hxxps://www[.]mediafire[.]com/file/d8hawcuxz7fwo5t/IK_Multimedia_TONEX_MAX_v1[.]10[.]1_WIN-TCD[.]rar/file

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
898s
max time network
728s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/d8hawcuxz7fwo5t/IK_Multimedia_TONEX_MAX_v1.10.1_WIN-TCD.rar/file
Sample260727-2a2hbade97

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296646286226650"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{6A6C6D3D-115A-4B2F-B788-CF8B27B109E8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5424	msedge.exe
5424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4880	4840	msedge.exe	87
PID 4840 wrote to memory of 1488	4840	msedge.exe	88
PID 4840 wrote to memory of 3832	4840	msedge.exe	89
PID 4840 wrote to memory of 3832	4840	msedge.exe	89
PID 4840 wrote to memory of 3832	4840	msedge.exe	89
PID 4840 wrote to memory of 3052	4840	msedge.exe	90
PID 4840 wrote to memory of 3052	4840	msedge.exe	90
PID 4840 wrote to memory of 3244	4840	msedge.exe	91
PID 4840 wrote to memory of 3244	4840	msedge.exe	91
PID 4840 wrote to memory of 3244	4840	msedge.exe	91
PID 4840 wrote to memory of 4992	4840	msedge.exe	92
PID 4840 wrote to memory of 4992	4840	msedge.exe	92
PID 4840 wrote to memory of 4992	4840	msedge.exe	92
PID 4840 wrote to memory of 1204	4840	msedge.exe	94
PID 4840 wrote to memory of 3836	4840	msedge.exe	95
PID 4840 wrote to memory of 1204	4840	msedge.exe	94
PID 4840 wrote to memory of 1204	4840	msedge.exe	94
PID 4840 wrote to memory of 3836	4840	msedge.exe	95
PID 4840 wrote to memory of 3836	4840	msedge.exe	95
PID 4840 wrote to memory of 3968	4840	msedge.exe	98
PID 4840 wrote to memory of 3176	4840	msedge.exe	99
PID 4840 wrote to memory of 3968	4840	msedge.exe	98
PID 4840 wrote to memory of 3176	4840	msedge.exe	99
PID 4840 wrote to memory of 4644	4840	msedge.exe	101
PID 4840 wrote to memory of 2328	4840	msedge.exe	102
PID 4840 wrote to memory of 2328	4840	msedge.exe	102
PID 4840 wrote to memory of 2328	4840	msedge.exe	102
PID 4840 wrote to memory of 2508	4840	msedge.exe	104
PID 4840 wrote to memory of 2508	4840	msedge.exe	104
PID 4840 wrote to memory of 2508	4840	msedge.exe	104
PID 4840 wrote to memory of 3292	4840	msedge.exe	105
PID 4840 wrote to memory of 3292	4840	msedge.exe	105
PID 4840 wrote to memory of 3292	4840	msedge.exe	105
PID 4840 wrote to memory of 448	4840	msedge.exe	106
PID 4840 wrote to memory of 448	4840	msedge.exe	106
PID 4840 wrote to memory of 3664	4840	msedge.exe	107
PID 4840 wrote to memory of 3664	4840	msedge.exe	107
PID 4840 wrote to memory of 3664	4840	msedge.exe	107
PID 4840 wrote to memory of 3336	4840	msedge.exe	108
PID 4840 wrote to memory of 3336	4840	msedge.exe	108
PID 4840 wrote to memory of 3336	4840	msedge.exe	108
PID 4840 wrote to memory of 2644	4840	msedge.exe	118
PID 4840 wrote to memory of 2644	4840	msedge.exe	118
PID 4840 wrote to memory of 2644	4840	msedge.exe	118
PID 4840 wrote to memory of 1584	4840	msedge.exe	119
PID 4840 wrote to memory of 1584	4840	msedge.exe	119
PID 4840 wrote to memory of 1584	4840	msedge.exe	119
PID 4840 wrote to memory of 3608	4840	msedge.exe	120
