136f1b068aeb4c7fc2e02f487883ee004ea7360b5ad1474864
MD5 baf8f0a19b8bef1385b4e50fdc8583c7
SHA1 b7d06ca0076c9630aa45c91592f3fb7fd072a67b
SHA512 8b369d07f04d804c452cfd716034b3a5f2b19c09a2f261cc2658e636ab311edd56fc734b6b5ba08af5dc07686b3243fea07528aae9e305e7b915278e8a00a322
TLSH
T1A961808D9B1DC3F1F7F9837E80E523473A72C58195834D420A9BE478989A3E7923B010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a89b086bd4cb1fc7784202f2c1839522774f3d78926b4c35a39cb8ddbd4ff0fa
MD5 2656f9303573399019faae1a8ffb55c3
SHA1 2e276ca2e389290eacd08f094b8de1eeb8c5d863
SHA512 f7d4841b423b13adda88cc9acb478ad2e48d6575d87048e37664d3a08020299a8e268979695cd1a1bf08b84d7a05a11fdea07df5477be3c2dbde61faa8615c49
TLSH
T1BF61808D9B1DC3F1F7F9837E80E523473A72C58185834D421A9BD478889A3E7927B010
MD5 SHA1 SHA512 TLSH

Submit Download

34b182bd-ea1d-4de1-8c7e-9561c052e8b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\34b182bd-ea1d-4de1-8c7e-9561c052e8b6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

28a97224-1087-4037-926a-d47144064a36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\28a97224-1087-4037-926a-d47144064a36.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

506fbfd4-1ef9-4442-b6df-7f464a302b44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\506fbfd4-1ef9-4442-b6df-7f464a302b44.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b3dbeee1-96cd-4a9f-9036-a741598da22d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3dbeee1-96cd-4a9f-9036-a741598da22d.tmp
Size 949B
SHA256 80f9d8c30ec78e45b592645de88987584a6c9430421d4e1c050006b3e7bba612
MD5 8ed2bf8c0b53bf9e5de4b56be59f13c1
SHA1 6b138c2093b26dcb3982b6088907a992bf1d3a22
SHA512 5edb9731eefda7e19c7d525861b093fd75752089948abcba4e3168b72c52329e42879cebcc3d9555c5acb8c117673b0945a131b60c60f978d19b4e21d00fc279
TLSH
T1511157B3C7E5866EC91116F05A28AE2BCE2D0606421C7D1989E4EF6BD3E3069E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 02d5ddf104ed4a7f38233ba269acd256bc037207b15477c163079fb7807ea2fe
MD5 a63d3ce15a532113168e9c9bd062b49f
SHA1 db76919e74b68559a70104d32829f1cfb465de28
SHA512 75731d65ec6e940de0edaaaa154f315a8fdc88535b89a0f463d8b7b7f0eef219776eb627a9c15e4bc06aaaef22d0c6cd65485e9b28a797d864f0b0bcb45482c4
SSDEEP 48:K0KV4kKIYJbUzEIScJK9A16JxyZYLs46yLCNQ8CgARbcrMISURK9Y1iRxaBYDU0k:KgZKK6Aimd6KmkR7KK00mR
TLSH
T162915E51317B260238FE2A484465C6AB434231B3305DE67BFBED41A25E6FE091CFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4ec776e-7c7e-4171-97bd-5ab8a06d05d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4ec776e-7c7e-4171-97bd-5ab8a06d05d1.tmp
Size 27KB
SHA256 626f2d6e6364a2b6645a19c16a1055b456ee09817671771c5d373f70850b75ed
MD5 bb2b45b103c7acca0b623aeede9557c3
SHA1 0a2aa6b12bd4b789187be6dbc5568d99d285507e
SHA512 2d3f7c5775215bad22c434544a403e333bb4e3d0ecfb4b7553dc21e2c205077f44030b584c3476ea72d4d4fec9ec6242a9999f04733a23c91282ccbf8df56c58
SSDEEP 768:nlWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Yro4YfeumR5:nlWPcLKWvKeEeu1jaClLiF7j4YWumR5
TLSH
T16DC2FA3B640CCB7E5FC01E9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed686a87-3320-4821-bf62-36f5b0ee329e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed686a87-3320-4821-bf62-36f5b0ee329e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6d770fd-6103-4eb5-a702-4060e13c5a76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6d770fd-6103-4eb5-a702-4060e13c5a76.tmp
Size 10KB
SHA256 b4d1d8de121b9be5c7f657b524c2456a589cfda4656a2927b3108a91f753958a
MD5 4fe538abe2aa2ef3ae7acca43dfb3513
SHA1 7c1632e1e2130ad5fad752b392d5e07cad570edd
SHA512 cccf79db99053edb3aa430ac4a26b9553025be0aa3888caf1fc4308e03aab9036f69b9a0db361a80244c5d56c0ba4fbe215d2ad184b996f45ff3bc376ec484e6
SSDEEP 192:sxZ3R8n5/fssTIcjIdpJHW6+WNGYaphZZygIg5tJ:sxZ3c5/fssTIjJHbGHxl
TLSH
T15522B8526E28A57B8CC7E20DBB557F13E6F95032A1D41E58EAFC861C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c7f52c7a-f724-4ee5-bab6-424bfdffb3ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c7f52c7a-f724-4ee5-bab6-424bfdffb3ea.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1345c54f-a67a-4f8f-bec2-ac8d14306b89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1345c54f-a67a-4f8f-bec2-ac8d14306b89.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ca7b11f8225add186a9eebe1148e59428a85112a9601b4d2510a096fb047575
MD5 50d95312fafb462336ac012e48e13bcf
SHA1 695b5ecf46a2156a1b821b2615e5e2fe3d4341e9
SHA512 8a32a7bcfabda59e08472e211ee58738a3fc6ed227f4b3d0d90c875eedafb798230bd323b4f3b98bee4417aba8a3298fb8ea9cb2c97873f8e679a9b17707179d
TLSH
T1A5414A5CA6EA1108B3B36F5AAFF6A96D487FBD372E0AD45D10110D4F0A22B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 d26fe1f8199a5856b4eef68f6b0d8b752bdeaad30bc5ebb7dc35af2d79a579d4
MD5 0452d1dc32248d000e9e85a69aeda6ea
SHA1 5dca9a04d734ab1e6bc1a1de843ed2545387a1bf
SHA512 3bccbe3bda246cc649aa40a8c9dec5d7be19d5e7ddcef393feec4461136ee6b4894ec95738a7d4b6ad76a87f552c4e9ef1105d6529eb794a2ff44c208af5a7fe
TLSH
T173514D586AE91118B3B36F06AFF7A9AE897B7C373F16945E10110E4F4623A40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

