hxxps://work[.]ink/2nLR/madium-install

Analysis

user interaction
yes
max time kernel
898s
max time network
715s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/06/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://work.ink/2nLR/madium-install
Sample260623-thf8caes9t

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4928	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267042083610106"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{10476F47-C90B-4936-BB15-6157568FA551}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2648	4764	msedge.exe	82
PID 4764 wrote to memory of 4928	4764	msedge.exe	83
PID 4764 wrote to memory of 4252	4764	msedge.exe	84
PID 4764 wrote to memory of 4252	4764	msedge.exe	84
PID 4764 wrote to memory of 4252	4764	msedge.exe	84
PID 4764 wrote to memory of 852	4764	msedge.exe	85
PID 4764 wrote to memory of 852	4764	msedge.exe	85
PID 4764 wrote to memory of 408	4764	msedge.exe	86
PID 4764 wrote to memory of 408	4764	msedge.exe	86
PID 4764 wrote to memory of 768	4764	msedge.exe	87
PID 4764 wrote to memory of 408	4764	msedge.exe	86
PID 4764 wrote to memory of 768	4764	msedge.exe	87
PID 4764 wrote to memory of 768	4764	msedge.exe	87
PID 4764 wrote to memory of 1320	4764	msedge.exe	88
PID 4764 wrote to memory of 4756	4764	msedge.exe	89
PID 4764 wrote to memory of 1320	4764	msedge.exe	88
PID 4764 wrote to memory of 1320	4764	msedge.exe	88
PID 4764 wrote to memory of 4756	4764	msedge.exe	89
PID 4764 wrote to memory of 4756	4764	msedge.exe	89
PID 4764 wrote to memory of 3412	4764	msedge.exe	94
PID 4764 wrote to memory of 3412	4764	msedge.exe	94
PID 4764 wrote to memory of 3412	4764	msedge.exe	94
PID 4764 wrote to memory of 1904	4764	msedge.exe	95
PID 4764 wrote to memory of 1904	4764	msedge.exe	95
PID 4764 wrote to memory of 1904	4764	msedge.exe	95
PID 4764 wrote to memory of 396	4764	msedge.exe	96
PID 4764 wrote to memory of 396	4764	msedge.exe	96
PID 4764 wrote to memory of 396	4764	msedge.exe	96
PID 4764 wrote to memory of 3040	4764	msedge.exe	97
PID 4764 wrote to memory of 1896	4764	msedge.exe	98
PID 4764 wrote to memory of 3040	4764	msedge.exe	97
PID 4764 wrote to memory of 1896	4764	msedge.exe	98
PID 4764 wrote to memory of 2200	4764	msedge.exe	100
PID 4764 wrote to memory of 2300	4764	msedge.exe	101
PID 4764 wrote to memory of 2300	4764	msedge.exe	101
PID 4764 wrote to memory of 2300	4764	msedge.exe	101
PID 4764 wrote to memory of 4796	4764	msedge.exe	102
PID 4764 wrote to memory of 4796	4764	msedge.exe	102
PID 4764 wrote to memory of 4796	4764	msedge.exe	102
PID 4764 wrote to memory of 4804	4764	msedge.exe	103
PID 4764 wrote to memory of 4804	4764	msedge.exe	103
PID 4764 wrote to memory of 4804	4764	msedge.exe	103
PID 4764 wrote to memory of 3032	4764	msedge.exe	105
PID 4764 wrote to memory of 3032	4764	msedge.exe	105
PID 4764 wrote to memory of 3032	4764	msedge.exe	105
PID 4764 wrote to memory of 3128	4764	msedge.exe	106
PID 4764 wrote to memory of 3128	4764	msedge.exe	106
PID 4764 wrote to memory of 3128	4764	msedge.exe	106
PID 4764 wrote to memory of 5032	4764	msedge.exe	111