PID 4840 wrote to memory of 3608	4840	msedge.exe	120
PID 4840 wrote to memory of 3608	4840	msedge.exe	120
PID 4840 wrote to memory of 404	4840	msedge.exe	123
PID 4840 wrote to memory of 3424	4840	msedge.exe	124
PID 4840 wrote to memory of 1676	4840	msedge.exe	125
PID 4840 wrote to memory of 3972	4840	msedge.exe	126
PID 4840 wrote to memory of 3972	4840	msedge.exe	126
PID 4840 wrote to memory of 3972	4840	msedge.exe	126
PID 4840 wrote to memory of 4672	4840	msedge.exe	127
PID 4840 wrote to memory of 4672	4840	msedge.exe	127
PID 4840 wrote to memory of 4672	4840	msedge.exe	127
PID 4840 wrote to memory of 5156	4840	msedge.exe	128
PID 4840 wrote to memory of 5156	4840	msedge.exe	128
PID 4840 wrote to memory of 5156	4840	msedge.exe	128
PID 4840 wrote to memory of 5740	4840	msedge.exe	129
PID 4840 wrote to memory of 5740	4840	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/d8hawcuxz7fwo5t/IK_Multimedia_TONEX_MAX_v1.10.1_WIN-TCD.rar/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13147297275567090827,5951216755845986990,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,451107231101599433,6688162440265428336,262144 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,7570531086503749573,16186069133933881592,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10773035935030710862,16764622558227091900,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,18303174561453471487,3546564475204075668,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,4577917420396649699,12286929443525339900,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,615114286396478388,438060417480985675,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,10464532546533830914,2722944014821970101,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,9184299275273549351,387683485005296948,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,12068937596202776725,14908278428609407945,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,12068937596202776725,14908278428609407945,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6236,i,15816926825128483139,15359710062400390811,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6436,i,14406057608357775050,14041734253415639596,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4328,i,7464354096977519065,7118628852202256251,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,14702654133270552774,7954788446283317814,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6840,i,16935093843293911706,344720316308413595,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7312,i,931379362210358970,6593138644956388323,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4516,i,5246022824249817952,3719475173468740710,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7008,i,11863480263138800080,3636583919417318968,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3524,i,4420109087778983828,8856461032367408808,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,14141332116861375350,5455937502905557383,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,77444769563810603,4631683565321269432,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7524,i,4667426176848524118,3868824534894363458,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7540,i,11801325883365175977,4193280746345902867,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7624,i,11884669126188767585,4963200881218211024,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7688,i,4464537681065360904,2659750185450879937,2097152 