hxxps://work[.]ink/2Tyd/get-24-hours-madium-key-12

Analysis

max time kernel
900s
max time network
898s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://work.ink/2Tyd/get-24-hours-madium-key-12
Sample261011-zm678agg99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1636	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{9697B222-0149-497E-BC58-8318ABFD5FBF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5220	4620	msedge.exe	89
PID 4620 wrote to memory of 3876	4620	msedge.exe	90
PID 4620 wrote to memory of 1636	4620	msedge.exe	91
PID 4620 wrote to memory of 3876	4620	msedge.exe	90
PID 4620 wrote to memory of 3876	4620	msedge.exe	90
PID 4620 wrote to memory of 2552	4620	msedge.exe	92
PID 4620 wrote to memory of 2552	4620	msedge.exe	92
PID 4620 wrote to memory of 3280	4620	msedge.exe	94
PID 4620 wrote to memory of 3812	4620	msedge.exe	93
PID 4620 wrote to memory of 3280	4620	msedge.exe	94
PID 4620 wrote to memory of 3280	4620	msedge.exe	94
PID 4620 wrote to memory of 3812	4620	msedge.exe	93
PID 4620 wrote to memory of 3812	4620	msedge.exe	93
PID 4620 wrote to memory of 4080	4620	msedge.exe	96
PID 4620 wrote to memory of 4080	4620	msedge.exe	96
PID 4620 wrote to memory of 4080	4620	msedge.exe	96
PID 4620 wrote to memory of 2176	4620	msedge.exe	97
PID 4620 wrote to memory of 2176	4620	msedge.exe	97
PID 4620 wrote to memory of 2176	4620	msedge.exe	97
PID 4620 wrote to memory of 4964	4620	msedge.exe	98
PID 4620 wrote to memory of 4964	4620	msedge.exe	98
PID 4620 wrote to memory of 4964	4620	msedge.exe	98
PID 4620 wrote to memory of 5024	4620	msedge.exe	100
PID 4620 wrote to memory of 5024	4620	msedge.exe	100
PID 4620 wrote to memory of 5024	4620	msedge.exe	100
PID 4620 wrote to memory of 4460	4620	msedge.exe	101
PID 4620 wrote to memory of 3944	4620	msedge.exe	102
PID 4620 wrote to memory of 4460	4620	msedge.exe	101
PID 4620 wrote to memory of 3944	4620	msedge.exe	102
PID 4620 wrote to memory of 1392	4620	msedge.exe	103
PID 4620 wrote to memory of 1392	4620	msedge.exe	103
PID 4620 wrote to memory of 1392	4620	msedge.exe	103
PID 4620 wrote to memory of 1008	4620	msedge.exe	105
PID 4620 wrote to memory of 612	4620	msedge.exe	109
PID 4620 wrote to memory of 820	4620	msedge.exe	110
PID 4620 wrote to memory of 2924	4620	msedge.exe	111
PID 4620 wrote to memory of 4232	4620	msedge.exe	112
PID 4620 wrote to memory of 4232	4620	msedge.exe	112
PID 4620 wrote to memory of 3600	4620	msedge.exe	114
PID 4620 wrote to memory of 2432	4620	msedge.exe	115
PID 4620 wrote to memory of 2432	4620	msedge.exe	115
PID 4620 wrote to memory of 2432	4620	msedge.exe	115
PID 4620 wrote to memory of 4048	4620	msedge.exe	116
PID 4620 wrote to memory of 4048	4620	msedge.exe	116
PID 4620 wrote to memory of 1140	4620	msedge.exe	117
PID 4620 wrote to memory of 1140	4620	msedge.exe	117
PID 4620 wrote to memory of 2904	4620	msedge.exe	118
PID 4620 wrote to memory of 2904	4620	msedge.exe	118
PID 4620 wrote to memory of 5908	4620	msedge.exe	119
PID 4620 wrote to memory of 5908	4620	msedge.exe	119
PID 4620 wrote to memory of 5908	4620	msedge.exe	119
PID 4620 wrote to memory of 3136	4620	msedge.exe	120
PID 4620 wrote to memory of 3136	4620	msedge.exe	120
PID 4620 wrote to memory of 4728	4620	msedge.exe	128
PID 4620 wrote to memory of 4728	4620	msedge.exe	128
PID 4620 wrote to memory of 4728	4620	msedge.exe	128
PID 4620 wrote to memory of 5600	4620	msedge.exe	129
PID 4620 wrote to memory of 5600	4620	msedge.exe	129
PID 4620 wrote to memory of 5600	4620	msedge.exe	129
PID 4620 wrote to memory of 1396	4620	msedge.exe	130
PID 4620 wrote to memory of 1396	4620	msedge.exe	130
PID 4620 wrote to memory of 6068	4620	msedge.exe	134
PID 4620 wrote to memory of 6068	4620	msedge.exe	134
PID 4620 wrote to memory of 6068	4620	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://work.ink/2Tyd/get-24-hours-madium-key-12
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffa0df5c188,0x7ffa0df5c194,0x7ffa0df5c1a0
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,14162937311484336839,9970646371088232223,262144 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,5583421364597725356,1840675248405848560,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,3087914154871731963,6918562816018023413,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3312,i,13899627874748046926,11369737934733195880,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,13804332592242700824,13918375645982369745,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,16679918617524426803,5757509897062862757,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,17845594027201252960,17159624205717574326,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3784,i,10438130435543839127,14234595518500650428,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5052,i,15434504803824669724,7895842748833890463,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,14344698016066018770,17301266913892510585,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,9640225909269476116,17868322833008809467,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5488,i,11536279288517386840,2062720909758525042,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,16808370824234586921,3924604240451364760,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,16808370824234586921,3924604240451364760,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,11842522975831380088,16519358654353998894,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,6350813307718067615,12505983094737401494,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,2887361896029121257,17775251207951221026,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,12938127438067512838,10441109475038762419,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7244,i,16930114345628941094,742887449283586125,262144 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5580,i,8988977818289410817,4512542862975879389,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,6784807097696566534,1422859128222369940,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,14169407294127975009,13199593197969286777,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6519267096865337469,12175315555778017057,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7260,i,14319962822084385025,4429466195411261617,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,17795482676520055804,12183225570682511220,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5560,i,13332410042231704521,10275370197975115244,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5576,i,14994558406919447334,8670880991970211124,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,14984398566302214317,251971808172365204,524288 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6052,i,6096005858907695404,16046863044815693648,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7000,i,12876896640237399898,4445531650680537581,2097152 --field-trial-handle=2276,i,2395141240466907339,8032819999494425596,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2088

