hxxps://www[.]mediafire[.]com/file/qelu2kumx78oqq5/Adobe_After_Effects_2021_v18[.]2[.]1_%7BCracksHash%7D[.]dmg/file

Analysis

user interaction
yes
max time kernel
600s
max time network
566s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/qelu2kumx78oqq5/Adobe_After_Effects_2021_v18.2.1_%7BCracksHash%7D.dmg/file
Sample260807-v8tf2atthy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305981760227239"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{64C4ECF1-EA5F-47F8-9F4F-B4A4DCF3CE2B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5604	msedge.exe
5604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 3172	64	msedge.exe	85
PID 64 wrote to memory of 860	64	msedge.exe	86
PID 64 wrote to memory of 3308	64	msedge.exe	87
PID 64 wrote to memory of 3308	64	msedge.exe	87
PID 64 wrote to memory of 3308	64	msedge.exe	87
PID 64 wrote to memory of 4500	64	msedge.exe	88
PID 64 wrote to memory of 4500	64	msedge.exe	88
PID 64 wrote to memory of 2496	64	msedge.exe	90
PID 64 wrote to memory of 2496	64	msedge.exe	90
PID 64 wrote to memory of 2496	64	msedge.exe	90
PID 64 wrote to memory of 3116	64	msedge.exe	91
PID 64 wrote to memory of 3116	64	msedge.exe	91
PID 64 wrote to memory of 3116	64	msedge.exe	91
PID 64 wrote to memory of 3976	64	msedge.exe	92
PID 64 wrote to memory of 2424	64	msedge.exe	93
PID 64 wrote to memory of 3976	64	msedge.exe	92
PID 64 wrote to memory of 3976	64	msedge.exe	92
PID 64 wrote to memory of 2424	64	msedge.exe	93
PID 64 wrote to memory of 2424	64	msedge.exe	93
PID 64 wrote to memory of 1948	64	msedge.exe	97
PID 64 wrote to memory of 1948	64	msedge.exe	97
PID 64 wrote to memory of 1948	64	msedge.exe	97
PID 64 wrote to memory of 1928	64	msedge.exe	98
PID 64 wrote to memory of 1928	64	msedge.exe	98
PID 64 wrote to memory of 1928	64	msedge.exe	98
PID 64 wrote to memory of 4252	64	msedge.exe	99
PID 64 wrote to memory of 4252	64	msedge.exe	99
PID 64 wrote to memory of 4252	64	msedge.exe	99
PID 64 wrote to memory of 4668	64	msedge.exe	100
PID 64 wrote to memory of 3324	64	msedge.exe	101
PID 64 wrote to memory of 4668	64	msedge.exe	100
PID 64 wrote to memory of 3324	64	msedge.exe	101
PID 64 wrote to memory of 3936	64	msedge.exe	104
PID 64 wrote to memory of 716	64	msedge.exe	115
PID 64 wrote to memory of 4048	64	msedge.exe	116
PID 64 wrote to memory of 1076	64	msedge.exe	117
PID 64 wrote to memory of 6036	64	msedge.exe	125
PID 64 wrote to memory of 6036	64	msedge.exe	125
PID 64 wrote to memory of 5604	64	msedge.exe	128
PID 64 wrote to memory of 5136	64	msedge.exe	133
PID 64 wrote to memory of 5812	64	msedge.exe	134
PID 64 wrote to memory of 5136	64	msedge.exe	133
PID 64 wrote to memory of 5812	64	msedge.exe	134
PID 64 wrote to memory of 5912	64	msedge.exe	135
PID 64 wrote to memory of 5912	64	msedge.exe	135
PID 64 wrote to memory of 3236	64	msedge.exe	140
PID 64 wrote to memory of 3236	64	msedge.exe	140
PID 64 wrote to memory of 6020	64	msedge.exe	141
PID 64 wrote to memory of 6020	64	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/qelu2kumx78oqq5/Adobe_After_Effects_2021_v18.2.1_%7BCracksHash%7D.dmg/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffeca6ac188,0x7ffeca6ac194,0x7ffeca6ac1a0
