hxxps://www[.]transfernow[.]net/d/start?utm_source=202607167PQEbv7n&utm_term=c3Ean2

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.transfernow.net/d/start?utm_source=202607167PQEbv7n&utm_term=c3Ean2
Sample260722-qqfd8sam2w

Score

4^/10

discovery link pdf persistence phishing privilege_escalation

Malware Config

Signatures

Detected phishing page 1 IoCs

Hiding page source

phishing

flow	pid	Process
104	5060	msedge.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x00070000000245ab-262.dat	pdf_with_link_action

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5060	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292004736577540"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{DFC4D75D-C093-4E55-A767-3CFD610226D4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1844	osk.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1844	osk.exe
1844	osk.exe
1844	osk.exe
1844	osk.exe
1844	osk.exe
1844	osk.exe
1844	osk.exe
1844	osk.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3592	1680	msedge.exe	85
PID 1680 wrote to memory of 5060	1680	msedge.exe	86
PID 1680 wrote to memory of 4212	1680	msedge.exe	87
PID 1680 wrote to memory of 4212	1680	msedge.exe	87
PID 1680 wrote to memory of 4212	1680	msedge.exe	87
PID 1680 wrote to memory of 4488	1680	msedge.exe	88
PID 1680 wrote to memory of 4488	1680	msedge.exe	88
PID 1680 wrote to memory of 3232	1680	msedge.exe	89
PID 1680 wrote to memory of 3232	1680	msedge.exe	89
PID 1680 wrote to memory of 3232	1680	msedge.exe	89
PID 1680 wrote to memory of 1948	1680	msedge.exe	90
PID 1680 wrote to memory of 1948	1680	msedge.exe	90
PID 1680 wrote to memory of 1948	1680	msedge.exe	90
PID 1680 wrote to memory of 3976	1680	msedge.exe	92
PID 1680 wrote to memory of 2020	1680	msedge.exe	93
PID 1680 wrote to memory of 3976	1680	msedge.exe	92
PID 1680 wrote to memory of 3976	1680	msedge.exe	92
PID 1680 wrote to memory of 2020	1680	msedge.exe	93
PID 1680 wrote to memory of 2020	1680	msedge.exe	93
PID 1680 wrote to memory of 2764	1680	msedge.exe	97
PID 1680 wrote to memory of 2764	1680	msedge.exe	97
PID 1680 wrote to memory of 4816	1680	msedge.exe	98
PID 1680 wrote to memory of 4816	1680	msedge.exe	98
PID 1680 wrote to memory of 2688	1680	msedge.exe	99
PID 1680 wrote to memory of 1984	1680	msedge.exe	100
PID 1680 wrote to memory of 2688	1680	msedge.exe	99
PID 1680 wrote to memory of 1984	1680	msedge.exe	100
PID 1680 wrote to memory of 1984	1680	msedge.exe	100
PID 1680 wrote to memory of 1016	1680	msedge.exe	101
PID 1680 wrote to memory of 3276	1680	msedge.exe	103
PID 1680 wrote to memory of 828	1680	msedge.exe	104
PID 1680 wrote to memory of 828	1680	msedge.exe	104
PID 1680 wrote to memory of 828	1680	msedge.exe	104
PID 1680 wrote to memory of 1700	1680	msedge.exe	105
PID 1680 wrote to memory of 1700	1680	msedge.exe	105
PID 1680 wrote to memory of 1700	1680	msedge.exe	105
PID 1680 wrote to memory of 4092	1680	msedge.exe	106
PID 1680 wrote to memory of 4092	1680	msedge.exe	106
PID 1680 wrote to memory of 4092	1680	msedge.exe	106
PID 1680 wrote to memory of 2068	1680	msedge.exe	108
PID 1680 wrote to memory of 2068	1680	msedge.exe	108
PID 1680 wrote to memory of 2068	1680	msedge.exe	108
PID 1680 wrote to memory of 2176	1680	msedge.exe	109
PID 1680 wrote to memory of 2176	1680	msedge.exe	109
PID 1680 wrote to memory of 2176	1680	msedge.exe	109
PID 1680 wrote to memory of 3088	1680	msedge.exe	110
PID 1680 wrote to memory of 3088	1680	msedge.exe	110
PID 1680 wrote to memory of 3088	1680	msedge.exe	110
PID 1680 wrote to memory of 1256	1680	msedge.exe	111
PID 1680 wrote to memory of 1256	1680	msedge.exe	111
PID 1680 wrote to memory of 1256	1680	msedge.exe	111
PID 1680 wrote to memory of 4144	1680	msedge.exe	112
PID 1680 wrote to memory of 4144	1680	msedge.exe	112
PID 1680 wrote to memory of 4144	1680	msedge.exe	112
PID 1680 wrote to memory of 4632	1680	msedge.exe	115
PID 1680 wrote to memory of 2856	1680	msedge.exe	116
PID 1680 wrote to memory of 848	1680	msedge.exe	117
PID 1680 wrote to memory of 2708	1680	msedge.exe	125
PID 1680 wrote to memory of 2708	1680	msedge.exe	125
PID 1680 wrote to memory of 4376	1680	msedge.exe	127
PID 1680 wrote to memory of 4376	1680	msedge.exe	127
PID 1680 wrote to memory of 1056	1680	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.transfernow.net/d/start?utm_source=202607167PQEbv7n&utm_term=c3Ean2
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9354fc188,0x7ff9354fc194,0x7ff9354fc1a0
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,9828885503215151936,16681207095047152484,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Detected phishing page
  - System Time Discovery
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13828600765700712724,1414279883298636318,262144 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,12245104815069617140,15523118465691514243,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,17171200340567943114,17584974917315458169,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9873430874399000721,17801366885317174323,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,2744853939112390883,6728669622729292696,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,13555329036719175862,7918729411788783616,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3210256986476273532,18095777168312703892,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1881586498050810187,9504407817173894569,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,11107375563547070452,5811128379675524415,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6056,i,18341046041160380211,17576171226877318856,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14431529890699862744,17954721013595937099,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,3235950830247295492,17487452119373732705,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,3235950830247295492,17487452119373732705,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7036,i,6793944541261160455,16185455439764830971,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7080,i,13856177787212867699,16932205438038332287,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3440,i,18044746498048689752,4637018872384749625,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4396,i,14531762248916718351,2697007202367256754,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6848,i,5927256983403402593,8576027402241841631,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7200,i,6656880711827875096,18346883651957340384,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6552,i,16728460863438491563,11209797723751047106,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3672,i,5583042704074563531,1895148951951701205,2097152 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,12043625551293608090,453714588581333738,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,5774621432806444038,4683015822287847555,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,17241999687745800148,8561116356477544841,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3157171701880887167,5461899623546591977,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,16532145556045158669,780938289934257027,524288 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,1422522913340821826,251223870751889202,262144 --field-trial-handle=2304,i,6910872753225793260,14386898458808602269,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4776