PID 4764 wrote to memory of 5032	4764	msedge.exe	111
PID 4764 wrote to memory of 5032	4764	msedge.exe	111
PID 4764 wrote to memory of 5152	4764	msedge.exe	112
PID 4764 wrote to memory of 5152	4764	msedge.exe	112
PID 4764 wrote to memory of 5152	4764	msedge.exe	112
PID 4764 wrote to memory of 5320	4764	msedge.exe	114
PID 4764 wrote to memory of 5320	4764	msedge.exe	114
PID 4764 wrote to memory of 5544	4764	msedge.exe	117
PID 4764 wrote to memory of 5552	4764	msedge.exe	118
PID 4764 wrote to memory of 5560	4764	msedge.exe	119
PID 4764 wrote to memory of 5880	4764	msedge.exe	120
PID 4764 wrote to memory of 5880	4764	msedge.exe	120
PID 4764 wrote to memory of 1492	4764	msedge.exe	122
PID 4764 wrote to memory of 5496	4764	msedge.exe	123
PID 4764 wrote to memory of 5492	4764	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://work.ink/2nLR/madium-install
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff837ebc188,0x7ff837ebc194,0x7ff837ebc1a0
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,16759178789865583368,15936557680196998964,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8882916422435141437,13908758485860286898,262144 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,9494807022961463754,54069433895288867,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17138173313015651733,10215634862148999744,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1594672880525909393,14844413450417184822,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,11613832292778478872,11148149152609165983,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,8426461645845121395,12515302987417787559,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4988,i,2784962625206620728,1854847150553129307,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5316,i,9667979725527833645,614820018902818214,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5456,i,16486841041734215302,14758154093550490060,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,16064547905745301311,5261091055311370057,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,14720689192496797778,11994889187590603540,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,9675439003571438027,6359800157752367326,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,9675439003571438027,6359800157752367326,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5296,i,11020296706479420119,18232929207301944893,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3716,i,11299491581778846953,11121069099801021067,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5416,i,2111326903177786238,6211153227040115614,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5432,i,10200054589056753105,5582863929935134555,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7084,i,13568800800095340248,6632948370465881770,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7288,i,17677301240372015951,11246108385672309500,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6344,i,18264866404790839856,17895630242697681554,2097152 