f485ba86-81fa-4b81-b552-bbc095ca865e.tmp

Path C:\Users\Admin\Downloads\f485ba86-81fa-4b81-b552-bbc095ca865e.tmp
Size 15KB
SHA256 8bac045608cc22bc2f97828416ed6793171d0e5d58460b83687b5e53007994aa
MD5 b6d907743bf7249237ea74c8b360e97c
SHA1 4316022961f740f07423f0aba2a94955d41e9e53
SHA512 5c522b60de7100ce63bf28c3bc871ec711735d1771119004639cc0635bee5b5c7eadbf8545f55bcb2513d0627d9c2206805aa479c042154d45430bbcfc237ce0
SSDEEP 384:sv0OVkjAdkYFVARHL6Wur9H0/xjxvVBJ6+zKY9:sXkEd/3iL9ur9H6ZRsQP
TLSH
T1CD72D01BC748EBD5F73622DCA2B158642DB58B3F40347A065F317D0D7B92047B684232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

melonDS.toml

Path C:\Users\Admin\Downloads\melonDS-1.1-windows-x86_64\melonDS.toml
Size 2KB
SHA256 0627f5d8de7a4432c6a57e642f84b718980b8a57404d93ef84ccc0bc972f23b8
MD5 d8b6aef7a2a4552f24145f9c440b52fc
SHA1 ea2a72f7b49ba05ddec77daff368fe28d5068688
SHA512 50be1d49f1568ce9462b7eb9fd809d60534ee271f0f1006323b0c8102997cd6f543dcc6116f97136b73dc68289a92f7f5663b84cb26e10ae1979bdd449fcded6
TLSH
T15751687AA71A843C045DA956A88361622DEF2817D11BF126735D40E93334CD6A7ACD3F
MD5 SHA1 SHA512 TLSH

Submit Download

melonDS.toml

Path C:\Users\Admin\Downloads\melonDS-1.1-windows-x86_64\melonDS.toml
Size 2KB
SHA256 afc626899539bd6d8b09d68f22f91333f5886c7ee0e2f680fce375b9ec0fab1a
MD5 c1416331a70da58b71f471e1fbabe8b4
SHA1 494a4b3165bb8d053dc41f1f9d2a753920e9d156
SHA512 1cb7a156fcc795ca644206af09b6c60ab31a79f9ee9b40125be52286e99cad9bd3cc5eaae52a87e7e04fed1d72e4c5305675a3b99f031da36d2c2e4469a72b6f
TLSH
T177517B6A671F843C042DA956A983A06269EF2806D11FF116735D40E97334CD6ABECD3F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5244-226-0x000001BB789B0000-0x000001BB78E41000-memory.dmp

Download

memory/5244-300-0x000001BB789B0000-0x000001BB78E41000-memory.dmp

Download

memory/5244-225-0x00007FF6981E0000-0x00007FF6991E0000-memory.dmp

Download

memory/5428-228-0x000002B2DA490000-0x000002B2DA921000-memory.dmp

Download

memory/5952-268-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-266-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-269-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-270-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-271-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-272-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-267-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-261-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-262-0x000001967A870000-0x000001967A871000-memory.dmp

Download

memory/5952-260-0x000001967A870000-0x000001967A871000-memory.dmp

Download