hxxps://www[.]mediafire[.]com/file/y2glghzzi0ybm0l/CryptonClient[.]exe/file

Analysis

geolocation tags

asiadelhiinindia
max time kernel
899s
max time network
895s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/y2glghzzi0ybm0l/CryptonClient.exe/file
Sample260820-vr2fbagj3s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317198489235283"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D91DA68F-5139-42B2-951A-2430221A8FEC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3244	3544	msedge.exe	86
PID 3544 wrote to memory of 2400	3544	msedge.exe	87
PID 3544 wrote to memory of 5036	3544	msedge.exe	88
PID 3544 wrote to memory of 5036	3544	msedge.exe	88
PID 3544 wrote to memory of 5036	3544	msedge.exe	88
PID 3544 wrote to memory of 1012	3544	msedge.exe	89
PID 3544 wrote to memory of 1012	3544	msedge.exe	89
PID 3544 wrote to memory of 4520	3544	msedge.exe	91
PID 3544 wrote to memory of 4520	3544	msedge.exe	91
PID 3544 wrote to memory of 4520	3544	msedge.exe	91
PID 3544 wrote to memory of 1816	3544	msedge.exe	90
PID 3544 wrote to memory of 1816	3544	msedge.exe	90
PID 3544 wrote to memory of 1816	3544	msedge.exe	90
PID 3544 wrote to memory of 3340	3544	msedge.exe	93
PID 3544 wrote to memory of 3784	3544	msedge.exe	94
PID 3544 wrote to memory of 3340	3544	msedge.exe	93
PID 3544 wrote to memory of 3340	3544	msedge.exe	93
PID 3544 wrote to memory of 3784	3544	msedge.exe	94
PID 3544 wrote to memory of 3784	3544	msedge.exe	94
PID 3544 wrote to memory of 4176	3544	msedge.exe	98
PID 3544 wrote to memory of 4512	3544	msedge.exe	99
PID 3544 wrote to memory of 4176	3544	msedge.exe	98
PID 3544 wrote to memory of 4512	3544	msedge.exe	99
PID 3544 wrote to memory of 1104	3544	msedge.exe	100
PID 3544 wrote to memory of 1104	3544	msedge.exe	100
PID 3544 wrote to memory of 1104	3544	msedge.exe	100
PID 3544 wrote to memory of 4480	3544	msedge.exe	102
PID 3544 wrote to memory of 2536	3544	msedge.exe	104
PID 3544 wrote to memory of 2536	3544	msedge.exe	104
PID 3544 wrote to memory of 2536	3544	msedge.exe	104
PID 3544 wrote to memory of 3976	3544	msedge.exe	105
PID 3544 wrote to memory of 3976	3544	msedge.exe	105
PID 3544 wrote to memory of 3976	3544	msedge.exe	105
PID 3544 wrote to memory of 4228	3544	msedge.exe	108
PID 3544 wrote to memory of 4228	3544	msedge.exe	108
PID 3544 wrote to memory of 4228	3544	msedge.exe	108
PID 3544 wrote to memory of 3964	3544	msedge.exe	109
PID 3544 wrote to memory of 3964	3544	msedge.exe	109
PID 3544 wrote to memory of 3964	3544	msedge.exe	109
PID 3544 wrote to memory of 1444	3544	msedge.exe	112
PID 3544 wrote to memory of 1444	3544	msedge.exe	112
PID 3544 wrote to memory of 1444	3544	msedge.exe	112
PID 3544 wrote to memory of 2504	3544	msedge.exe	113
PID 3544 wrote to memory of 2504	3544	msedge.exe	113
PID 3544 wrote to memory of 2504	3544	msedge.exe	113
PID 3544 wrote to memory of 3304	3544	msedge.exe	116
PID 3544 wrote to memory of 384	3544	msedge.exe	115
PID 3544 wrote to memory of 3304	3544	msedge.exe	116
PID 3544 wrote to memory of 3304	3544	msedge.exe	116
PID 3544 wrote to memory of 384	3544	msedge.exe	115
PID 3544 wrote to memory of 384	3544	msedge.exe	115
PID 3544 wrote to memory of 4028	3544	msedge.exe	122
PID 3544 wrote to memory of 1448	3544	msedge.exe	123
PID 3544 wrote to memory of 1812	3544	msedge.exe	124
PID 3544 wrote to memory of 3292	3544	msedge.exe	126
PID 3544 wrote to memory of 3292	3544	msedge.exe	126
PID 3544 wrote to memory of 4028	3544	msedge.exe	127
PID 3544 wrote to memory of 3984	3544	msedge.exe	128
PID 3544 wrote to memory of 3984	3544	msedge.exe	128