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37bc6878-1653-4780-bf43-c1847e29a9c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37bc6878-1653-4780-bf43-c1847e29a9c5.tmp
Size 39KB
SHA256 5b64d52453c07d12febcce7e52983a1767d002890cfe66f093878342c8df9a12
MD5 74f6bdc8210e0a2e575090cafdcbd12d
SHA1 a721d4811fbad892f85c9f5e8f6dffb2edbe8458
SHA512 2babbbc8773c0717a50685ce773e12347a3a56b7182687010aeb421b134d0cfeea9c0982e46bd556547a5869490517b6e5368aab68c4df65c8834dab41c922f4
SSDEEP 768:N/UxvxjgC+T33h1fnKe+iE57Y0GZxJsXBdK8ZFoDp:wZj3+T33hcR70/JsXf77oDp
TLSH
T14903C034F8A4AD635CF7E390760A7387EEF456B3C1C54DA889E99B0D06876AD134381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

538a02e9-86cd-4fa8-8f2b-9a381eed1e91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\538a02e9-86cd-4fa8-8f2b-9a381eed1e91.tmp
Size 41KB
SHA256 664e0d790494c82672a7e6d05e61f3d4ce9acb00b0f6e155048b929405fcef5a
MD5 0bc8bb0eace0ea1565eb00a5aca1df4c
SHA1 cff63cb4c4edf4f6bd8cc2c699b4434fa5c70b61
SHA512 81f6ad488b116d43382a8239ff92ad7b1cc72d076153de3322ed1ac76853da4cad86f095b22ffe9c7eeb3d0e1a9bdf246801f9b755e765ec5fe09068aadff85d
SSDEEP 768:hFQh3qwg3h4NnKe+TE57Y0GZxJsXBdK8ZFxT2:wh3ahpK70/JsXf77Q
TLSH
T160136AF198D39A72D8AE9783A73D3E029EBCC163B5844954B7D99A0CCD461BFD303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62d5ca9b-f60b-4436-9cfd-d9147ee5d839.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\62d5ca9b-f60b-4436-9cfd-d9147ee5d839.tmp
Size 34KB
SHA256 386d54476f6e1cfddfe8307d36e8bf7e4f5305d02cd3780f0205eb3d7966ca79
MD5 1c63f4dced41ea93bc4cebd529092ef1
SHA1 0b191a327dbec517df31eac8b48eb4c0a333a31c
SHA512 4e73ea3b27dfbd52e3ccdacf5bf38608b4a85287d6c50f02b50982cf3da70e970e215c30081f83e60f2996830f00adec47ac9dcb9dfc6ded056458b9b94fcb48
SSDEEP 384:RZcIO38NznVZv8dKYcsNOA/nfydXMvz3j6rrgYg57HD8CJGZXhJqlX/XBdm/e5xi:5O3MhgNnKe+HE57Y0GZxJsXBdK8ZFxT2
TLSH
T1FBF2C030B8A09E635CF7D291761A3247AFF84273D6C84E58D5ED970D01875EE130391B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

3d6b6a36-9ab9-4275-bb8d-98161b6ed21c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d6b6a36-9ab9-4275-bb8d-98161b6ed21c.tmp
Size 11KB
SHA256 0d3ce9900cb3f2faedafc28867e95b397db7135a4574143350d808fcc22067dc
MD5 8cf55d53727a50aa818fe04507650d1f
SHA1 ae33163be4bfb5a362a4ea818e2d4dcde9a39925
SHA512 a33ae2fda441af0948993b0581845302164a646def94932b1f1d7b25fa5dba8f78511f38f888c28e317ab51bf5eec9412fe94830813694cb02fdc3fb680e06e9
SSDEEP 192:sxRgmb7/f7sA88zoA8pTCCe/g6+WNNwe/YU2j3RIGFIgIJ:sxRg47/f7sA8tVe/5T/Es
TLSH
T15F329715AD68BA3B8CC7D219FB69BF53D6F95032A0D12E48E6FC851C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