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,1382986679312020494,14248186313115260853,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,8454446739816770709,17486727897640931434,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,5561307397543489434,10001741873306267538,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,1908089314545648143,16794302467407150134,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,455621725807458717,1232513901238076016,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,7502658954166793545,6959144691912465801,262144 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5250918925616989914,7325547152816175791,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16800250920423040077,12577561069938488986,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,10780983492618083152,11020073145447768277,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,14250110272712425219,15519828962560996751,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,5177244773501322140,7785831742349107549,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,5652043634284753620,7017403645289020032,524288 --field-trial-handle=2232,i,1036396111397123448,12024415361182020993,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 85dd34d12a80770fe509891f28b1a15e872e1b2fa26ebd5dfddf423908e498f8
MD5 e7de91b66ffe1ec0b523eb038ae01252
SHA1 3994db9faae61addd2aad96f9df37f835f58bec0
SHA512 7895bcc60b03c6cfa70df39d934dc04bb3bd4bfaaa211ddbdb4da172e746f288a7b1aab634b7803ab453e138826831f92dbf8e753086d9d73a78ec2488fe81ec
TLSH
T173E020C655C5C32F914DA48743B8732DD2513A0ED2C7691F9B2C855432019846A81590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 32bd6143c98d3c14129ce379f48e63ea4c030fdeba01dad65ba02a235a5a5aa8
MD5 3733e30959a00597fed39cd5259bd239
SHA1 c618e1bdc5c0a2d849aa1a6d3ee93d79c1f2e0a7
SHA512 58dae3745ace608389b795b2f4bb745f7f75e8492a30645ff0412f99ffa788fe9996c763f49c70632215133eaf27c21e6db0e517fd4420393d9ddea0bd14cde9
TLSH
T1CDE0208855C4C35E938564C78378534DD180360F92C7E96D2F28859430019C076895E4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fb1d9adb1437307132f5d733e1a70095b1c853b272c362cf8685ff02efb628c8
MD5 b0d2e7fb59c26d74e8ef560b77723470
SHA1 586d8ef483d69f0f53ae038c1217cf384dee62f8
SHA512 c1531f7a72a4efe245b2854c1017d89cbb5b19843bdd09a906c71c2dd9203185b28a1862673787dd1951acc26f96134f2e885328024651d953394a3ee889dbe4
SSDEEP 96:WPTMl0AUFHCEG7qpndFBIVYYFd47SrqkFfFJkC23zc1K8OoDlXZJNt+FZ9FOFoPC:WPTM2Amq7qB/aVbgc9Jkp3zc1K4DlpJj
TLSH
T1DAB1D7E0098C09A1FF256C3559D1CE897BB4B6F519EB6F72405C20FA96D23F092448DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9ea697b75430348d6f4fa5b471f0508385a0671ef6f200f3eb685b4b6e42820d
MD5 18363d7955cd8209e162e98033a40e10
SHA1 e06c051c1a0ee0440fe03fa079ac31cbfdd16e8f
SHA512 b7c2975ddd8f72d4e1bb3ae41487c8e16dc6a8a272d16d1a499ef6122bd4168e082e15aa455a808411cf0322b92dd258c6bb27f6a36eb6f0f82d7370ca939325
SSDEEP 96:5PTMl0AUFHCEG7qpndFBIVYYFd47SrqkFfFJkC23zcK8OoDlXZJNt+F39FOFoPLu:5PTM2Amq7qB/aVbgc9Jkp3zcK4DlpJNH
TLSH