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,11386750098323117056,1755169101956809534,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16672342574457943485,4146545786931666445,262144 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13127111893610390407,13834852530451196804,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,3716913119975268441,6338371633836001712,2097152 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15685750909228603757,2198609627814248700,2097152 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,16463774364999815187,449454084086912657,2097152 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,286263022272509929,8811718523740486200,2097152 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5060,i,5829913291835766121,1068250557611098371,2097152 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5228,i,14601899348539431491,15663646044515277051,2097152 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5424,i,3919720512852764524,4355101597850222130,2097152 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,16043094225060004767,941391994648333265,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4240312582525112663,5689747683062241785,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,15382494897718063156,11806658380637315053,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,15382494897718063156,11806658380637315053,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,13913358496094967367,314683977971934681,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,6083822739039863937,15697284147378221825,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12372029800908060122,9342069628565159831,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,10903347490178324549,3285707634125396460,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,12968224116813622006,16542910767430048207,262144 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1044,i,11480780790608116289,11623636139879727069,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,17041501799175240856,13501788930911907393,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,315145562345883189,15841464805879316704,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12933091723242510444,15019867357482571640,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,17831480062234648572,12427076253841402467,524288 --field-trial-handle=2084,i,1894850654008617827,15771879712486015270,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d8e1e767b9790b3731b1f3b5784b93c589fd3991899ac383164045251d205982
MD5 6915357474192688c46176001179ca12
SHA1 8e0601fdc50de809afc38bf3a9f1f936280771fd
SHA512 ca3307b5457c8a8a5fa99812d523159df74f66da8b24879083db9d6e0f75051fd6a712c47757557589bd423565f7a0f338d2f75983ea13249f730c2a4f70016d
TLSH
T19AE0201412D2DDDF0D08E547A1F7B73872D17905FD8CDA5B3215B0541D41C174D95FA8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 7599d138b107385d94d7dc47d9d22f88309dafb107c96e2f2ddf2417fc6fa2a7
MD5 e25472ad4ea2c44b4d2deee9ef25c2ca
SHA1 b9ad2d55914981fcca77d38d9000d9dfecdb7df9
SHA512 e542f8de3e81bd61d183a533d1185207d88dd207139a208c098cc4f265755a169d56701eee2a29a740ab900b253c421c98495c66f16128aac5368dc294821206
SSDEEP 48:QVWBHYVYEaTh6lsGjnEp4Z1lzdsM7NKIRjgN/N30HARjqQW:QYY+fV6qwEp4Z1lzdZK4AigR+QW
TLSH