411ca182-040d-4c6c-bd75-bfc3da38e31f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\411ca182-040d-4c6c-bd75-bfc3da38e31f.tmp
Size 11KB
SHA256 e3e4c3f4d1f43700ead799b541dc9815ef1992b4ac5988d49255bd0950ec926d
MD5 123e90dd77add22f20e8d88c22861d2e
SHA1 64a1e9cd2af74cead4c88fbae51eb871a1c6c83a
SHA512 4ee9c0d5a9ceee0627978fd1533885bec4858ff08fccd166d8fecad3c439519af510a9fac6b6f30d820bcc94d49cb5acdcc8ff69d04da714eff756c3ddb89d81
SSDEEP 192:sxRTmb7/f7s188zoA8pTCCe/g6+WNNwe/YU2j/RIGFIgDlJ:sxRT47/f7s18tVe/5T/eL
TLSH
T15332B855AD687A3B9CC7E21DFB69BF53D2F8503260D12E48A6FC861C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 61d17b6be57634949c3737cd4ac4b9d9673d5e4719f8833e91839907c9604479
MD5 db6452152d8cff5541929069254ad563
SHA1 dba16cf1a4f684efa237418c9ffda0966d00a57a
SHA512 be446ea28fea2487489c476aed2a3f6aa8ca7e42601a89a95164ece0f0068421e64c71d976034870954485c5eba0ae9a94aeb1fcad7b86a5f24dee9c53886101
TLSH
T191E026C40DCCC32EB328AEC70178578C8B80265BD3C8691E1F04C588B00B640E782AA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 a902d2bc851127dd2d6d25f0aedff081d762d7e5c7e33badb531a883abfbe8e9
MD5 299a5d17bee67525d4fb3d0d832d2fcb
SHA1 edf5e61325b4ae9d749d66203973748b6cc68f1e
SHA512 c4f362eecc6317243b0dcf58698a86ab42b2c1f9fa70129d6a2d59f23e395fa260fa58cebea939a54b7e3c69cdd25fa3f34db69db5558b149b716f455851d949
TLSH
T1E7E07D848CDAC32EA30CAACB017D430C8B81371BD3C06EDE3700C588B005B40B7D6AA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d08bfdfcf98453e06010b021201415e6b95da8cf706943a473ace23d95f9be99
MD5 0793677f69f104f545f1a70767e03560
SHA1 8d961a7e01c21a333267e3e6c36b2b2471c5962f
SHA512 e82df695fe496ccbf3b02c513e1681e1fabe73c30d8a341dd577b70475ca1d12a5df809b741102e73edeee03adbd7acc77ef44bcf3937b3acecfaa0378fed639
TLSH
T1FCE026A805DBC32EA7086CDB1178434CCB81271B92C47EDE1B04C5C9F846344E3D2EB4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 09d5cc645cada4254aabcf3e16ddd5dfaeac2a96761d724c1b81a7f8abf0c7a0
MD5 d16a770511d7bc72bd9308ee903f4c1c
SHA1 3745abf0bdcd3420f6ec7cc01ce46a629d9b4648
SHA512 f8155db2ab8ed4b41d279246b453f9781e2c62151e0380d56a44ca25aad215d98281f5acf4123332992b6086e9b22e58ee1e9852e2a967d793d4513e028a9137
TLSH
T17651988162E3F0C6FF5413B289D1598F3B3C78A2D6473F0B08B6F4781902B6471962A4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 31813c8aad2e87bdf09bb219e9326de1a66f7a8964916021fd50c371d8336ab8
MD5 e5bed304240a8832fc0190b476230957
SHA1 6aaa47c1ed6c766df2b6204a8b509bf12e8acac5
SHA512 a2a8f7d0d9ea0e52564d9aa02afc3b27a1d308195c9736b61ee2b7d2a99572d4d6b8324f1a6b7cedff99db51940c2579afc884adf2683be88dea15fa1788b02e
TLSH