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12952250687014962943,7492256773581429392,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,6650967877779797813,9760143106601684319,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,12406051417129256126,13905393053524653222,262144 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,439987039966920572,7580586826254131786,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11512365069974368912,11532475025459342611,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,12820638108103953234,839544161470794972,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,7816095339746887908,6680305194119696439,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,8817699313453533773,16382622395356869595,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8156,i,1074371634358990841,7394345588056505671,524288 --field-trial-handle=1984,i,4977797740680734631,5964510817095359907,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 d509017f39612780ef84df317a8e11cbb4d2931880fdb1a7633797a11e04b762
MD5 96333812e99cad20cc04a4819405e9f8
SHA1 9faf093699a0225083274ee0789fab221d440939
SHA512 7f3ef9c0e89638ff4b5d2e827be6e6f318a48c569d552e4170cfe03ccca07a71edb622ea120de3023638cd5eca5f46935f62d1a37fcf7eb721ce7d8c60f5ccb8
SSDEEP 192:FjgW6Bl2WWff22//ooppqqjjvvYYZZaTTMMM3LO:FjgW6Bl2WWff22//ooppqqjjvvYYZZat
TLSH
T1C4E1494B86E4C79ADB0660CB4DA0A35C41B53B0DEBDDE508139C8DED31CE4AEF6B1691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 aa9112f60dfa057b90a47ebe60b68e2d6be325a215a53cb93e88ba723fa37f7c
MD5 fabc6b8ea77212420bf86eeb6c0c92e2
SHA1 63caf41258aaab98b7539278e356ea30af89427a
SHA512 1845b76f1da8059958c200870d71b3810c5df5cb9099bd940b9e36e845a6dcb6da70ec14b67a0494609485e3a4da1beee7227a66b1e4d31b77526c1a975f46fc
SSDEEP 192:ZjmQ6rPWPWPWHH4444aaahhhwOVVV00zzzyyy5MbLO:ZjmQ6reeeHH4444aaahhhwOVVV00zzzY
TLSH
T1EDE1485786E4C7EA8F0611CF8DA0526C50B13B0DEBDCDA18138C8DED748E59FE6B56A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 df544c68a500dc370eed46e523d96e1216e6612729458549e753ac8c7c8c42a8
MD5 1ccddc1a660a1062d2296b43b4655e1f
SHA1 1dc808a2414f65772859e7819b6f8843ff65d6cf
SHA512 7c3872c1c93945cedd0f697e308ea756e9cc06c2ab07d19c6cc34324796a05d6e45a12c480dd16b4ab4436a2473d334388ec07a5f08a2ea00bf4d1ef074fc642
SSDEEP 192:CjYm6JFiiiiinnnnUUUUUpppWWW77774444MKLO:CjYm6JFiiiiinnnnUUUUUpppWWW7777M
TLSH
T1C7E1404346E8C39B9B1520CB4EA0679C41B23F0DEBDDD508678C9DDD308E89EB5B9690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1d00fd4dd3e7841e4d84b0045ad7f12eb6b67689c99fceac96879594ddc5f91d
MD5 6be2b760f84024b4e28bbe0a304abebb
SHA1 7f55524d1c2cac770930706930ccde9a527f52fc
SHA512 78368f9e87fd588616d90341117c6745e3995aea39bae5c0d86304545d9ae73733ede2a48a9d5205809f197a7f960b7c44cb9ee6c3993897fb4d606361b2143a