T1A6B1D7E0058C0991FF216C3919D1CA897BB4B6F619E76F72405C20FB96D23F092448DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589d64.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589d64.TMP
Size 3KB
SHA256 40d91271f15799d963de672062614f647a43a8ed8fffffea87ac0cc0f54b4618
MD5 2b2a56898c14098e9bb21d8358e1908c
SHA1 fd32ac7f8dae305bd86a45b11537dd25db32a3b2
SHA512 a0e67c56c615a3ea7ef79fa0dfcbbdec466743df7b82cdbcb56630bce01118ad4bd5f3665d15c0a67d67288aacb18f382b69be6e0319d8751718dc3612f0afa1
TLSH
T156716B21094D0662FF714C3458E2C2487871BAFA6AD31FB6509C84FBABEA3F152149CF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 7a378ccc770d1e4295bdf24719951695b7481badf14a6cfbf66238dbfae7079c
MD5 1bf02ece2c7137de1120cf884d942262
SHA1 f05e8b3d913a406f05e1845103a32988a7efdc33
SHA512 9d9bfe043d628aba3cdd6ae89b5ff365bf6ef968c502253ebd337ab1caeb6dca08cbc7a85928a774c68f6bd0eae8dc135577634a876f9760372c33826935d826
SSDEEP 192:DWui4+rLeJGTQweNJIJpJik3Be1hJUE7OJ6Ju1vMXFwjXIcbfvFT8LeAoyJL8Ar7:DWui4+rLGGTQwebIJXik3Be1hJUE726D
TLSH
T1B222ACF743F8826EDC11A3F0AA246D278E591516072C3C9B86D1AF0697F24B1E2C1B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 3d9b7c7afbf1086ba488b39fe38586cf4295444cf83a73e510770daafc7c3052
MD5 edb581afe5ad33e1c1267910170866fc
SHA1 bf0766db23e1f5e43854a273f9a506ddf5219ef6
SHA512 71811cbe6094f1edf9a36ee5aaa7e0334ab8c6a6cfe3cc5816212f850ef790be84a75e52d563bb7a052b4f4fe4a75c3be9b50aded3662b1f48772416af599723
SSDEEP 384:Djf1T6v6GJBKLenoJ/CEXBe9tJp2YgWHgCbnMXFwjXZcbfvFTZaAoyDT8tWNKim+:Fv6TGsuk24/VUd
TLSH
T14D5258F7C3F8866ECC1163F0AA253D27CD591A15432C3C4B85D6AF4A57F28B0E291A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4be627f45dccfd331870434b76819f9d063a5c1bae1e6b3b70c5b9d77d25039d
MD5 c7013f1b5c0d28cb60383dcbcc237f60
SHA1 2cb2565e39c9fc1f2a8bd25583653d58348176fd
SHA512 8f6df39ac8a76719a3abc599efd974c968dd895238d3e115e8176eface8164008d19252b15d9fc69cd770505f43ba098ecd2ff50328d4d164679e9d81b5c212c
SSDEEP 192:sxZbRRyM/jK1Ml8UQ59G/fLs/ooQivIdpYBuJHW6+WNroeXYcDgeClIg5sJ:sxZbPq7G/fLsgoQV7JHbhXkS
TLSH
T17252E812663859B7CCDBD209F955BF53D6F51572A2940E48A9FCCE0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e6ca0f16bbb531a102d6b4d521058a93a1d1988c698bed315bd37ab87a32be27
MD5 22f90e6dc7417adf61622f0fb9e80937
SHA1 d735a01454b5bb76ff3db3bad5eef7b205572c44
SHA512 9aadf2cf20121da9325dae16cdbdf0f3f2ae58f8a494cca8f261513b87a654eccdaddce1bd2fe11d9994c20bdca5d332a9d467fee151e8929670effb032151a1
SSDEEP 192:sxZbRRyM/jK1Ml8MkG/fLscoTQivIdpqBuJHW6+WNrR+/YcD1jylIgrJ:sxZbPMG/fLsLTQV9JHbA/M9
TLSH
T19652D9126A385977CCDBD209F955BB53D6F91532A2940E44A9FCCE0C05E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 6a3b264110c09cc4deb29c1241c4f918d17f9376ed0f7e01c0a1339185cd3a70
MD5 bf6f65c5e83dbc4b0c7c3c05bde3b66e
SHA1 913db28fa031e5cb869eccd3b54ac41fb2e76496
SHA512 5c300b7c1338d31a62b526622250599c72c415a64802ff3202c9f18b243962f2fa9021332f420e924914fb2cb3e94e6cb6b733f912692f55e25cf71566503ed1
SSDEEP 384:sxZbSq7G/fLsg466s8qMpRiYnazAW8pZS15posJWeT+1QV7JHbhX2S:sj97G/fH44Mnc7WeT+uJJHb99
TLSH
T1EED2F805A924C8778FC39D19B47D7E3399EC50526285CEDA1AECCE0C01AD5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a2caae2d1f418b82055332f8c2cd6fd6beca4a543966abf3bbedf7d93685b077