T1D351738162E3F4C6EF5413B289D1598F3B3C79A6D6873F0A04BAF4B81906B6171A6264
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 97f341cdc8c9bf9d921f8d32d33d83f9bc1a9db39780114b81db2d821b19747b
MD5 b14bcd6b22f28ae1a50241fe3c2f4746
SHA1 28f99646a37e5f26752d628afe4804b5bb3a9e77
SHA512 c49e0e297206881f8c0538a4275de26597f523e2d7a63b2ba07ee4f054436a0e8b226bd7c1599e4c77fe470882972d1c33460a515a2eb21fc6f33fee9fb016dc
TLSH
T1AB51988162E3F0C6FF4413F259D1598F3B3C79A6D6873F4A08B6F4781902B647196264
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e0e8fe9a441c356024a6643a7a34e2ceeb63bd788712a4837f75659d932a8caa
MD5 715c6382bae5d1c01c098a00cff17797
SHA1 d3049c2d004488b506f40188e55ca7eddf9fb725
SHA512 d7c6ee10fa0daea48f4bfd643f102c499c55b4076a17f2acef4fb713cecdbff5741234ae82cfbaefd4209a3e67d758c3c4c42e809fa0d59056a9427a01d0d565
TLSH
T13451998162E3F0C6FF4413F299D1598F3B3C78A2D6473F0B04B6F4B82902B657196264
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 626fe5706feb658bcba861a2890c6f645abbce445d3c3c9cf027c39b6ba2383a
MD5 bd6e0cf1b07b5244d0bba0a24e7d42ed
SHA1 b1c4bd16edd578a30785beb03c7b67ec35491225
SHA512 2d2e144535b5d7ac12f532b3b5495ce59676454d2eda8531f8d7176813c3d1e6c81a8d5ca1a90405e48428a4c2475cb6e62a310a5d7a23e4463d0a11b37378e3
TLSH
T13451BB8122E3F0C6FF5413F249D1598F3B3D78A2D6473F4B08B6F5781902B6071A62A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 afb582350dd03072e3c9f2570444c34a653c9a853fc409ee1f12610b4cd3d953
MD5 a920e1f1fc7d2e01dc0e7fa6e177661c
SHA1 b5e800a94a5148277ad3f37b364bbc9a1129307c
SHA512 bbd7361f547ee89ce072d1b570f700d081aa6974b74fd3540ca4a232814c5dacf09114a9fdb810e79885c8b52e745f9d5f5ccbc6d590aa7f0dda4078bfa5359a
TLSH
T19551958162E3F0C6FF4403F29CD0598F3B3C78A6D6833F0B04BAE4B81902B6071A6264
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f8f14a77f222d159b78fcf0c818f409106da0737cc3d4a058f138b893d94a00
MD5 ed1e71d5ff4e81f77aafa0ccac71543c
SHA1 f21774218d6b402b52529c6be5b8ae1f0ae51dff
SHA512 3a788a0dd30dd5683b5d760914976107dfc6eab0c0ed17960bacc0e965332908479189b9a94813fd52890e510f3ff88020de8dc77bf5cd121444d40999eb7baa
TLSH
T10F51BB8122E3F0C6FF5413F248D1598F3B3C79A6D6877F0B08B6F5781902B6471A62A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a074ff649e34e17975a96e2269f802f7fac97aa8695ded9787bd9c54e4dc0ab5
MD5 b01720822f5669b5c2ca41f1eb587b6a
SHA1 cdbf608c49bc84c8e2afedeb482f7e1a959065b3
SHA512 92bfbdc57280f0a4165e21babdf425f30f94bbfefe565f0975e6876a7ca5232604290b24a4f4e2538bbc877ea2314710228a92b50b80f895b35d8a8eab02ae7f
TLSH
T11D51858162E3F4C6FF4413B289D1598F3B3C78A2D6877F0A04BAF4781902B6071A6264
MD5 SHA1 SHA512 TLSH