PID 3544 wrote to memory of 2788	3544	msedge.exe	129
PID 3544 wrote to memory of 2788	3544	msedge.exe	129
PID 3544 wrote to memory of 3788	3544	msedge.exe	130
PID 3544 wrote to memory of 3788	3544	msedge.exe	130
PID 3544 wrote to memory of 2960	3544	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/y2glghzzi0ybm0l/CryptonClient.exe/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90992c188,0x7ff90992c194,0x7ff90992c1a0
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,5377355620499107822,6453218879866246126,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6152616727643629439,16476715602032926648,262144 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,18205469679572236544,10103560484886527802,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,10156938872223041919,7501087067988821327,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,1845019569103777912,3769121452430845429,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,6752791121672770741,1859564628134076094,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,14031128694709514812,3952469593906542919,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,11042869592496242734,223328454903617527,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3707617052751173224,12521322647765221003,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5840,i,10532023755711695747,10556339750135221449,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3852565062395207200,14064587041308325146,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3852565062395207200,14064587041308325146,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6636,i,4213489319280073996,13730713193440155464,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6492,i,3692509550382684462,1158641206948651826,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6520,i,10663138990635428384,771003905324826595,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7004,i,11645637345736278831,11783874379843917947,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7196,i,17145534908113476813,5683266337083325207,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6572,i,11155104276003669335,4806635376776655791,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5868,i,3780354628067215055,17102214125826493938,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5884,i,14850580592195751023,3136435832890381857,2097152 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,9483342514484853211,8210616092353537752,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,17144138860118584629,155772335865795720,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,17473251532712940484,17805840806563803810,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,7720007816395728662,7648210141335776159,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7384,i,1617309687084554665,9437102178252741130,262144 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,16934176025410513393,3619721509360384524,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,10791491779299329427,1644493644117170854,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,10767830817807013048,7009431426989573157,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8339954452014904686,10342522374335327063,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,16497584075640841924,8432665623829395481,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,6399987778198569359,16594218439878218231,524288 --field-trial-handle=2616,i,5521222273313732056,1554743577323394991,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 074625000d60c9b8d0f74ba1d0a39aad0ea7507de272df417e16f7ee3f08c853