T1B581732B475D5153D7593332E1EB3A05F271854ABA732E772218EA3C663BBE0821DA0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 ccb7a2821dabf31b24e8c4d945378b7d94b948672f7ddbeee64bed5e9c84528a
MD5 f110df49094d1f28dd41af493223afb4
SHA1 8831a6dc6acc2d6ad9008d5353ea674348c438e9
SHA512 53a8cb9c4677384f72d254d89088e6b058fc43e617bd61a137758867c1ed824765ed2c1eb71e456b91f2e9ed3d0bd4df7a5904323108f2da563701a5862cdfdf
SSDEEP 48:UVWBHYVYEaThjlsGjnEp4Z1lGidsM7NKIRjgN/N30HARjqQy:UYY+fVjqwEp4Z1lGidZK4AigR+Qy
TLSH
T14481732B471D1153D7593372E2EB3A15F2708107BA772E772218EA3C263BBE0821DA0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c41feb356b070d3e8f1e842786db4c260bf7c71587de443f4aed64173766bd98
MD5 e5e4cadce76e15171e4f52c2d47832a4
SHA1 efaf99eb8199bff279a57083df6eac13a8c5556e
SHA512 ccc83eabae7856856420389add16f2325f63706d8e71e65a8d74e080984328cf669521a3d5c0b8da8937c14382a62aa52e746fbac92328b2f61cbe039231b9e9
SSDEEP 48:/VWBHwYPaphjlslHEskZ1lLdsM7NKqKgNWN3MHARjqQ8:/YVSvjqaskZ1lLdZKyVgR+Q8
TLSH
T18D81632B475D0553D7592332E1EB3E16F2708546BE772E772218EA3C263ABE1C21DA0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe587cbd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587cbd.TMP
Size 3KB
SHA256 4d472f25d6e77198cc1f6e79bf0d9bbcbf7fa56826d3767de07c687973de1e98
MD5 00957ceb96341f2b201f62ca840e55a2
SHA1 e5575e02328709b5722ac6d1ed29fb9184f71179
SHA512 64a39fbbcd63800e923734ef1a3eef49467e9d04768bdeed03f1a9eeb26d93acae9b6879bdd94088deb894fc13aa6599ae07c6237e5f2331f608664577171e01
TLSH
T16A614F2B1B4D0963E3693372E0EB3A16F0B1D65BBDB74D761508DA7D660ABE1C21D80C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 872f0a7137e162ec78f3dc6f7d2ac53414248fbcbd5475c619a1bdc1b79c0fdb
MD5 a11c29fd1651115bb2f08934ff1a566d
SHA1 8e85d4282501b9b88d294fd84349a4acf9aaaf37
SHA512 2c8d0349a89ccac346d3e36e8614251c1f3eeb576ca5b58e8cb27fdb52b585094b885db43acb477de4dd1ca89186a1b0ef7a49402c1a0a7bf927375ba0fe6e77
SSDEEP 192:DWdeWEkGSb/tBD74eOZaV1fk4qK6rsYKLAh4IY+9limAf7VfQhJRUHYH4VM3afoG:DWdeWEkGSb/tBD74eOZaV1fk4qK6rsYi
TLSH
T1451246F753A2D55E89115BF89604AE1BCF1C162A432C3C2589D1EE87E3A3033E16E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 39d861a60e21e3d394dfd64379d98461fcf5492e30add5b5d8f46515d027a46d
MD5 318d1b7fa38f4150abd7e767f1619847
SHA1 62297039181046c76fd0fc1a37691d433eb2432d
SHA512 b281c8fdf5bcfd3b49c85c02a5ec8430f0b16d3ecbc36c7ea7b2ea2405c832c944582a8d3a07e3355d72c072587294ba217b59bc5b416783f657abfa9349d580
SSDEEP 192:D/cplWtP9qqaOiAYeIoMxf44qSDTzYKLAh4IYEs1lObHf7VfQKJZjHYH4VM3suYt:D/cplWtP9qqaOiAYeIoMxf44qSDTzYKm
TLSH
T1273258F783E5D56E891157F89A106E1BCF1D0619432C3C2689D5EE8BE3E2032D16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 3bb6865b8cb8772fe44310a7d58ae36643370161ba46da9004873374553eb703
MD5 69d3e7710bc2e244fc2442bf7fccdfa6
SHA1 bf4e0f17f7ce9bf9c3d9721be30b7b993e86c389
SHA512 173b12684182602533ad93df6cdebce82c27ce08862f06f0cc2183511e159fd52a0fe23c7998d01fbc5cd79d0f7db1342058401be7a2d8dc4903eab6c4749b3f
SSDEEP 192:D/cplWtP9qqaOiAYeI2xf44qSDTzYKLAh4IYEs1lObHf7VEBQKJZjHYH4VM3sfBr:D/cplWtP9qqaOiAYeI2xf44qSDTzYKL7
TLSH
T1413258F783E5D56E891157F89A106E1BCF1D0619432C3C2689D5EE8BE3E2032D16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 36de3ab1df044f5fb0b513c6ef8854e60412c9968f654ba1b6d20c277860f275
MD5 47734a55f2efcdc4c9d4d97743cc6064
SHA1 369011889b7d06de256c06acddb5755f2a243db1
