hxxps://work[.]ink/2nLR/madium-install

Analysis

max time kernel
900s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://work.ink/2nLR/madium-install
Sample260812-q76mraycnd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1668	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310165296153677"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{841DD4A7-01C0-48E8-A961-7F56DBC56498}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1984	4152	msedge.exe	88
PID 4152 wrote to memory of 1668	4152	msedge.exe	90
PID 4152 wrote to memory of 552	4152	msedge.exe	91
PID 4152 wrote to memory of 552	4152	msedge.exe	91
PID 4152 wrote to memory of 1888	4152	msedge.exe	92
PID 4152 wrote to memory of 1888	4152	msedge.exe	92
PID 4152 wrote to memory of 1888	4152	msedge.exe	92
PID 4152 wrote to memory of 4492	4152	msedge.exe	94
PID 4152 wrote to memory of 4492	4152	msedge.exe	94
PID 4152 wrote to memory of 4492	4152	msedge.exe	94
PID 4152 wrote to memory of 5820	4152	msedge.exe	95
PID 4152 wrote to memory of 5820	4152	msedge.exe	95
PID 4152 wrote to memory of 5820	4152	msedge.exe	95
PID 4152 wrote to memory of 4536	4152	msedge.exe	96
PID 4152 wrote to memory of 3412	4152	msedge.exe	97
PID 4152 wrote to memory of 4536	4152	msedge.exe	96
PID 4152 wrote to memory of 4536	4152	msedge.exe	96
PID 4152 wrote to memory of 3412	4152	msedge.exe	97
PID 4152 wrote to memory of 3412	4152	msedge.exe	97
PID 4152 wrote to memory of 3616	4152	msedge.exe	98
PID 4152 wrote to memory of 3616	4152	msedge.exe	98
PID 4152 wrote to memory of 3616	4152	msedge.exe	98
PID 4152 wrote to memory of 3920	4152	msedge.exe	100
PID 4152 wrote to memory of 3920	4152	msedge.exe	100
PID 4152 wrote to memory of 3820	4152	msedge.exe	101
PID 4152 wrote to memory of 3820	4152	msedge.exe	101
PID 4152 wrote to memory of 4724	4152	msedge.exe	103
PID 4152 wrote to memory of 2264	4152	msedge.exe	106
PID 4152 wrote to memory of 2264	4152	msedge.exe	106
PID 4152 wrote to memory of 2264	4152	msedge.exe	106
PID 4152 wrote to memory of 3104	4152	msedge.exe	107
PID 4152 wrote to memory of 3104	4152	msedge.exe	107
PID 4152 wrote to memory of 3104	4152	msedge.exe	107
PID 4152 wrote to memory of 4484	4152	msedge.exe	109
PID 4152 wrote to memory of 5588	4152	msedge.exe	110
PID 4152 wrote to memory of 3020	4152	msedge.exe	111
PID 4152 wrote to memory of 4684	4152	msedge.exe	112
PID 4152 wrote to memory of 4684	4152	msedge.exe	112
PID 4152 wrote to memory of 1640	4152	msedge.exe	114
PID 4152 wrote to memory of 4848	4152	msedge.exe	115
PID 4152 wrote to memory of 4848	4152	msedge.exe	115
PID 4152 wrote to memory of 4848	4152	msedge.exe	115
PID 4152 wrote to memory of 1828	4152	msedge.exe	116
PID 4152 wrote to memory of 1828	4152	msedge.exe	116
PID 4152 wrote to memory of 2800	4152	msedge.exe	117
PID 4152 wrote to memory of 2800	4152	msedge.exe	117
PID 4152 wrote to memory of 3412	4152	msedge.exe	118
PID 4152 wrote to memory of 3412	4152	msedge.exe	118