MD5 b29f1958bccee949acf62a4ff46420e2
SHA1 91acac204895e3c682145065899b453480f559e6
SHA512 a61500402bdb84dadab6291d9101f37ddc0bcf8c7687bab3dba57f58cbe5a3aefd2791907940d67e882f55171492a7df9d2cec72300ecd74c6f97d0baaa4cec6
TLSH
T18AE026D509CCC37EE600649752EC8B4CC3A0360A96C8EE9A170084987102048A38ABB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 da38ceff3751012e6c30b4bcdf3923c7da51c6ba61be51310db3ac367a851d4e
MD5 1df60ab4c3459965702d84f431c46467
SHA1 161ec2fb7fbbf9c0ed9fae16df4ef49e6a145d06
SHA512 2184592ca14e6eceb45a8fc931dbfd18b6fa83fd4441e704f45d808fe3c53e61443f0c89b7520a34cc72fb941ab245d16d2e84540d5319e3cf64b44d5ff48a0a
TLSH
T10AE026C416DEC3BFE60064AB5378B38C8280368E92C8ED1A570888A8F812440E7A26F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 112441639e8fc6432c255c86ea111bbf7d60689ff990f12fe6ff9c9e3829b852
MD5 1bfc5ba4b51fe8b00d78cb5087c45a6a
SHA1 bc952b98efb8512161716f81bd0e763ce915f408
SHA512 b74647b2eb91cdaede119b6912ed73556d775ef9896e4a6c00e7f2ecde7b7295c9fc7405694d9b25076e1fb75a569d3caf321925aeba03c8377955bce74d28bd
SSDEEP 96:Me6xM0/TtFiYZAeyoxGtMktZj8y5h59qPokdq/1xAd1+qb7Kme:16x//TtkqAtaGtMktZgy5h/yokdq/1xV
TLSH
T128A1D632808EECADDB6C39B11CD14DB374B18DD9F8871E9B50BC1F341A06B97B59A548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f9ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f9ad.TMP
Size 3KB
SHA256 25789d3adfbf6e33ab82489f9183e8c397cccb4d586873845b49d2df8b9bdad9
MD5 1044c089aa3b5b083eb1b00a16f79719
SHA1 e8ae895a9ab7adaf7a328bb77c2727602f7ffd65
SHA512 37a63c424513285a9a3aa74b3c2df0e5a4bd1b7f297848b552e1ce97048d00c2cab8ee9b684fd624f66cc917bf2f575edeb2e6b46ea2c5054e860ce09ac1ed5e
TLSH
T1C2714C361087DCAEE71D00706CD181F334718DEAFD475E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 97c7001bdf34663921b177ea72eea1c18db2291e25fe5393e2a2cd5be2d6f4c4
MD5 178ed880902a064d20c3edb928b9854f
SHA1 79dd9608f14e33a8855a5a7c4478f1506c4fe28f
SHA512 7de9957c981aef9da37b455c977ac6c7dfd2f838066732e5e7e7b13098051f393e6c49293fcd73cbd7a0629ada16840c66388b64cc497b84b04fc8fa8a6035ba
SSDEEP 384:DWQdEelkwf/7D1tBqecez5hJvYOMRJZ+wL1y4If6Ym1wtYKKsao9xiOK4VRmmAYe:pSviAwt/JzbB7Y24y0m8
TLSH
T1807298F753A2D56E89115BF89600AE1BCF1C1716432C3C2589D5EE87E3A3033E1AE65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 ecfd06bed855c9596d990a9bca7f93946620d53a8a4244166979a0a674e6f29b
MD5 a6fd8426db2030a05d86da8b70dac8c6
SHA1 976ad30b9354e920976055c9d5b975754b6564c5
SHA512 2cb385d909879b75e076dd66e2298de3de2079435700ff5e224a7caabd45f5015493a38204d2fd02b3a7cb354537c1a07e4a1937721a58dcac03969df78d170e
SSDEEP 384:DVI1dpYVv9usPJ0URezepKqJwnlQmJktgy4D2k4VY917SFYKhTvaPpViOK4VGmmZ:7EJk+RBtGJzbB7DjEV0H
TLSH
T1819276F783E5D62E89115BF856146E1BCF1C0769432C3C1688D5EE8BE3E2072E16A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f959f0cea10f8852c0b8ccdc9a24e256a949d2075bc82aba95ffe252f4e1fb6e
MD5 4b2dc6c56e82091a0202ea0ada8fe455
SHA1 7da5409881a0a234d95f9fee8dcdd68938077a93
SHA512 63a02f30b5d666add31f1a3ca8dc98ff53ac3af9d530284fd128f32ac7d0272e689bd838df7fdcfc3d9347a7a8a5924392d5208d1671a9b79e151cd2ae28d14e
SSDEEP 192:sxZJRbkv/ffsXityIdp8gHW6+WNmUT/Yzkei7BIgrJ:sxZJOv/ffsXi5FHb9/Qi9
TLSH
T1F422D8526E38A97B4CC7E21DBB15BB53E6F9403295941E48AAFCD61C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 868ea678666f0a5288054046748b000bb7ac219bff30a043242f5e38b747a34b
MD5 0fbc9cf2a7dbe965b80c67cacc0264cb
SHA1 af6648109879e0def83d5ad4286a59f94203982f