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 617671d6dfc157f17f375e5367f51b1a4b41223b522b53b2b9d35d8e592c0fec
MD5 d46f1ad780e4460d5cbf8340f9e45d28
SHA1 36d97d3b8a123953d5932f364c322adefa42576a
SHA512 22a99dc6f08da0a638de36fd3a94290c515d38e0477fcfad280eb7a54cc2e64f4bfb646ec0a01672436aec0de00ce3cbf9f3f1665eb00653728434f756260aa6
SSDEEP 96:UgoR4fpsMa1/Kky3aCuoVpEHgNLtHPGYj52Wf:DfpsM2KkyaClVpdVlPdj0Wf
TLSH
T1B1A18156159240D2DFA52EF2E5D2AA09FC728CABFBD2CF5B0254E57C770BAD4029034D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe596cf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596cf9.TMP
Size 3KB
SHA256 ed413cb592f8531f114ceeb7c96f4729348f936b49dda3fddd67968fd12ae9bb
MD5 747f93ffcec5bb36c56ef5556c5f05e7
SHA1 26c41b90f54af8f739f1026f9bee384fde566866
SHA512 d5d59140e779cb87ac1a35f0b8b70e953afdf2a47284f5db73a61f7a5a8eeec6f39cc1a1643bdaca9da6cc35c34abc3c073bdd068a6cb4430005db5877985e1c
TLSH
T1F871B42B066200D0DF691EF3E5E24641FD728CABFB13CE630064E47DB70BB9845A1785
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 76e9b8f7a32d84db84e0a296276c0916951763241213012adfed7fa6cb245a2f
MD5 3e0defde095b506d42cfafc2e058f910
SHA1 cfac9e9d99e17e5e064f2993accc85b15b1b699d
SHA512 a93749e13f30e8dc46c8de830f9f6585f929b36634d8088061c4d3404c495331de46367fa8c7bb703c5807735453d99de7e8746217dc643cf3bb5c4ec99e3ca1
SSDEEP 192:DKze2e+q157q1W7nujpmT5kTOfrWVXZlu/FjTWQYG3SO:DKze2e+q157q1W7ujpmT5kTOfrWVJluJ
TLSH
T12FD17EF7C2F4866EC86162F19B143E2BCE6D0919821C3C5DC9E5EF5BA7E2471E140A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2787d30633624efc6d5bb050f3c21e5878c2425dfc18e8c18352d3b7422ec53b
MD5 5c9ec2cca4d22bc952fb7d15046ff777
SHA1 3bf2aab7b7f887b6226e116165b6a37d1baf890f
SHA512 00896be80b6a1392a9a22cdeaad63f1524304145e93fd50e7b9dcde966543c61524dbb46682bb4f62edc28d27f0c0f4a7240020c832e299a3f81735745e6c668
SSDEEP 192:DKze2e+q157q1W7nujpmT56GTQ0nfrWVXZlku/FjTWQd:DKze2e+q157q1W7ujpmT56GTLnfrWVJv
TLSH
T10AD16FF7C2F4866EC86162F19B143D2BCE6D0919821C3C5EC9E5EF5BA7E2471E140A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c7c7f8b92cbe1810c4d1c4a01f9673bb167169ecaf220089d0b7fe840b8dff9f
MD5 cf1d8991ec9cb74990e8c9adcaecbe9d
SHA1 3bbeeedef2fe28f6b8203c57dac8754e7e3b7c1e
SHA512 fea019e64835b5edca9bc4900f876ad2dedd79cae98383910273ca3c85a1960cdbceb8e652b97b6faf7fc04a51db05fc8935854c47a93485d936de830ccdffca
SSDEEP 192:sxZAR4yM/jK1Ml8M9G/fxsqN4ZIdpqJ9qHW6+WN9dq/Y4x8OwQIpIgLJ:sxZAe1G/fxsqN4yXHbO/QOId
TLSH
T16452D6166A345977CCCBD209F955BF53D6F90123D2901E84AAFCCA0C00E6AED234782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3cfe0eb8068ee64b8312f40d51837c4316cc6ca8861478df8b1cf9c00f1279dd
MD5 eb7b9814161350fab40e0e66930ab557
SHA1 c954aa8f0ae5ece17d9203f8a10469aa2443eabd
SHA512 6185e9ba89c4573b6f8523502dc49363e07989bdc6f8076fd95bbbb890bdb785bfdafabba397baa806be8c195b582d68b6a067e857781d5b59aecea2288a1e70
SSDEEP 192:sxZAR4yMojK1Ml8M9G/fxstNZTIdpkhm9ChqHW6+WNe7pLwdq/Y4pQOw3IpIg5qJ:sxZAl1G/fxstNZMlHbEx/IObk
TLSH