PID 4152 wrote to memory of 1736	4152	msedge.exe	119
PID 4152 wrote to memory of 1736	4152	msedge.exe	119
PID 4152 wrote to memory of 1736	4152	msedge.exe	119
PID 4152 wrote to memory of 4984	4152	msedge.exe	120
PID 4152 wrote to memory of 4984	4152	msedge.exe	120
PID 4152 wrote to memory of 1360	4152	msedge.exe	122
PID 4152 wrote to memory of 1360	4152	msedge.exe	122
PID 4152 wrote to memory of 1360	4152	msedge.exe	122
PID 4152 wrote to memory of 5008	4152	msedge.exe	123
PID 4152 wrote to memory of 5008	4152	msedge.exe	123
PID 4152 wrote to memory of 5008	4152	msedge.exe	123
PID 4152 wrote to memory of 3780	4152	msedge.exe	124
PID 4152 wrote to memory of 3780	4152	msedge.exe	124
PID 4152 wrote to memory of 1536	4152	msedge.exe	128
PID 4152 wrote to memory of 1536	4152	msedge.exe	128
PID 4152 wrote to memory of 1536	4152	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://work.ink/2nLR/madium-install
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffa28efc188,0x7ffa28efc194,0x7ffa28efc1a0
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,3383179841443767746,12305689450504287222,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,9791454884702221855,3233912787800831929,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,4607963272060962928,4749585281484949485,262144 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3668,i,18089501761690866406,11424269441454266291,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3688,i,17325740099179232088,15678588808656003529,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,16426728975028091430,7670749324996184162,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,16828599455780813779,7114366474257038409,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:9
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3820,i,17682759438208446628,2399595518076947118,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,964093529281662367,2928271444253738312,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,2630685064594055659,9634333382998862872,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,11324352051164542911,2240498152414591251,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,11324352051164542911,2240498152414591251,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6696,i,9588692288082544903,16917845491264125650,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3852,i,12729646437422992618,10286594312241802899,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,4017419053340991949,4510296687740053578,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,18038918501865755467,10832766817858673687,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,12520747147092471363,8789977929844805888,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,3861394250414805556,5483209223567361977,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=800,i,3691075444785093803,2177124850849402441,262144 