SSDEEP 192:4ljIDzcDz6NDz6z6zfzfzfzfzRzRzRzRz0z0z0z0zrzrzFzFz4z4z4z4z/z/z/zk:4ljEzgz6dz6z6zfzfzfzfzRzRzRzRz0D
TLSH
T193E13C4796F4C79E8F1511CB8DA0526C40B13B0DEBDCEA08178CC9ED348E8DEB6B2694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c3f822b44b27e237acc89a868477baa1af61775ada7c5ae420886e5254e5e01d
MD5 9f51f6b5665fbf0e4782897933f8b506
SHA1 3085cb70764bdcc273ef629f2bb98256cd63761f
SHA512 f1adf7e1cffcd5a57e87f069e97f128b542a50f9100bc3f67a0e785a6b8676f230d6e7aee1dfefa3bd9ed7834443c9c54088b45344ad91b119ecc460e0051970
SSDEEP 96:lt1abPzZSVg3h+cqeBvDnlZoSqXcek5j6Fy:lt1GP9SV6h+cBLolkss
TLSH
T104B1A670115E2698EB428F71C0DD458033F5A6F6FC3B1FC7CC9E91BEE6057A008550A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 96419657682735450c4a5aab1ab1907840a8610b72317163464b925c92be19f9
MD5 7c6d5cbdd3106f01ee6c09c18d7a50dd
SHA1 13c24c7b56db32906f4c8f26591ac408d6a35ed4
SHA512 a66cf73cc3af4582d36aec6d42cd171914dad0983cb392e3e6bc73b3ea9b71278f1f56a847628fe723ea4e0e6b3aedde0e0ba9d8a1ddd4f9ed09fee7953437dc
SSDEEP 384:DjWdQleSkJf47TeJex1OtBZNhJYseQUBereRJwtgJPpNdeK+Y1f4Iy6rKYmY9k4h:ksbRgqRpMI2px95aWiWEvs6
TLSH
T185A279F753A2D56E8A115BF85A149E1B8F1C1326432C3C2589D5FE87E3A3033E16E61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 83ba61bb80cca26a56e1b074689589ca6de2ea7d6d9db3fb235e584a89950807
MD5 2c32f21d4007d2f1fe5288ca05ae0ea8
SHA1 a89bfef0ffa0b2bf140b86d5e9be0226baa20a64
SHA512 82e617ff8340b3a8c8ec04aa4c5d320b73da63a96af5cdf67a0842b4aeff12356b9d0d4d1d8a35362ec57605fcd6803484c8948f30ecae7cb677a83b2b4c574c
SSDEEP 384:DTe1I7EQYNyse9ejejvcRS03sJgMetrBezeTJ/m5JDJ4SeQGVG4TphrKY4Y9A4Ym:jQZQedzZq22ZgwCnjrBKZO
TLSH
T168C267F783E5D66E89111BF85A14AE1BCF19071A432C3C1589D5EE87E3E2072E16E60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ac9c2ecbda5f9d1d4502bfa77e2e9ac93edc2caa3a2d0e6440c908790bf7c890
MD5 51b5c995ba1d4c096decfff8c96e916b
SHA1 074a8b6bc2844b5fe2527c027a6bc13aeee2c77c
SHA512 f8ee10d7787a8e0a91225dcb3a66a74c4c91bae697e0660043b8843fa534b3e2da7438e4221565a70592c8b3f454deb0c3c879acbf542112b1c6859485fe9ef0
SSDEEP 192:sxZQRWyM/jK1Ml8Mk8/frsB3hVCIdp8YyHW6+WNmNIK/YvDncmEIgrJ:sxZQ0M8/frsB3HpyHbil/7T9
TLSH
T1F552D8166A349977CCDBD209FA45BB53D6F55463D3900E44A9FCCA0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0774e476e2876796505ef062375ead4f4962b867da4efeaf75051d898ba41692
MD5 9491abfb5178cd46f965f36cac229274
SHA1 ec5b901a46c5edecace341bf537a6abe405f6177
SHA512 dee19b9c146a190a34e4e80b6bfa0740f04e3ab95c1968d32bb1c3cb7c62bb06d7b4d698287dec450787fab2ef9e2d6e007df97339d3aef7a7b7ddf3affb56dc
SSDEEP 192:sxZQRWyM/jK1Ml8UQE98/frsxEhVCIdpuYyHW6+WNmNIK/YvqKPmEIg5BJ:sxZQEqi8/frsxEHnyHbil/mTl
TLSH
T1C452C616AA349977CCDBD209FA41BF63D6F55463D2900E44AAFCCA0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c54185215d12097b180e8a0b82a4fbbdb0a81abb1a85cea460bf0c7008309e92
MD5 5fe14028da7d61f65ef022f4fca2ea5d
SHA1 1d6187d2fde11fe0fc69847df0ee0a8a3a3d6a95
SHA512 c3a977ab8a430b00c114236ec987a682da9db4f5a35ee84d0b37c583a0338bc236eed28e47a84ebabb2a1b09264c29a6ebdd8c0feb8ff9a6ed0c5af6273894ce
SSDEEP 192:sxZQRWyM/jK1Ml8M98/frsx3hVCIdp8YyHW6+WNmNIK/YvDncmEIg5zJ:sxZQ018/frsx3HpyHbil/7Tz
TLSH