T19F62C756AA3459B7DCD7D209B955BF53D6F91123D2801E84AAFCCA0C00E6BED234782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2d115411e36ddf74ac5f1b6ca7f8e9dccce175dc76da1a9948a731996e083bf5
MD5 4269046ac09a7c6d0d5e2c911e8256de
SHA1 4650e12a80b1beb55f7059b34ada701315e3fa64
SHA512 12fea64f8cd173465a430d8c16568531f07b36bc5a7c1aacb538a3b9d09f0efc91b5b3207eea5623a204f1e7737c6c9cbea800504b7265c0389ca3ac32aa3144
SSDEEP 192:sxZAR4yMojK1Ml8UQn9G/fxstNZTIdpkhm9ChqHW6+WNeuL0dq/Y469Ow3IpIg5m:sxZAlq9G/fxstNZMlHbX1/eObk
TLSH
T18462C856AA345977DCD7D209F955BB53E6F90123D6801E84AAFCCA0C00E6BED234782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d1a645e13a3d5d8ca48da98d2cd5e2c652c1d46b0488f5629e8751901cf98b05
MD5 3dfa7f3c6e0d9c0acc6940136a4ff946
SHA1 e8d7d42fb6f5b1d6cb24c5983b392a78c0442ab3
SHA512 bf1c155210e984663012bbd4b2c039c38c0a5a9849a1019f22de5d70905dbbbdd18295632e8e566352f3ddbffa553e447ade1497e8e774006526eeaf1d1ece8b
SSDEEP 768:WM8iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdtroXksBUnI:WM8iJPNWvx78ru1jahALocdGXBUI
TLSH
T12AE2FA3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4d73b79b8e37e55d31a39a2b7d646766efca0db1834b703bad44eb73c98e5edd
MD5 792ab42b2c2ac2ca854d927da9c3f89e
SHA1 4f6f8cce67c3f93f1de59dd86cc0d46e553f2041
SHA512 43a52bc3bfc8835e9d490c543ce4dba373acda86d6a8d413c1af67133e866bdb7a8372f52397a86b4c6cec20ae4647d37de823bd6706d0713b8188bc17542111
SSDEEP 48:KukZiGkySx3mnsIUuxKp4xExFMh6PuSSyVfIhKs4cY8IjKV6cPy1rTrerXrDrpr1:KIFGKWUqufiKs438wKV6mL
TLSH
T1BF913F4730BB06422D7D290CD6E596168B83B1A370A9B46B7FE800B50F6BE245DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5969bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5969bc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2da74bf5156863f3bd81cb8d43bf06974f0ee23785ed38e0c513f3b96cf225fe
MD5 74ff703d350505effd91923d3870301f
SHA1 a4a5e56fb2b7fa2c71b21385122c00b92432165b
SHA512 292a33403c247f2c38270b71e58d7594980a870f4ec1507764ddaeef27d5f4bccfc388dc98359ab24bd3727ea8c0270247d8a8b85854fff2d980246a7f708af7
SSDEEP 192:ufTSNWMsnMcPPQLz3XX9VomsNsLQMmZfQmiU15cx8Bk03YqLaJNEkLIMqYScjmqK:ctNn/s3n9SmsNsLm7Mx2kcAip2ScjmwY
TLSH
T162926C326C786D6A9DD39486F44737175FB481A397C42FC4D9EC6B0C05DA2AC130BA3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6e8c281618a1a96bed65d3a9ac2de34a74926e33989c9f5c5b948a55892ea422
MD5 50467145c9dd5c0249b0692baeb1dce0
SHA1 c6ff6e286905aa2f9063ba04243b41c1f116413f
SHA512 b4cb62310d12ba3566e54c5dc8b740dde4747409e4d75726b14a871f30630a0e4c3c3499e240613dd38c284fdfa11fa44a3b33b3783fec7462d0de66c0ebe77c
SSDEEP 384:I+iFKtNn/s3n9SVlsNj8TUNTUlIlEmWmx2kcAis2ScjmwY:IVFKj+9A8wgxx+s21jc
TLSH
T128D23BF258D7993AD99E4B47B73E2E129E7CC163B6805E80B798590CCCC61BFC306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 45e5c14c56ec000528b652699954c17a302c5f665404d14e271a20c81f0e7632
MD5 9f25e7a1aa8a335f4cd84feb635b5fe8
SHA1 6c38e35220d6bd442990ae429eb6f956e0b702e4
SHA512 6fac55f1696b648ed4997e27d1ea8c0e9a011fc2bef470ee5c6764f93753ec902547d08ebd3a1ae5d29e3245f5e3df7f80330643c9142a74a38eb38b1beb3e6d