SHA512 6b8bc35f6f9445f227eeb39b3b4a415334ae4520976e19636b87f3ac9f23e2cc99e718021b15d29fca515b2d297148b41b4c70bc580832fc8859015d237ee1d1
SSDEEP 192:sxZAR4yM/jK1Ml8MkB/fjXs7USPIdp8vHW6+WNmVa/Y4wiWRhIg58J:sxZA2MB/fLs7USgmHb5/CPK
TLSH
T11C520952AA385977CCDBD209F951BF53E6F5447392900E54AAFCDA0C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ebefb9fa2f35849d0dddda12c0c29f47feba58e56664fbdf1621e8b56b510344
MD5 021a2e4dd08c395c8ee980d3b5c2386b
SHA1 308d2700afa4e531782897d9fbdd131a42ffe2a1
SHA512 dda2856ed33d3b706e73f048cbfcc84b23fcb75137272c297504f876e8734cbd90c164224be65dd3876fc1923f6d1912aff2d252bb9987d3fc35bcf8cb064a74
SSDEEP 192:sxZAR4yM/jK1Ml8UQKkB/fjXs7USPIdpuvHW6+WNmVa/Y4qiVRhIg58J:sxZA2qZB/fLs7USgUHb5/UOK
TLSH
T18352F852AA389977CCDBD209F951BF53E6F5447292900E54AAFCDE0C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cc3f5249c0fdb97933d26589fa7e00d134004c68ae6ab98787214f001d364fca
MD5 7b2aed0972cc513d1a8c418f9d579859
SHA1 35f0048e0394f90555f02bead7782d9e7de566d7
SHA512 9e460201db68f286ce0fc0c33ecd855f79bad27955801ff9cb1dcca6d902806c3cf1b5623b9ada3c8165944396ae6f0529476612e2b76ff78165b6d9279eb638
SSDEEP 192:sxZAR4yM/jK1Ml8MkB/fjXslUfPIdp8vHW6+WNmVa/Y4lwRhIgrJ:sxZAOMB/fLslUfgmHb5/a9
TLSH
T1F1420852AA38A977CCDBD209F951BF53D6F5447392900E54A9FCDA0C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 af48f1429d7228dc2dfc4bd8744a3209cc6caa3534b15dd530d93f33fb231c95
MD5 50815ccb671484f316e2d469507e999a
SHA1 4c9016a952eb089508054695dbf9b30e9217cfd5
SHA512 5a0e690ec9753a985d03cc14e9a3d94ae406b23f1baa58bd47131f55f6bb415b55454fc7cfa04557a789d2c4d29d934e8231efbc921cdb554ea2678eb19cfcdc
SSDEEP 768:+88iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd9ro2kcUns:+88iJPNWvx78ru1jahALocd2iUs
TLSH
T1BFE2FA3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 1b775bcc62f8857f15ee35ace95dd0bee3b6eac00ce001619246698565ebb1c9
MD5 afa410f92b8143413dd2a2db64f87661
SHA1 97f05e269ca262b209418b31c3650a42ce9d8806
SHA512 6897547e67a072f8250654345af3d20f8ebda3a2387f9dcb48a3f7f91d18e559ed197a2f511d69629714bdeb8319665f0966216a07b229848bdaf9bd0fd50142
TLSH
T15B3133494EA1CEAFECB04572167668A4737184DC2255B723583C31316E2775A2A479EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbbb6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5cbbb6.TMP
Size 1KB
SHA256 f670ac51d79e6d71ecc0725181774bb4ac4c439038d280c4459c291c97a8bfdb
MD5 68871a5e0911854592d153573ed9821d
SHA1 39a343e1fd2192442641e07a196cd3f4341f7ca1
SHA512 e775ce08aaa2886a1f6517417d69735d17969074f8938b16cc50443dc5c39e14b15583fc3b62577170f97b7cf078ecb73960ad7ff77be3166ec3438e9ffba013
TLSH
T17531124A4A91891FE8C4507B1A62E8B8733598408311B793A47C62799D25B9E1A5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 41fb6c07575131390eb0a26c546f3558274ab6a0d23fa828718033bac56ec137
MD5 914423d16bd8da5e40549126f5132592
SHA1 1fe8301df4794ad30a08d35a4edd9326e663b959
SHA512 a4c20b82fa1c39efd2820754c4fffd4de605b68084f722416dee38144e7937cdcb8c4001a67d3bbaa1909935bb6620e29842cca7de1a5260a7d544d2807c8d01
TLSH
T146E0C0F72EE72850FEBF63E1057098A00285B459D544BC8F142AFB8324613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 39e762b5fccfb2d45efe01b9583cdd53638999e426dc059c070fa64a6f07ebe6
MD5 e4cc0eed95ec2b757bc2fd54237ad02e
SHA1 f1e1ec5c295520daf082eb4f9a17f7f6e2e5e000