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6180,i,17846640384755000014,11160009193538610634,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,10001516808626749598,8768714351635462562,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,8347202537948784197,3879916502632548683,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,2511935347271824780,13061367457565324953,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5208,i,7946275164789866996,7622799364318611479,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,15871683807646432269,17419723092393730238,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3880,i,13485363897681622814,658657252247987243,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5220,i,14356967136640334676,4018837940915928051,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,1437998236251452215,11782381264110148001,524288 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4332,i,14907808111688007463,2875148658825368342,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5356,i,11379546203292001347,16332644769682161536,2097152 --field-trial-handle=2212,i,12491020146525876746,12423688813462775320,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3288

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7b1bbb945117ec97d6e5fb9ed0e217fdd75136a95c2fe579146ccf3d88865008
MD5 e341733d61d8103ac8da79787341d547
SHA1 945380b235cfe6bb2e3bd7b25785c2199339d811
SHA512 da1c9f9deb716b360ab9ec21aa0853844a168321f1b8799fc6bc0522a025bd1f56d86d9eebf952e8f2bb7748fde0a7faed8746488e9e520bcb8d832639dd9585
TLSH
T198E07DE547CAC22EFB82E54B5368670CC2807A0BDAC8B94F5700D8CC70C6B40B7C3690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 40daf0c67f6fd7752e5dffdbf99ff8502e3cb63bb58241cb2d2eba5189d4357a
MD5 b8c05ec3458b6b244dbbd12d69237354
SHA1 1eca7c8292f5832f5b44767daebccb267fe868de
SHA512 4534746874f34641a854decb75878380e4c2fbf098d1f0fda2490d12812c55ddcdc6808927451ecf945fd69a86b613ab19535f4187fdd4b0463715df3aeb8b4a
TLSH
T1A8E026A40ACBC22EEB80A8875268A34CD290360BD3CDFB0E2704C8C57405880E6C3791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 13e5253811f9407612cdc709e9924664ed583e09c3336c5c663b29a9736e3200
MD5 4ff53d11f5c29b1c31d1ec4de644b973
SHA1 b4091a048449d50ccdc36e77fe3f757118b6e189
SHA512 aba24f2ef67e493a3dc94a083465ff6e4cc0ec68fe993a8ab3f62f55057f4d19c4d1ae90385c23e6f05793f9efc5d510786af3fb6fdad889243015db6a1e5c81
TLSH
T1D0E026C744D8C23EAA53E54B6368672C82B43A0F9ACCFD0B17008984B089E41E2E37D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 40b7c47db74e883404b073c2bb03b9d8244385251953797280d962043c48803c
MD5 5a770d9904951d675e4847fa8d17e290
SHA1 1064ce6dfc385f21e365db66399283fdca4e73d4
SHA512 1fb7ec226f4da7adaf76abc12cde1c70c781509645fde1ca81c9803f179f3a703346af32ee9bfbc2bff3c3443390b3b8b2d188903727d95dbd02de3e6a8d3abd
TLSH
T175410C71173B2DC1CBA1B9B52DFDA65C3F75E86A450F6F50540322B4BE0E74AA0A10D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f310db5675f212bf83db9f4b85cb6131219d4a300f7a6fcb987d96b963fa59b0
MD5 9255d5f5e63d4bd595e208522a5bd9d5