SHA512 143558bd39de5d02d656d63c84e155669a1a69be378c328caca5815b20d7150645736bf8189c8d9084870dc95580494ea12a5f07edd535ce868af403b15b41fa
SSDEEP 192:sxZJRbkv/ffsTityIdp8gHW6+WNmUT/Yzkei7BIg5YJ:sxZJOv/ffsTi5FHb9/Qiu
TLSH
T11722D8526E38A97B4CC7E21DBB15BB53E7F9403295941E48AAFC961C04E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 773479c32e732081a7f0bd282c7f0e0a2e439986bff9de861bf77dbd0b87b0d8
MD5 0d959f61bb567bc688256b2672d1a819
SHA1 99324fa2a85b9cdfd174d50b8bd63dd4b5a292c3
SHA512 f23839f68bb2e7652c0547fbc1e5bd97260f2b62c61486692632b9b0fd7a48233f20dbfe2ebbcd725fdf215377405b90ab5cf4f044a2ec8f759e0f25588ac821
SSDEEP 192:sxZJRbkv/ffsTctyIdp8gHW6+WNmUT/YzmeG7BIg56J:sxZJOv/ffsTc5FHb9/O2c
TLSH
T17C32D8526E28A97B8CC7E21DBB15BF53E7F5403295941E48AAFCD61C05E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 7c461dfc781e7bc541eaa5cb14da54d0981dc7898ef8b2219b49601980fd2e8f
MD5 c4fc87197faffd7573d23f8fe2f6acd5
SHA1 e29818013026ceef4a28d327a00d565edfcfb5dc
SHA512 91679a7957dbc18d938663bdff62611cd8d47701e8f48206e521736787031e3718b147a42027884d72980d02fe8d0aca78c861cc14f85f6cb4754700e1e19ebf
SSDEEP 384:sxZJOv/ffsTA66s8qMpRiYnazAW8pZS15posJWeT+v57Hb9/Vkc:sxOv/foA4Mnc7WeT+vlHbBb
TLSH
T13CC21805A924C87B9FC36D18653D7E33EAEC406222C5CEDA1AECCA1C019E1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0a400fd8ae1d7aacda32b4d41122d54110cffe659f25dd8b19f9515516870ea4
MD5 0e8b28943c7d087b05f843b4cb9734d5
SHA1 a661b03e0c98b83271e7d78324e870aba98bc609
SHA512 4317ab184c8d1cfabe9e4466ac4e99de0b7a538925bfb800e03a79e7a16c85187a2cb294e421947df5b7592f4a032347562be2d1e3d8ede7d2410d10194cc567
SSDEEP 768:+Ek7u70Wvqica8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBproyWYe:+Ek7u70Wvqicau1jai5LA3BCMe
TLSH
T161C2E93B740CCB7E4F801E9DAD166F977E9802C7A6948D4087FA994C02C77EA61264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 44e261d60639c9ddfe656982fa59d9c750c9a921914df8c9738bc210ef95d90b
MD5 4aadd1f16044323ed38b4fb9430fe167
SHA1 b055945e396a7e906b83e84f756343ec5e2350a3
SHA512 442bafd219133f5b2f2a7f7ea5368aaeb1fb4740ae4dd6df800e6f5c4406890eba6617bb0b09b23e21a0dd5645abf75d6ad604589ae470dde8a36973affcf460
TLSH
T105211C8A8A965A0FE9E085B60552B4B83374C900A322B3D3983D633A5C3579E6A4F0C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 a0a229ad61f75d32b54915f481e1c809ef136740fabb8268fc4e3ed57eda52fd
MD5 bc82e30ecc128483ebb3c62b84c08471
SHA1 ab045b8dc166eae33f7fd8733e49505dabbff07e
SHA512 fb80d4cb074fce0b2be96a10f8f14af7ad26de5e5ab0ecc7afd54cadea3fe67b494a6eca5a6a26bfdd13ca734adf7ced21937e1b601cb5400347c0bfed69bfe0
TLSH
T1552125894E91955FEAE485F2107775E43370D9DC2712A3A35C3C72752D233592E5F1C4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2fa378e5ff212d5b5b1cf07a91d58661ea1908ab82f17e050f4d2aef2f67f38e
MD5 2a6230722a370d2bd529e6f4606f6f85
SHA1 d4e26f31e8006c5de15dbc4725510eeee7447982
SHA512 100736e1d11f1b7e9bc47c0f4ce40b993625aaebacd988c12d0933edf8e6a69aae33693378a7806a16a7ba18f32c8cc2ad84fe89bcc2e7deab28e3fee147f94a
TLSH
T1C2E0D8BB2DFB1824AC7F97D538B1A5A1858539589514EC4E3167A29770F2761280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b71d9e081bc137380ace39ac1d4a66e6d22764560042b07460e2f0ffbd5e8e0d
MD5 62c12b649bad91b93083ecbd35cc666f
SHA1 312fb832938c3834460a0830d4e4f6b060375583
SHA512 c3f32729773710c2dc81e34f371b51180c2888f146132da8d406dce89641e9dbd46b19ba72e6bb5d194d9bdb1d3a298979adb48f67c4860bea95dc6e9fd85b75
TLSH
T14AA0027C22541001E4405A70749DE6517259AF605341072368D10BD789A52504581115
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 af3aa57ab1bc83d82955b58c6597abd610379590d9a32258679425d3959c1ea6