Submit Download

abb7cc6c-f080-4c45-af27-abd04e2f4440.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\abb7cc6c-f080-4c45-af27-abd04e2f4440.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2876cadb-acb8-4116-ae1f-85d2e31ec351.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2876cadb-acb8-4116-ae1f-85d2e31ec351.tmp
Size 3KB
SHA256 f20ccd39ec930a049ff67afd52df7586dd115e4ee8700630725b46cee4f28561
MD5 81301053c8eaf410df7aa46104c7acdc
SHA1 ca4c1ec2dee2f6fefdc5ccef8ae7bd0798799d21
SHA512 f601446362eaa11eab06d6b613eae2a5c9597ef36ce45ed135d09f0af72126c1c7e276c6d221a2d5fc474c066fde98b6f168c3ca59af632fc1899758d05e4d6c
TLSH
T160617CF3C3F8866DCD1152F0AA542E2BCE5D0915432C3C5B85D5AF1B67E24B1E281A4E
MD5 SHA1 SHA512 TLSH

Submit Download

428277a5-e5ae-4a66-96ac-5388fff03d1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\428277a5-e5ae-4a66-96ac-5388fff03d1f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

804e5d83-f5c5-48ef-a6b4-ddcb9a19e07f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\804e5d83-f5c5-48ef-a6b4-ddcb9a19e07f.tmp
Size 2KB
SHA256 507bf13acee0e5ac52abace6d231b1de8449a2eb700d171718eefa2dbcc8a65d
MD5 b09399e52ea4c4f85a73df6c334d06c7
SHA1 f8350ba7f77cf50a382a990bb2d21b722e9eb9eb
SHA512 58efdc59ba9d92500080018efff390fa854ec882f818e95b3d28ddc51d8e872f8957f43aa434bf665c614e66e78f9fbff9a07be048148be70e2b6dae56eaec32
TLSH
T132519CF3C3F8866DCD1152F0AA142E2BCE580515432C3D6B85E0AF1BA7F34B1E181A5E
MD5 SHA1 SHA512 TLSH