SHA1 8422e729ea0dc89bf2d1cbc53e77058f7388ee46
SHA512 7454ef3670ebd584f4c4457f271d8fcbb8ce2a76ea5b8b70227d76e206143265e82a403d46c57363927476be4881ea2b73e8de87dafeaab45dd53b8462134cf2
TLSH
T1EF416E71437B2DC2CBA1B5B12DFDAA5C3FB5E89A090F6F50040321B4BE0E386A0A04D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 29122142e22d3cc4b53c597b2d1e633c7d9e2b542598b70522f70267185d9a23
MD5 a4fe13e9c6a30c02eba69122afbc3b9c
SHA1 664558e728cfe61a2bcc8735dc7a8f2a747c8eb8
SHA512 3a923461a860eeedf10d46065d1bf62c9ed52e3e86ee3dbdbd5e677420f389d3095b771a6fdbb47a8f7552c6fbd4423d03bd625d8549e5aba5a71e70fdba2865
TLSH
T19C414E72137B2DC1DBA1B9B52DFDAA5C3FB5E85A050F6F50040321B4BE0E346A5A14D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c486cfd7593776ea654ca4e44e6de2573954ff07b9ebfd183d462a107b36d102
MD5 dad802b1f2e4cdae80e6864fb985cf61
SHA1 024cf694a6158373c27657d1995df075ad80fe8d
SHA512 b406c377340593d075902cef20366e60221c3dabf70dfdcd42c593d09234f8b8842e37f875f989fd881cefef4137863a9c4c607e8a1e71e653bfc386cc95a3bb
TLSH
T110414EB213772DC2CBA1B5B52DFD6A5C3F75E85A040F6F51440325B4BE0E386A0A08D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 543c656f1286e293b6c87124d238d5fe9c0766ab3660fdd11e7aa22d3b490f38
MD5 07ddb749ef850daaf9854c81c8947e36
SHA1 cc14bb755ecdd5e8d90fa489b67bab61137e24be
SHA512 0f1863a5430e7f2f9cf870498ac4334006df990745e22876941a24ea62c0484aac821b97e8ebc688f9b16d4eef777aaf8bedad2702808bb360ad50623d6f553b
TLSH
T1AD414F72137B2DC1DBA5B9B52DFDAA5C3F75E85A480F6F50040321B4BE0E386A5A14D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6548be7afa2fe7c359c5d43231c2f0fe2353769bf7a8ef3d83896de4f6827946
MD5 8c9e0fc9fb902a3a81e237167337a597
SHA1 8d1289117edc7a1728fede800c5bd58bfa3d8852
SHA512 836ae88c2adcd7e525c5d26cc29cc1bc1cf16814590394e51412c237992ddda59e0dd404c9abb165293f511880aa5320e8e13731a6f8cec1bcb8b53759b0b91b
TLSH
T184414F71133B2DC1DBA0B5B52DFDAA5C3F75E85A450F6F50040321B4BE0E346A5A14D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a35b3cc2266d2ad93476bc9d0426e0a3ae72b96c29a8529c1a94486d770fffdb
MD5 80f50e904e2e8b94572a3422b7c899a4
SHA1 eadfcb5b04a4a2da9f6b1fe9fca7171e3fe1ef77
SHA512 ebf784487bd95371cc3db6675bbd923efa6105718d399980b994102ac6fccacdab703e146fafd200bf18f24a9c1d77ffb269d82b07f857e9ce82592957466da7
TLSH
T1EA414C71133B2CC0CBA0B9B52DFDA65C3F75E85A080F6F10140322B0BE0E74AA4A10D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e08d0ec96cb53a03457e7abfc3e3fbf9aab13b193d66abaa50077f2b13f9ac07
MD5 21235cfc7d24f7af2a9d9171d602c19e
SHA1 05da18cce6f81e5b42d227ace33b14fee12abdcf
SHA512 b8f4840d8699c9a39eeb3a5f9cbd222c3eb66a8cbe8919e40eb9683b61fd7b45fae0899736eb53ce69c2cf2f8d1d24e76d4110ae988714e6512b0806ee06bb4b
TLSH
T19E414E7113BB1DC2CBA1B5B52DFDAA5C3F75E85A040F6F51540326B4BA0F38660A04C3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 18fe33870be7d5a11e557ac366083b2d22d50038234869805c58eee15036877a
MD5 91667922aa3c91022991381b2a96e4c7
SHA1 c51914b576476d19a9a4fc68c18c523bb6e142e9