T13252D716AA349977CCDBD209FA45BB63D6F55463D3900E44AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a12348c760d311fde74dd3067abcfa70fdbe3463daa25aaf6dd8ffd8fb7aba6e
MD5 53e20860a718092d3ead528c61e425e2
SHA1 7664b8df4f86dec670e89853b74a3cb57073d814
SHA512 31076b31c0aa780a353846be17e6616671cb46384f774d6d9178b79900a5204d8f361f0d10b4d48ba92798db6d26ccacf55c390647b1202d18053613a578e3e3
SSDEEP 192:sxZQRWyM/jK1Ml8M98/frsxEhVCIdp8YyHW6+WNmNIK/Yv5VcmEIg5BJ:sxZQE18/frsxEHpyHbil/ZTl
TLSH
T13E52C716AA349977CCDBD209FA45BF63D6F55463D2900E44AAFCCA0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 057a958769cd8e9d6b39ea187b709708dae4eeec70216711a909b16cbe3ea11a
MD5 d4d175f17f1d8142d0471756afac3af0
SHA1 aece0b4bafa823630f9c62254872f057d877df2f
SHA512 a705f852e7be6cccaa88ec6eccb40c7b6e35a8ebe0b6157886207cb4b92bcba04a37bbef0f8bea5ed15880338c00bb25e1d0e0cf54f1d04d1bd07cccab9fea12
SSDEEP 768:d1seJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp+rooL:d1seJ3xWvhfwnu1jaVcL88pVU
TLSH
T169E20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\temp-index
Size 624B
SHA256 af6e427d733b8359ff287debca41f24da0c0d066f57e5be8df8602517c3eeac4
MD5 2a501f7bba954b2b7c162dde362b772a
SHA1 e0fb6455d1b0f13e7d324ea2dbff99e8a7a8c0b9
SHA512 b735545c3a95a167b30816034769f3da75b63f77de5822bdb96af3cbed7fa6f4ee521a09cfa901b37b2055320105ca1c2778f040ef798f43647ba14c8df78230
TLSH
T108F0D4144E800C26E528457725F6A0E463704EECB321D97B286C5C6E1D213CCB4563EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf17c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cf17c.TMP
Size 624B
SHA256 adabce0209997dcd950a5f06b71c7d981f2c80d3d66109a6b9ab749d1c05bde7
MD5 b28caf2771fcb44ec61a4de4369cf5d4
SHA1 540e5932aeffe4d122fb3b7f78c4752d1b43f5ed
SHA512 11ee9d6445d9a84fdca516b1d41672e1f8d82e194d00bbb64d04c5963917f1c107b6c4d9b5064e1e04a9e8a88ade400db69116de092781f0b45210e2d353c50c
TLSH
T192F0A3558B920D12D41009773EE7D4A8F3308D507672FAE7385C682E5D71BC959023DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f3b664a0a179efb6c9f37679410fbfcc6912c3357db955c20d3bab14cbb43e09
MD5 3df8d306b0a736722c8da2c4df60c427
SHA1 7532f3a6f6e72241bb40a611eae2a9c7a1a8759f
SHA512 3acabd25aa71fc0a9d1fd3138a6b5eb214ddb37995baf331ea8856fce059a2dcbdda274cdfadb5a52f8734726ef823b4e59b7f91bae953852e416488432cf6bd
TLSH
T140E0C0B62DD72450BEAFC3D120308090060A749EE941FC0E541FF6C310B231530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2c06584f9041d72df6993b8b1e80b3cb11db1e3818a7d797411c7e4e5e3d0fd9
MD5 54b0abd8b1f2179e57300d9814775b8e
SHA1 960b12e5a849898b84185087117112092647509c
SHA512 b31e82bd598ee89078fd43f570d4ba872f23462d18a33792cb7222a31f59177835bd2bc8ba215ececa1ae20a6ff43dcf627b313c409a805c0e5bb165baf92149
TLSH
T140A0022103544095D20002F068C20365A325FE107101174360E80874DC585C45D03056
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 80c8ae738ac46e00dc6f6eff227d96a9cee5827faa703ceff6afe7f8f969865c
MD5 044f04c0050121d8281b86d37de321cd
SHA1 bf23477620d627300a741ebbee9bb0bdbca429cc
SHA512 54ce0fb7694600686657fcbaaf8119b5033c778b7b43e4786d46eed5d731b1d2c8a252049f5832e8d207b4c70aa707f23ee9c2a2fd8bf79e04574c6d4ab1d3c7
SSDEEP 48:KYHIhKggkXyR8IHKZW0DypKIPKrCYfytJIZKSc0F:KYH+KggmC8gKZWiKK0KrCq2JyKScW