Submit Download

c614b37a-2d76-4ece-94f5-bc880e9f1748.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c614b37a-2d76-4ece-94f5-bc880e9f1748.tmp
Size 3KB
SHA256 2b5a5dcc1a46d28e82f2443b52ff97bfc92866ef6b92b544b8859088514153e3
MD5 f8ccaebda346a2f6d7497592403c7fa3
SHA1 6e53be39c92f9491e410fc2e2e962180f94836e6
SHA512 7eb785b9c1eb61803feb18ab0f865cd7b0ef65cd91f6aae8557c7a0dc40f876ab0d74f923686c02bcfe7ec0a266ebbd7d477a05193afd5bf9614f5f6177ce1af
TLSH
T195618CF3C3F8876DC91156F0AA642E2BCE5D0915432C3C5B85E5AF1B67E24B0E181A4E
MD5 SHA1 SHA512 TLSH

Submit Download

cf36d35a-c959-444d-a4e1-c89ca1fd2d3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf36d35a-c959-444d-a4e1-c89ca1fd2d3a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b6c62e6f862cff1e4eb6283c1f668cdc6a07fbe1eba7f23f1221f8ad3a528e1d
MD5 226fa018ff127b7b14b3b90fe721d3ab
SHA1 a8c17a611e76665e5c61aa22162cd698e298d3a6
SHA512 2c7f64f8f09aaf8d36592b2a8dd3707fd6d43293d20366bd35793b1aa7b1b8312bb987d0e08e6175b6cbecc10fe0b9a746cc63487caca91d9084682aff087477
SSDEEP 384:64qajXwfCtgmcFf4O7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRuOro7:6JajXKWgm0f4O7n8F1+UoAYDCx9TuqhK
TLSH
T19BB2DA3B650DCB7F5FC00A9D9C19AE976D9802CB96588D4047FE984C03C77FAA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\temp-index
Size 408B
SHA256 eecf70bb811c86c3fd5306537847b0ff75ad7dcd86e99351d4735eb9dab3a27c
MD5 37ff36865a91472923350a973ebb528b
SHA1 45b8914e9890f6ae6518ab0b148674d58be9d481
SHA512 eb346ab8cf7cf365264ff61517350603a7d33550e57f73c6b4e16582daa8802b92bd4577980458fda985600f3f1273eb7c59e518110cf560e33b8c30ef024872
TLSH
T1F3E0724D4F226701EE285475303E70A2623236CCE290AA0F68ED809E8C983D8FE52A18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index
Size 408B
SHA256 b6239ed4af5b694e3a4d63160108341e9a3be2c951811dec513b5a9fe1c79ed9
MD5 c3c3286ce784538cd7b8f89a4acbdf24
SHA1 67a13fc72c01cb367a3029d357fefb17194e8bc9
SHA512 d72be2e24d9c80473c97c45c2b3410a34451d1f39011dd1cbe8b3c06d1b8b120fd5439aea74996abf3e947af1c29ddcfe3802ec1b9db9679670a31f811bf94c4
TLSH
T1C9E0EB6C0B33A3C1FC0410B574AE61A262723408B3957B0F65EB408B8C80BC8BE42B08
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 e5d43e5940a1b12f856577460a7587cea03a87e14d1ff9175b6b8db38bfb5954
MD5 d073c4c4d8bec475c3575ccbb0196ee8
SHA1 f28237ea01a85832b4f6e49d130505b172130f06
SHA512 77fb950dda68178c80630ec881303b351280df93fed35d155066eca3805eb8309c62ff23fc14454d26bb1905ef5b717d71a8f74f1afd9f814a7347ac788f7d0e
TLSH
T19EE0C0FB2DD31800FCDF83E514F344A800457894C4416C4FA41D51D380F13593A97C32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 c7d8233319fb8b5137d3d30bab5b4fba5ffddfddcd1413dea3173a8fc7bc58ec
MD5 2aa4e8256c1d438a6b454e6f092574f7
SHA1 2b54a19605efaf72aeb7443df91dc93be404b389
SHA512 59ada4ef83225bfcf95d7b70a1aaac4300c282b694823e08a0130fdbe4202b0b5d635d5b25212622695e288343475f2ee42c09a2c0d46c7b8540c474c696dc59
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