SHA512 4227875937ea786d766477de5903bc30e97ad842f9589bf9ddc2e4ed4dbcbcbdaa86180ec4a0827db2149fa99e3912bb2c5de3ab65ef52fc51352276250ee431
TLSH
T1BD419DF383F5866ED91192F0AA146E2BCE5C0515431C3CAB86E0AF1B97E34B1E181B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e9a013074b8f4691e4420182850d7926e1687bdbf8b414b0cfb1cd6fa6a011cb
MD5 df3c41b6372a81711f8473ab70d7a04e
SHA1 4458f1aa6d5d72bf75f18e6a251b22fe27435de7
SHA512 02203c009a037b0773b0be125e29d9242fc0d2f8eef39eb76c3f5be0361c40e35c27396752e432ef317a6abe65e73420b8cb9cdfab51af3e706eadac69b0002f
TLSH
T13B518DF387F9866EC91192F0AA146E2BCE5D0515431C3CAB86E0AF1B97E34B1E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3ffd2783d0eb375d3dbb0ce3e6a8eb7e1f7a6d5224103626f1042c7db6b4e690
MD5 e1599e34bee0dc8c125f0061ad9d6619
SHA1 f5266f4a64ef8df84dedeb1cac1a6b43d03d6e53
SHA512 161ebd24fd11abc6175636e5ff74cc963161963270fbf26e45c24209ec0af3eafe4129359f41dd8031682f46af7d4ee91cfbfca2dd30dbe26660989b77d32341
TLSH
T1CD519EF383F9866EC91152F0AA142E2BCE6C0515431C3D5BCAE0AF1B57F34B1E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c8c1cf75-1392-4956-87f3-755b450e46a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c8c1cf75-1392-4956-87f3-755b450e46a7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 138ab5d9ab3cc8413c64c7cee029f0b350442805c5159a4663907bc134421f7a
MD5 5e7a9cdb256a77c24c6a69da9bde035f
SHA1 4b2c2034f738284bd1e3fe979306b4eb00fd8d9b
SHA512 fa489632c2a8c624c2f9f0d793c1f4524fbe1774d7da8a4a7d61f8a954618fddf9cae3dadf5ad1135fc357d273294f325cf2c3894df97f59bf4bfe5039a56c13
SSDEEP 192:sxRbmbL/fls+hkKCA94/NzoA8pTqJ/g6+WNN5J/YD9HE6STGTyIgIJ:sxRb4L/fls+hkZ8hi/55/oSxs
TLSH
T1C142B7166928A97B8CC7E21DBA65BF53E3F95032A1D01E09EAFC961C14E66DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 deb9c8f2d23b3942329231b6e2769c089b879ae2a91f2818bd08e028cbd9e6bf
MD5 c3a486bee9a62e7ac0a0619baa559f50
SHA1 64abc92e868213345e7e148d0b48b5eb2b63b394
SHA512 e6be4117516294fbd06217cbc194f68db32458c5c88bfeef51f2a75cf1d172bf4ea09ddddf2c2ad426b59da86ab1698512ae111fd5c66297f31c21f682f0c73e
SSDEEP 192:sxRYmbL/flszhkKCA94/NzoA8pTqJ/g6+WNN5J/YD9HE6STGTyIgDoJ:sxRY4L/flszhkZ8hi/55/oSxA
TLSH
T19F42B7166928AD7B8CCBE21DFA55BF53E3F95032A1D01E49EAFC961C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1709ffedf81f9514f89f43e5a43640272214fcea22c9bab185144b14e7d1c9a6
MD5 82502c71d1aaebf0c09d54ed8568d4c0
SHA1 3e48d2e35be8967fa4928184bc0cda263f75867a
SHA512 cf56cd797f61efce8aa5a054d3182edae68d1466a16d97f6e9f775b018e4aee9160917f6efcf825b14adeda1f8fcd432fb8d67a8bde917cc9b772c907acd2703
SSDEEP 192:sxRYmbL/flszhJKCA94/NzoA8pTqJ/g6+WNN5J/YD90e6STGTyIgD6J:sxRY4L/flszhJZ8hi/55/zSxK
TLSH
T1B942C8166928AD7B9CCBE61DBA55BF53E3F9503261D01E08EBFC861C14E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 5aa3850f7a8c21fe9b22646472b1dc9ea27eb6a2f97ae272ac50da0e0681654a
MD5 ac86173e02dc0766025ea0e17e37e9f0
SHA1 df3145423f6f4ae904c3d320cd3348d049ba33ca
SHA512 d38bf33476212e905e81408543b1d557ee4ee3b700f5412457802aa26970344198ff23a4b1d3c22dee8589e68c13c3afa87ed2c91e3cc27305f9d55277498ae9