MD5 f8053dc9f7a215eaf919e5832aaf7bb9
SHA1 b97158295cf07d45f8abb6b822bed600b97d3aa2
SHA512 c515a336dcbca07127e15b6a474e025e9565dc8d68ca86429f673559249f5c896841937e78481496abb26dbaa40d9c4aacb4448fca6ca01528a124975c7a2d18
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcMqeInKPq8zyRyIfK/aYi:KIbCKcvNSKWcVewKPqqCysK/a5
TLSH
T15091620572BF02003D7E286E92A5C53A5F4235923458A47F7FA904B25DA7E224EFCEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593be6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593be6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 705507cc7aca4b3fc370d86bfea89e9524cd70da1b39ffbf9fb02e4e13e63905
MD5 a609ebd07c50ffa8a90de7b99344b784
SHA1 511c1eda34a38056d5ac6786d95217f5b15b0680
SHA512 f788651b8d2a780b90a1ae6f5d73cd190cc8e1cf986f3c510fc7318ff6e9b9154e3ed015ce2299f6f9eabc11f3ae35c6d2f2fe02647ac2b5440c43224cfe7f75
SSDEEP 384:4iFiZcIQsNf8TUNTUlIla2CVsbCkBR7LCdiIz/rgOSi+Ars74Hk:DFQQqwgOCrBpUBz8L74Hk
TLSH
T180C22AF25CE7893AD9AE9743A77D2E034EBCC067B5849A40B7D8561CCC961BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f378cadd46cf46ed2b1bae7d093b301e718a248b893d70b59b3fddbbcedea137
MD5 f9f8007c0052ebae0ca525c54be0c685
SHA1 64317b08ddb90f4bf4af1fb8665dd606a757fcbc
SHA512 77643e00282252a7dacef2be5ea74b35cd49ea264d6849420ff4b1d31b7c53e7c3052e1f9f67717dfdfa97035dfe1766dc36760d61cb302b03977ff700de5245
SSDEEP 192:MONx64BAQmiUyI1XW5GBPKIOCHruaDljU6:MONx6eAL1W8LLtU6
TLSH
T10B02FB396C796C7B9EA2BD45F48637175FA4112BB6945F44EAE46B1C00D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 33ace95a46420f06a8d9d20be6a58ee22a2e97f950c06df03ca089f7bfc9902b
MD5 420fd91ca97c3be273c2c251afe5fc48
SHA1 45311015a0d0b3c3eea1bbfd0a07e919f290353c
SHA512 5cfe4e6482280f06c3a87f07c54884659062353e5036fe0025523853315dfba2910d7de4f5bfb1dc01264f9701c57c87d1c580ddccf54e9f48551afabe025a0e
SSDEEP 384:7ZcIhsNFlhCVsbCk7R7LCmiIz/rgOSi+Ars74Hk:jhlCr7pNBz8L74Hk
TLSH
T116828E71ACB56D3A5DA3B551F88A33035FB8903BE6849B40DAFCA71D04EB6A81317C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d3fe75b4f69878fe965abf6e9a0d851ee2e5ae0b85a9e177c93df9b556868d4e
MD5 1f17a20b737aa7f92f3caf3c2fa262d9
SHA1 d0170d8f6854c8d3723e9eb69f4223e06567b37b
SHA512 80e36d04235a54182b1daa971d32e0f6c29e6e2c1c97dd4a32b5e351758c8fb25f4fa8efb7ce2d7ba5a866036d8fd362f1fccc64f641da2b4a0541bc0fad94de
SSDEEP 384:hZcIhsNFa2CVsbCk7R7LCmiIz/rgOSi+Ars74Hk:phVCr7pNBz8L74Hk
TLSH
T1C2828E71ACB56D3A5DA7B551F48A33035FB8903BE2849B40DAFCAB1D04EB6A81317C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 177117db8afdc918dc8ee1e5a1ff598a300bd8cf6c934512808d9cb3309b267c
MD5 5b5e358075a38e0bd33c7c2809a0b931
SHA1 12310df79cf9aa9c51d6b79c42244152df6ea890
SHA512 7b3e71bb2f91a093eb86953a4c9098225272d47b827ecc02d085c01a4fdff9f4a470c9ae6cfa9a5b41417b9a7cdf9dd53ffc308173687b412f275a9001710687
SSDEEP 192:AONg64B8QmiUyW7Xj5GBPKIOCHrWTPNSWwibqrU6:AONg6eM1rj8LCwiIU6
TLSH
T1FB120B35AC796D6F5E92B551F48632135FB4412BE684AF40EADC3A2C01EF65C2317817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

090cf3eb-886f-4e6b-937b-77162f0f896d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\090cf3eb-886f-4e6b-937b-77162f0f896d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 184af7d7eb5f0cda377e44b2d18578b6abceb489bb54fda3b97376a369cc21f6
MD5 130fed8339bbe720d26187f2fb07003a
SHA1 b168360038e26a0e33d58d927f68ed298f728542
SHA512 51a2d203d44e69a1bea441f10684d6c49d2593c79e103c92dc2b7815abfb941eaa98c6dfa73122da0bef3d3cab0cdf1d6bd2f0d8a8657d7af9362ab094303d55
TLSH
T13F411A58AAE91148B3B77E569BF2B96E447EB9772F07D45E10010E8F0A72A40C862737
MD5 SHA1 SHA512 TLSH

Submit Download