MD5 1062f70c8dc1dfa9f3d5f998adee5ffa
SHA1 83289c30905a797709889f7803ed4a181f4eee06
SHA512 80d3d5b17f4bb4083b9fb15fe65e71e7ca605cdcb9d4caf1e3da357866884e457981289d76d636edadff1a2ac21c4438a36042c68a19be59572f463d81529fb3
SSDEEP 192:sxZbRRyM/jK1Ml8M9G/fLs/oTQivIdpqBuJHW6+WNroeXYcDojylIg5GJ:sxZbP1G/fLsgTQV9JHbhXpo
TLSH
T15052EA127A3859B7CCDBD209F955BF53D6F51532A2940E48A9FCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c596f3e49d00d8c946d1b51ad6eee0fe30c60a48981bd588406ee76e6d4ad6c1
MD5 1ca3f187cd65d287d38af3580d0666d0
SHA1 3b188b4b2c422b541ada2fe2ef2edcc37faec2ad
SHA512 7626bf61662e2b840bf9eac37adfe258c37e4fc7224ef7cc4ef6100a0c565fe9b2b4c80cf4ebd47e60c7481ac8f9361ef2f257757070231a68cd2ede5dadf0fd
SSDEEP 768:Lm4RkXUWvssVg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlLBERwro+M8zcfuj:Lm4RkXUWvssVgu1jacTLBWRbHu/j
TLSH
T160E20C3B284CCB7E4F845E9CEC2AAE966ED802CB97644D4447FA484C03C77EA51179DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\df71be4f-4cd8-4cf2-b7be-ce7c2f2ec83e\index-dir\the-real-index
Size 2KB
SHA256 e2e737495ba77faad1997e5ad302cf322b60d981d329c2670c4a3fd41d71c76a
MD5 bd1e3de4365ac80c0f5a61fba73ab3ae
SHA1 3306ef93d8b6b0fd55e65a43d9f82c8d311131bb
SHA512 e9b317345429234ca415013b91a6d2e53c7ac2ef8e515d25e8fa52c56db4f742e3bbc90a14283d718ab571eda2dd3c4ca2b8596499309c02f88ad408e52d1252
TLSH
T15841954D4E10596FE9B88573107210E43BF0C9CC6B5597135CBC223A6D4776D1DAF26D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c8bdc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\df71be4f-4cd8-4cf2-b7be-ce7c2f2ec83e\index-dir\the-real-index~RFe5c8bdc.TMP
Size 2KB
SHA256 1b17d86650f6213cab0a8eedca1c76a8dd250e9f029b6e323189506fba1e95fb
MD5 a1388079a7d577a80b27357b336f438b
SHA1 5caaf15f560cc27bd97084be924491be857b95ca
SHA512 88f23d5a7140c30743401a327ffc5d93b1908b9f48f4fdfa9a455a990e26981d15238947c855a669d6e31c5f1f73d4f51edb475840ec829b583229ce6e59e22e
TLSH
T1AD41C6898E42862FDCA44073098264B83339D90087117B47B8FC463A68E27BE2E5E1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9fc06ee9e7527e7a0a05f08f0663a43e4a8ea74b2757796231f3f76a3b3ddf33
MD5 c1e55f7b0e1d25d69830fdd93aff0d56
SHA1 9313d27b222f3d1894ea56fefce647cd3984dca7
SHA512 e013ef912d62b20213624e61c6e12fa8b54c714f174519fd2b5f7e556041c5c1c20e36100e41e1bdc4566ceb92a4e3f888b3234ffef6085663fe2e738aceadcd
TLSH
T15CE020BB2DE75C90F85F9BD1787118D541057868CC99AC4F1427EBCB40B17587456C62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 acd721bb00a75d153d144aaf3e7cd8f437ae0ac6b2eed40dea80bc171c5b7bea
MD5 a7b62251ed76419969130e09dc58617f
SHA1 196d4a58957241606262764be3c98e9b8a3f1612
SHA512 876e439ff10a8dd1eabfef3e8233677c645af101aba906f25b80cb8af07fb2efaf727b4170e91d7dbb7f28d4c6eeaeff0e4d7b0bb007dc08b4e683ef57747a3f
SSDEEP 96:KUQwKl2Cmz6KAASiWIKnqcYQK1Ca27+KYknJ6Ky0Kg:yL9B/I3Bl9g
TLSH
T104F15112327A538238BE350DA6A797775E4231733009E67F3BAD01A61E26E520DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58d9c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58d9c1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0a75d8f95507e60a63cb47fcd50c55a58c77f6e6a9e4719af6dd8a325bc98e9e