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcIropDw:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VW
TLSH
T116B2EA2F200DCB7E5F800AADAD196FD76D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f6c51f03-d02c-4d2c-888e-70feb62db043\index-dir\the-real-index
Size 72B
SHA256 13b95d9e8bcb2aff98841cd5449cefda38c34ec51888bc1fe5c413a035e5e3cd
MD5 53650c89ad8d793d60f022d022f0fd90
SHA1 8c324e652606c68945461640dfdb25f8d20dc63e
SHA512 bde0e01fbff36ffb9c91b40e6e0669da7fff29516565e0f69392b3cc1a59ec2185906c3aaa92d9ddfcbc2a40231f568d63fb66838ea811432ccb13e8bf385209
TLSH
T1C6A0026156C7089EDC1A257411D361E952335D582C91C71750DD1059D9920C4D141001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dcf88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f6c51f03-d02c-4d2c-888e-70feb62db043\index-dir\the-real-index~RFe5dcf88.TMP
Size 72B
SHA256 f0004eb8076e99222fb98ffcb9ace3954cda378873fa4e2bedeaeb25af9b6d9a
MD5 fa6ef4bf93fcc9f66bdcbab061f598bf
SHA1 e0d0d39167093f19688a02979cebe13080b61515
SHA512 9c0cc439904fe2302ceb6fef7886b42611acc656429c175511701b17e606b7f36e879f1d1c04aab48bfdc8433d24dd162a8b3fd64b4ad2c48d2ad8fcbf27ba60
TLSH
T1FEA0025247C74CA2CC1269B42023835953928D146055C31F70D56459DC930C09581019
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 42ed50d0ea401451d76fec10d5cf337f5412b31bdaf51697b9510ca1b9c58df7
MD5 a97a36072e8d40dbe0de38eb27c187f8
SHA1 2475aeea730d9be47324bdb0df3357bae58c098d
SHA512 df538251e1a3f7845d05414f593c1c1e68047ade7ae0d6b9981d17db45b432a1678e11045a846713cc32da45ead22338ff6d7e014afe777f89c518569d891791
TLSH
T113E068761DAB2850ECEBC3E1187144640140F8288548FE4F402AD687C0A13551816C66
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c2e66853810bee38cb5a48d501e03e3fa6547f9de74b3717ed7d897411457aad
MD5 d52db92f625e040765f9fae0cc1cf468
SHA1 c7df5527d9010fac67a38a6d9917fe46be3395e3
SHA512 33cead99bc2a55b377bfaa74e5ff57bb4eee409b0245cdec4893db1b202e1f88befd1e461592def2e1d43eb901c83865da940c2f34c6caaea13b5f44239555d1
SSDEEP 96:KRnwVRnlV5WhOUgZ5K4QgX5cfXWJVKH4Jco6GKQWOTDgQQK4FgyQcAQjSvjSKUUj:CnwVRnlV0hOlZzQgXGfXWJVKH4Jco6Gv
TLSH
T1B9917411747F06D03C7EA98D8269855F4782B0A23618E43F7BA915E50F6EE125CFE8CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 c7d8233319fb8b5137d3d30bab5b4fba5ffddfddcd1413dea3173a8fc7bc58ec
MD5 2aa4e8256c1d438a6b454e6f092574f7
SHA1 2b54a19605efaf72aeb7443df91dc93be404b389
SHA512 59ada4ef83225bfcf95d7b70a1aaac4300c282b694823e08a0130fdbe4202b0b5d635d5b25212622695e288343475f2ee42c09a2c0d46c7b8540c474c696dc59
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

24f0f33f-e520-404b-8356-d084bd63dcf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\24f0f33f-e520-404b-8356-d084bd63dcf0.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4e0a8dc689fe8b29fd97320050fe7cf6f7149492d5463f504ed8f2c21f17dd17
MD5 5a26bbae3f9b317afc7a9e0909180eae
SHA1 e17ea481997821bf225fb33cff84295ab16c5ced