SHA512 762bd2317120b9ffea592d9dca28e71a8dcafc618358c6dea9e752ac6ae9fce14d1b1028c8fd367bbb31aee7fe61b56de58b7cb25f2780820d8934e3b319016a
SSDEEP 96:KAT6KAwieDqKcMJshK+s6qp3O/khmpK5gh8pVE8nWKaX:0Bx4shK+s6qdO/6mggh8XE8nWKaX
TLSH
T1A091200232BE13422C3E6D4D92659E5A464271A33159A87B7BF910B20E67E350DFFCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

726f6b8b-2a57-405c-adaf-0ef7cd0cbad2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\726f6b8b-2a57-405c-adaf-0ef7cd0cbad2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c5af27152fa22d4fa2b3bf1a2bfd98a3d7f242a82c0b76ff86facd6236c063e6
MD5 6f27f73d017629ef880f7948caeb2fbc
SHA1 45b2feeeaca7aef60f9d236166cdd4aa7779ea6b
SHA512 e48e32223d9fdb543a10b523cb456af5a0645e8f5beca8165656f7fee4e62c0e0195470e512d1028a125e3e262b0a71205388dd4c92883e59afab4da6e8c1625
SSDEEP 384:AZcIhsNVPG5XY/Txk0JJr1zaf5UrzbKDy:+hdKHhNaSb1
TLSH
T17C929DB05C78AC3BAAE3E554F48733175EB48173E7C92B94A5ED7B2C01DA498170782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 487f494de864eac2ad71f34dc6915bf50c2c5796d72da41f396eda831a879498
MD5 745b627c1ac04085a29f7ca4b962241e
SHA1 4f0cc498dfbb5c6f43c2f02c38f7ea12dc7c02a0
SHA512 844dbe8ff9c81546ff588ff6ce5cdaafca7c6dd0ff6001deb84ddd50e14e90730a34ae80f5dcfbe1386e59f85f6186b053c08775f78c808ab333134496244a70
SSDEEP 384:tiFiZcIszsNv8TUNTUlIlmG5XY/Sxk0JJr1Oaf5UrzbKDy:kFQQ6wg3LHhcaSb1
TLSH
T149C219F148E7943AE9AE9B47F77D2E024EBCC063B6845650B7D9691CCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3d725359300f4ddf8584f7067294c91a7580b8fd15cd8b4b464a64e85e355b60
MD5 0ab9c3b8f50ed946e38f779cad5fa3c8
SHA1 ae28bd2e803dac2311fd628447307b9d3eb2d6df
SHA512 cb1ccd8cb147cc52e99e3200db2cacb82e94a6d4b72d5af5ff582027a48cd8b81baa65bf42e933d79735af2b8449db54a6374eecaa3746bb3e1da6add639f911
SSDEEP 384:BZcIhsNVmG5XY/Txk0JJr1zaf5UrzbKDy:JhQKHhNaSb1
TLSH
T104929EB05878AC3BAEE3E554F48733175EB48173E7C92B94A5ED7B2C01DA498170782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3c8e8ee3c2e4e23f124b1a51fac9b6905f89b1af32f3691b15ed0832567c9cfc
MD5 7400722ffe846faff5b6a07c11470c52
SHA1 6f7d1c5b69ead25fe8fd5ca272e9f328177a0aa5
SHA512 7763ea85c7808748653ccf4d74d57e4e97f2ae510f7966ac2e9f5dab011dfb03031fbcf7022b0d13b9616fe335479273f8163f915a431136590a34174b313676
SSDEEP 96:ZqONkiQsjpfmUTmDK5ih/cIPURHl8h4otop59u5D6BhPwivh50xy0SFYKQAxaY6d:gON26kDfQmiUy9YqZ903LPQipFU6
TLSH
T14002E73868786CAB8EE3AE49F58637275FA5103BEAD42F80D9E81A1C00C764C1703826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ec86e096dd90e7a47626ce360e99f6a4e0cd3fb94eae0c1fcd4cdfe92e56ce4e
MD5 e7d1ce62837a3fa493cc9c14ae61291a
SHA1 9863df06883450067102003b561fdacbcdb120b8
SHA512 8acb9980e402117a392dae34efd5c008bdda8d7e5b6ebeaece3f34f3adbd0dffa72eebc86f899293d99fc84b31e810d1eaf6ade471082459aba3159b34c40e25
SSDEEP 192:7ONg6kjQmiUy9/qD903Lx1eYMSJr1gcR9iqMU6:7ONg6Y2iD90JJr15aU6
TLSH
T19D122A3168787C7B9DD3A854F48737235EA5412BEBC96F91D9EC2A1C01DB59C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55293405e1fceee8859533cdc9ab96ca2575619cfc4439992afcc602ae9e3402
MD5 070b01968db4d8162d4ab7fbb07e62e0
SHA1 4bd2fc8a2bc36ccf4ea2fd730159323707aec661
SHA512 08feb5262bfd854383aeeec00a863b5040b8788be6be8cc69b7832b0a07d86ee843c2926953a9c68cfcf7a3c4e7b375d563d911b0dae54c2658f6afdb32e7d8d
TLSH
T136410548B6F91148F3B76E56ABF6A86E487A78772E07D55E00010E4F0623A01C862B37
MD5 SHA1 SHA512 TLSH

Submit Download