SSDEEP 384:I+iF3tNn/s3n9SVlsNj8TUNTUlIlEm7mx2kcAiu2ScjmwY:IVF3j+9A8wgQx+u21jc
TLSH
T11AD23BF258D7593AD99E4B47B73E2E129E7CC163B6805E80B798590CCCC61BFC306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e92eb9441baf4e440642819ec7c42748b408edad87e99fde3f8c9cf57e463313
MD5 22b8b5f538178b4ecc54753f00a2dd94
SHA1 88fb431955cd1969cff89cdcf4afd88cdbd6f70d
SHA512 e572c4bed47c86b6e8bd9033e8f6455369df42e84ad2ec92a7de94186502851a54b0ab6cde563ba07fe1ef4c30cc95066d86c5e967eba8ba8a95800c7920b9ed
SSDEEP 96:ZqONkhQsjpfmUTmDK5ih/cIPURHl8h4otop5u5DIBhPwivh50xy0SFYKUAxL+YLZ:gON56kDfQmiUyY8Z903YqLMQi7FU6
TLSH
T1C702E9356C786CBB8EA3AD45F44737271FE5112BEA842F84D9E81B1C04D724C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf70b25a4d31d4eac2638992c94079f84bb3ca98a2cb755b6b9c615f3a7432cd
MD5 2256dd5d3ffdfdec68efbb080713c7de
SHA1 b469744b15b623e52df762e881dfce2cdc80e6f2
SHA512 f892a42f77ba5ffd86c43db6ca7cd39d42479c17e6429d495b910a80cf786c9ac95cc7af7bb8bb91308508381360b3f7330a5bb1ad8b4dc396ea0cf5cc8e62e7
SSDEEP 384:I+iF1tNn/s3n9SVKsNk8TUNTUlIlQm7mx2kcAiA2ScjmwY:IVF1j+9j1wggx+A21jc
TLSH
T1F3C23BF258D7593AD99E4B47B73E2E128EBCC163B6805A80B7D8590CCCD61BFC306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2fa9444194d79c536b554b7cb8992df5b4e754a1a2806a2aeddd59ce2f0275c4
MD5 270733e32ede069f1423d0e8e4e8a6d5
SHA1 b28edac29f5fb9846bd276a7a217f30a8bba4344
SHA512 a5e1b7dbf15175e8a9c633e355c2966905ca566fb69fca8510fad2bf8bce0ed187d0248fa389207d2beb3484ff5eb5649b3ead7c898092b6deaab51dbe5e8a37
SSDEEP 192:u5TSNWMsnMcPPQLz3XX9VomsNsQQMmZfQmiU15cx8Bk03YqLaJNEkLIMqYScjmqK:mtNn/s3n9SmsNsQm7Mx2kcAip2ScjmwY
TLSH
T1E3926C726C686D6A9DD39486F44737179FB481A397C42FC4D9EC6F0C05DA2AC130BA3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 473a992d50c67c6c833b67427a6caecf2f0ee33e0c9385e2d023d8fc6d96324c
MD5 966f1733e1c105598c4818aff6b2b25f
SHA1 2dd3c906f9202a5774bc2fa920b57ba3430365bf
SHA512 1616fde51fc39fc0064ed1cb636ea38805fae22151aaae39ab4c09505dd7277028e78ea13678098d5acdf36c47959fced459862a50c91edfb0a56b1052621dfe
SSDEEP 192:pONV6kFQmiUyZ8g903YqLaJNEecRMqYU6:pONV6iRg9cAir2U6
TLSH
T1B212197168B86C7B5DD3A842F48337135EA59227EBC96FD1D5EC2A1C05EF298130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 02881325e2419b015d7a01aaeb8eafee026c327e8156193fc2980b6eea8477f4
MD5 f6aef6a82d2ab182817fd12f2b940667
SHA1 56ec024be2015b5eeef100e064fdaaf688cb9150
SHA512 f65b912a61f0b225e4490ac3a016edda2ed5108d627b0859ea05014d76623862e29c3eaa1894f0d8805c9381cb0e6719f33cfe6464eddd0c508279dc52972c3a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58d646.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d646.TMP
Size 392B
SHA256 0d1d91658b4087d01cf54123390b1a7d4781cad815d8f8f61161f5c44f9be15c
MD5 525589557d932753b9362a15ed78dd58
SHA1 2911e49699658d91b66883d2e643fc6094de1f4d
SHA512 3893816538fc0abd9cc41119d1126a1b444133b8961fbacaa611fac348ac6400c7f8c965d5c0c1f245869e07de5881c807e822bbd11ea573bf56fc7a5f7bb1eb
MD5 SHA1 SHA512