MD5 472dbdb5302648d57d35c0659c442f95
SHA1 8e48b0a9c2e8b1893badf7d4c38a0b0e617f8751
SHA512 70dd1b460bdadf644c816c075bfd6cec61b24586bd3a6a78544662308e4547c3348ce272ef8a92bb00015aa599b022dd8ea6fc29f6995e42c24f6d7048b6b639
SSDEEP 384:7tNn/s3n9SfsN9k2d50AR0dQ4sw2bQO8Fym+2FnB/Pb9oRfppx9f:7j+9U4dLEMQO+ymlFnB/Afppvf
TLSH
T1EF926C3359786C361EE3A688F4073A076EB44177A6C17F95D5EC6F0C06CF69C234AA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a9968a5771ecb5204370d24bd5930503abdcbc82d1f3a7055da17cf98d81d602
MD5 ce4dcba522e4415d702ed91e686e268f
SHA1 aa25a2228d5e7a402897ec94b7fede9c2b159a29
SHA512 20b4adc049e402ebc833294187a58bb3c70c55423ca5d93b25f1f0c35373ee41fc0358b2367d7260ee3fce1f2d1c21a48a643a09b717b00cb7389b48d875d6d9
SSDEEP 384:LiF1tNn/s3n9SZzsNH8TUNTUlIlkJ0Ab0dQ4sw2bQO8Fym+2nzB/Pb9oRfppx9f:mF1j+96WwgAEMQO+ymlnzB/Afppvf
TLSH
T14AC22AF248E74836D9AE9747B73E2E035EBCC067B580AA55B3D85A0CCD861BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9112c039da243cfaf98a8e0eff2a491331db2b4fbfa079792e0f36fe65ee46e5
MD5 d6c450b50851a7dc50c2bf540c6fa425
SHA1 226aed87277ecaafe5e436d4a1d8e1b32bf240d6
SHA512 e529f32151499f69493dd7e92964bb30c434d4e626b628b3e14c92213dc8f070d781cd407ab4f87c7e590889afd303eab88a27b56b99621399468b1db086b8ad
SSDEEP 192:lONG6JpdQmiUyHVgcQ4sw2bQOkptsFHNiU6:lONG6jQgcQ4sw2bQO8tkYU6
TLSH
T16502D735AD787C7A8AF2AE45F5473B276FA42137E6D16B44DAD81F0C01E764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8b02a50d31ba40533c28d17d8e8675043fcb81e86a49e68f47796a9d46f9cc1c
MD5 7e920a35b4f78f0a088060a41e78d6ce
SHA1 dfe842ec1568fbe05a1383636268ae508ce1c17b
SHA512 04bd9ce750b2e6488f48820cd82653fdb6676f5b57e9c3a0d988bbf6f3731155f497ea4eb94df739a46017c93df3d6c41d2ce329f4161d5150f50b8e3f15e24e
SSDEEP 384:BtNn/s3n9SfsN9kJ0AR0dQ4sw2bQO8Fym+2FnB/Pb9oRfppx9f:Bj+9UREMQO+ymlFnB/Afppvf
TLSH
T1C1926B3259786C361AE3A688F4073A036EB45177A6C17F95D5EC6F0C06CF69C234AA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd1aa1f27bfdf203eecb8128cea3829ed5cbb8e8129099249b991b7184080dd3
MD5 eb0b59e7f0eebacea65b8fe6e1066579
SHA1 7ffba92f8a1784de4539f058c6cdaa4c547507e7
SHA512 6864792b17fd80511843d8245df45cae5ba6877370720113824a0ad65d0e62f3280b694bc96c57eed1b5c214feb775c1dea8204f6e847deacf0383e6917416b8
SSDEEP 192:7ONQ6JpqQmiUyCVUcQ4sw2bQOkpFym+2qshsdqAU6:7ONQ6uPUcQ4sw2bQO8Fym+2q7BU6
TLSH
T1E912F936ACB8AC775EE2E541F48736139EA45137EB84AF54C5DC1F0C06EF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d07ce5d-fc41-4489-be09-81e3fa128d9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2d07ce5d-fc41-4489-be09-81e3fa128d9f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c85137f03c936d73dd9ff550df6463de16dbd52e356de6e8cd78e7d66a864abf
MD5 d03827a0524c97225d47e0aa25a5afa8
SHA1 76b00d798624549a179e44894e646e45e3136a64
SHA512 51bf614dc2b68b2f5fe48df1ff513fd14f2d1451e91b23a6563b1c6460319d7896ca5d3743b8665b77f8c37a5ea2a45938b07af1725da6b05cbfe88fca025309
TLSH
T14841D958B6E91148B3776F5AAFF6686D487BB8772E0AD45D00110E4F0A72B00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download