b6fb9a07-b234-4ba5-aa5a-1069ce214ded.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6fb9a07-b234-4ba5-aa5a-1069ce214ded.tmp
Size 11KB
SHA256 ba667b1d9d348d8bccc05b9f8834dcf008aadd252fb840c86f3ac2843f05d6ad
MD5 b0f366236630969120fa9e56cff76670
SHA1 e9093fce15f5d9a59104947d1d7c22339d330a28
SHA512 c5a76115dd23af8f49f7cc8418fd383503610f438a55495b3648e1345fb29c08f5efa01c0b5161860d751bb1087ad38822c9e65b6c647748dd5a9e2d0dfe46f1
SSDEEP 192:sxRTmb7/f7sc88zoA8pTCCe/g6+WNNwe/YU2j3RIGFIgDjJ:sxRT47/f7sc8tVe/5T/Eh
TLSH
T1FB32A755AD68BA3B8CC7D219FB69BF53D6F95032A0D12E48A6FC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cea5489e-e67f-48ff-b609-c950a4084b00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cea5489e-e67f-48ff-b609-c950a4084b00.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34bcb9aa-c0f1-4319-a0f7-21110f5206d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\34bcb9aa-c0f1-4319-a0f7-21110f5206d8.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b77f1d2a-4283-404e-890a-82d40d770b3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b77f1d2a-4283-404e-890a-82d40d770b3a.tmp
Size 34KB
SHA256 179c66c770d3cf1bca6bcf38ae03cd7e054e33238466b399221482da00449652
MD5 37e87c5a04bb802d24710db3579fd28b
SHA1 254da64ad30b04da46f3b9639ad110e9ba0ef519
SHA512 7889dbbb73998f7dd7f712eaf544c80866d95eb2f7b0617627ef4ad7024f033ce4b52f2b10b2c50ebe168673f629dc9042c0610e130874e0248aeb61bafe4eb9
SSDEEP 384:pZcIO38NzyVZv8dKYcsNOA/nfydXMvz3j6rrgYg57HD8CJGZXhJqlX/XBdm/e5xi:hO33hgNnKe+HE57Y0GZxJsXBdK8ZFxT2
TLSH
T1ABF2C030A8A0DE635DF7D295761A3247AFF84673D6C84E58D5ED9B0D01875EE130382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df821c40-1029-4337-a91f-fb339624a656.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\df821c40-1029-4337-a91f-fb339624a656.tmp
Size 37KB
SHA256 7fba00a5ac68fcc5919494abc4763f67bc7ee66a82a307d2d4a2558d69e79d37
MD5 9430b38ff37766fabfc7ea6f45a31537
SHA1 94510802c26d149fa18fbee1321b8f44139d9e30
SHA512 4f5599430c4f879949363a7fd9e229d504616271cfb3c0f187b70912e34d801644fa7593b3d1bfbd19406477e618fdd8f4fa096e3c94dc12f44970bb3ddfcaa9
SSDEEP 768:A/UxvxjgC+I3VRKeKE57Y0GZxJsXBdK8luSHUPpMs:tZj3+I3570/JsXf7oSfs
TLSH
T10603C034E8905D735DF7A3903A0E7387EEF845B3D5C559A88AED9B0D028B2AD134391B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88d9e236-fe98-4f8c-ab16-7d4a70e6542e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\88d9e236-fe98-4f8c-ab16-7d4a70e6542e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download