Submit Download

9114ebbf-b890-4d1e-baa9-f9210a3fe826.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9114ebbf-b890-4d1e-baa9-f9210a3fe826.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d3603b9f7ac5c162c3bd40dec623ee752804e3703c30a6abf57975c5f8eb441e
MD5 3a76a1c696dfb9efefd6be130cdc8717
SHA1 85ea66f6bff286cf8d2d643483e6cea469c88fc3
SHA512 13f84e4ecc6d8d9c6f8d9e7562ca1ed1aeb3311fa8203b262591c205a55086bab1ebb198d127c7c6a770a3fd36b3e73dd084f7cc8ce78ebb016ccd167174ac2d
TLSH
T1BB41D459AAF91148B3B76F16AFF6A86E447E78372F46D85E00010D4F0A27B40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

KNCONSTRUCT-Projecteren_Aanbod Overzicht #00014726.pdf

Path C:\Users\Admin\Downloads\KNCONSTRUCT-Projecteren_Aanbod Overzicht #00014726.pdf
Size 66KB
SHA256 8976a60a6535bc1e556189b37cfa14c6f07da8348026ad0a7abdc3aad02e0afe
MD5 6610c20b20be1e0985c565495dfdc3f5
SHA1 773d210e70ac9a22c55326d551c7e1ed563b8645
SHA512 60d986cccc9fe6845be91037a8f884b89bedb8c1c291dd0c0e24be086f6bd61c13d16ce243806b66150a2b8584c1b4d8d05583606e860ef460acd61c4c9394ca
SSDEEP 768:ySIlCUIrp0ipstjouKv6L++2I/zFdoamTqyZRuIFeXLRKGykH+Y9HGtRcvUxXdIB:wLhFm6Lu+FG/Tq4w9ykH59GtRvXd2Y32
TLSH
T17D63D1435915CB83A16987E47E031D986F5B274DE4827AEB306E0ECF3F206625DDE12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download