TLSH
T1D5C10242343F4202287E295CB2A39E368E4275633454A4FFBBB900A11E67E155EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5933a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5933a9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 adb271da95a3bbf5c51a09db11616ae3726e101f83b6dc9220b8eed1594bffaa
MD5 79049d5c509bb1d1106cd836314577c8
SHA1 ff77b011072dbb32c1dc1db431783eec826c199b
SHA512 c7f1bcae2fbd6424ed3faaa62ee1f59bdfd94f3998e3fa0d6c784e4e3f83660ba93ea5c835ea0cab646c611f0ac359345d40416a8b829da7b08e37a4a0bd6c41
SSDEEP 384:QiFiZcI8ksNW8TUNTUlIlN69E7UNU/uGdwdUy4C3:rFQ/fwg6y9LUUy4C3
TLSH
T192B208F248D7843AE9AE5743A77D2D128EBCD067F6849650B3D89A0DCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8072dd8f5444820512878066a17d3e703cb323bedc5fe7ebaf5f5b0cd1d1302
MD5 e133c838f7d79efac2c6db424fbbb76b
SHA1 4465496b0708bf010e95cd466c6fc8b9c9ecb884
SHA512 2429f935d671953e557f01447eba26b7813c2f67cc95d01e82470a8891aad587f6e0abb3ddb3874a11c3862275b373f5002f7c67cae5cdc87d9562d8f964489e
SSDEEP 192:lONnZ6vMtPQmiUyrHThTZS+FdLF847CSU/u:lONnZ6UtRwTFdJ5U/u
TLSH
T1DE020835AC786C6BEAB3AD45F48A37175FA4607BEAD05B50EAE86F1C00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 83ea76d49e6aef223e080ab8ee863e3671e7c4b09526d7605dad7317040bd304
MD5 ec440c3b8f6831a875ae5feeebe081df
SHA1 108f6bb3db9b27cdd93c8960c74b47e557923589
SHA512 ae414893380b6c06b6f13aa2c98fbcee3cc9dd2a1b5ab1304951b8a2fc2f47bdd3135e8cbc04b46ab0313c807dbb9423d84eaf3247d32d79b2c20705293d7109
SSDEEP 192:uiLm+xasuheOwQxMxsNWNQ2s9n3CQ1M7jAbQmiU1vm2/B4MTZS+FdLK7Fd3EX8z1:0ZcI2sNWN69E7UNd/uGdwdUc4C3
TLSH
T1E5726C726C745C3BA9A3B145F54A36139FF4902BD7C45F80A6EDAF0D05DA6A81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c16fe3cd12db6d014d03572ae3469ad2193023eabea5979fb89c8b529a3dd0f4
MD5 77a07b0601c89cdcff5ff778d250163e
SHA1 2d9cebd2eceacc4948aef4ebdd46785c91375751
SHA512 6d2e51b23d02ffcbca0bce57c0e3e9b65e4e47c1be4b4d260d174e37d56703f7b129cae8fc905b6beda447bb193ede4c5339566e27009108faafb6988532f2c0
SSDEEP 192:uULm+xasuheOwQxMGsNWkQ2s9n3CQ1M7jApQmiU1vm2/B4MTZS+FdLK7Fd3EX8z1:KZcIhsNWk69E7UHd/uGdwdUc4C3
TLSH
T1B5625C726C745C3BA9A7B145F48A36139FF4903BD7C45B80E6EDAF0D05DA6A81307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 1796e4a294484114da06cce13295b6c19d8fdeb6e1394fdab4418670d7ff6d56
MD5 0bcb0d129a3ae10412a3d804a369345c
SHA1 8327f0a7b51edd0a7dd47c480b70f281996d2506
SHA512 2117a30e2d5becb0efd538690df8ee24a908fa85f65b529da3c65fed048557b20cb2206be192c3cdf5d7a64be53b8abc726c6384b3dd145e76b73f623b27e273
SSDEEP 192:nONX6vMWPQmiUyoHChTZS+FdLK7Fd3EU80I6qAU/u:nONX6UWRhCFdwdU54U/u
TLSH
T1A1122C72AC746C2BAE937585F08B36135FB4912BDAC46B50EADC6F0C01DE6AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c8131360d93796ff12bb6143e293cc0e61327c2cf09e7acf7d289bf37952138c
MD5 cc425d7598b25737bd50f15f684548f1
SHA1 ca23acb4fd5cf0aff0ed0a552ec131ad2c74f0ac
SHA512 421ba562fe710dc258bba71e1644bd02dec957f3783d9ed295790d92b72ff37538f60b60b944ef5454aa61c212c8972e859fae640204005fa1d58fd8f56f5407
TLSH
T16C41275CA6E91118B3B37E5A9BF6A46E587BBD772F0A945D10110E4E0A23A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download