SHA512 13e3756439409061d8e9e93744a1146807812422b16f37284482bf96324dffdaef1ea6ad449e9f6b22a0ccace8fd0c5e82b2fff52d15eab1ac2fff06c8f4a85c
SSDEEP 768:Yrv+4UNbdS3kti0ZX4rEnjN3Gac1o7eVH1SCz:Ybsbg3AV4QnjMa7EH1V
TLSH
T10703BF3669A89A739CE7D78670837A037FF4525381C50BE0C9DD6B0D069B9EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 00eb697d4ea65054cfdeebb5109986de24f19e83ebdf3248df859172309ad044
MD5 aa8b8a7b41a28aa495c911b09148eb88
SHA1 84cde8ef88bc992ac6a4937697a231393efa79e1
SHA512 da309a9fb1dfdf4230f4cf7de70dc3925bda29334cf88f65f280905782e8d9402814ac0a5476d88c8467edb9e6826935782396a7e329a175d214cb3aebca1f86
SSDEEP 384:oZcIf38Np3glUNliWZlf8hyEGSfk3ETImy2rEoajo4cdR8eHhVODjYPNDUM70s8p:Wf3I7i0ZXerEnjN3Gac1F7A
TLSH
T18EE2BF757CA49DB38CEAE68675573B03AFE04353D6C40AA486DDA70D01D7AED130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ada2e51cf2e1dae5a935ed22925e2c2d8705bfaea8e2eeda3de8925f0a1808e0
MD5 8c9c859ec93b09ce7d5ea5e819fd609f
SHA1 2e908e3799356af3c1f5ee4cdda3024df26b709a
SHA512 1644a6722d4acb9f5caddde9312ec273126a084c4b41fb97a66842c18e11281f18af860e87ab3d82b74c37ef993d17b88a90985e5b26353cc139f8e27ad60a09
SSDEEP 384:YNFiZcIX38NL8TUNTUlIl3glUN1iWZlf8hyEGSfk3ETIuy2rEoajo4cdR8eHhVOx:WFQX30wgV7i0ZX6rEnjN3Gac1F7A
TLSH
T1810349F618D38973D9AE9B83673E2E029EBCC253B5844590B7C9550CDD876BFD306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7fc564ed70bbb5a5d5bddafa2b41bf3ee33e0adaeecd561355b0719033b2bebd
MD5 15c1f3fbbaff7ed22c2ba551bf789dde
SHA1 d813cd9e037f57cd63d622763d54257bf5dc45dd
SHA512 7961dccc760b768e452874640320dfcbf7822ea2c276fc0f340d6fc1bb18e070942ab59d2f23cd0d5c38228b361e5ad0f717626723d7a258d41fc18ebfa94e7e
SSDEEP 384:jsrv+89zHqlDNP9oidA38NpaglUkliWZlf8hyEGSfk3ETImy2rEoajo4cdR8eHhd:Yrv+4UNbdA3O7i0ZXerEnjN3Gac1F7R
TLSH
T18D03CF3579689DB38DEBD68675477A03BFF4425385C50AA4CACD670C02CBAED230B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 afaab3804f14df5a7236aa08a745c08f4cf9285ae7d062acb2363d9153395989
MD5 b3ca2799eeb3130a57c7adb80a057638
SHA1 7d4452638f9cc232a470d8fa32aa44081bd28b3b
SHA512 4ba954dc6ec45503d9746ac9555819877ea11965db04afa5725f51c0d404afd16e4e80714781fd80a44e6a92f31ce6a40ff3d8e78ca72159b43ade6091545df7
SSDEEP 768:rrv+4UNbdS32mi0ZZrEnjN3Gac1ZNeVH1SCz:rbsbg31HQnjMaSEH1V
TLSH
T1C503D03669A89AB38CE7D38575877A037FF4525382C40BE4C6DD6B0D029B5DC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3e069954ed9f13d0be51fa71377f54188490cddf0f534cd0d6aff3f07403da85
MD5 01134f104f1f6857a9763f37319d0217
SHA1 71950d9e80a4cb49f8923ed26faaff91b9490f24
SHA512 c84b041aec2deb19770a8ecfa4eec872086b86166d712a18317677e24479d6e290885f5ab48ae826cc3b4739d6619bf17a5a682a3d91a7626be7316b5c889f24
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b703a0ba572d66eb1e0ed4ffa44444e6705da895aa4c68872d26feb4a8134838
MD5 23a92a7213b27607a33f7b59d83c3a0a
SHA1 04df87f7fab17f6e046ed1002570b80033fe76a5
SHA512 895e28717416f7afcb69f25d1ae6a3f11ac6af13e0f286aea94622e86e0574c20eb389411ec2cf2a581138bf93a30b7e949bf2d9e8dba91ac7f383d7be011b43
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download