hxxps://gdsi[.]ie/i43trghnodcument/approve00100-download[.]html

Analysis

user interaction
yes
max time kernel
898s
max time network
887s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gdsi.ie/i43trghnodcument/approve00100-download.html
Sample260803-kr852seq4v

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302206856629082"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{3AECB023-0A5C-45CB-8FF8-AC5D2FA48BC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4988	3676	msedge.exe	87
PID 3676 wrote to memory of 2076	3676	msedge.exe	89
PID 3676 wrote to memory of 2344	3676	msedge.exe	90
PID 3676 wrote to memory of 2344	3676	msedge.exe	90
PID 3676 wrote to memory of 2344	3676	msedge.exe	90
PID 3676 wrote to memory of 2812	3676	msedge.exe	91
PID 3676 wrote to memory of 2812	3676	msedge.exe	91
PID 3676 wrote to memory of 3232	3676	msedge.exe	92
PID 3676 wrote to memory of 3232	3676	msedge.exe	92
PID 3676 wrote to memory of 596	3676	msedge.exe	93
PID 3676 wrote to memory of 3232	3676	msedge.exe	92
PID 3676 wrote to memory of 596	3676	msedge.exe	93
PID 3676 wrote to memory of 596	3676	msedge.exe	93
PID 3676 wrote to memory of 3180	3676	msedge.exe	94
PID 3676 wrote to memory of 3180	3676	msedge.exe	94
PID 3676 wrote to memory of 3180	3676	msedge.exe	94
PID 3676 wrote to memory of 4836	3676	msedge.exe	95
PID 3676 wrote to memory of 4836	3676	msedge.exe	95
PID 3676 wrote to memory of 4836	3676	msedge.exe	95
PID 3676 wrote to memory of 4260	3676	msedge.exe	98
PID 3676 wrote to memory of 4260	3676	msedge.exe	98
PID 3676 wrote to memory of 4260	3676	msedge.exe	98
PID 3676 wrote to memory of 1996	3676	msedge.exe	99
PID 3676 wrote to memory of 1996	3676	msedge.exe	99
PID 3676 wrote to memory of 1996	3676	msedge.exe	99
PID 3676 wrote to memory of 1180	3676	msedge.exe	100
PID 3676 wrote to memory of 1196	3676	msedge.exe	101
PID 3676 wrote to memory of 1180	3676	msedge.exe	100
PID 3676 wrote to memory of 1196	3676	msedge.exe	101
PID 3676 wrote to memory of 2592	3676	msedge.exe	103
PID 3676 wrote to memory of 3392	3676	msedge.exe	109
PID 3676 wrote to memory of 2024	3676	msedge.exe	110
PID 3676 wrote to memory of 3192	3676	msedge.exe	111
PID 3676 wrote to memory of 4492	3676	msedge.exe	116
PID 3676 wrote to memory of 4492	3676	msedge.exe	116
PID 3676 wrote to memory of 4192	3676	msedge.exe	118
PID 3676 wrote to memory of 4192	3676	msedge.exe	118
PID 3676 wrote to memory of 1280	3676	msedge.exe	119
PID 3676 wrote to memory of 3280	3676	msedge.exe	120
PID 3676 wrote to memory of 3280	3676	msedge.exe	120
PID 3676 wrote to memory of 2848	3676	msedge.exe	121
PID 3676 wrote to memory of 2848	3676	msedge.exe	121
PID 3676 wrote to memory of 3392	3676	msedge.exe	122
PID 3676 wrote to memory of 3392	3676	msedge.exe	122
PID 3676 wrote to memory of 4984	3676	msedge.exe	125
PID 3676 wrote to memory of 4984	3676	msedge.exe	125
PID 3676 wrote to memory of 1280	3676	msedge.exe	126
PID 3676 wrote to memory of 1280	3676	msedge.exe	126
PID 3676 wrote to memory of 2296	3676	msedge.exe	127
PID 3676 wrote to memory of 2296	3676	msedge.exe	127
PID 3676 wrote to memory of 2296	3676	msedge.exe	127
PID 3676 wrote to memory of 4592	3676	msedge.exe	128
PID 3676 wrote to memory of 4592	3676	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gdsi.ie/i43trghnodcument/approve00100-download.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,8979821664075956423,12218975992386100533,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13086005962257901861,14186527425128923664,262144 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,15665286570491017713,9483227802215557951,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2020795988378931044,7385091533454489685,2097152 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,2069172415153721547,4235480389974647008,2097152 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,14522217118819997162,6766047833074804174,2097152 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,13967531769947540605,5448128183808558805,2097152 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,1243427541619495569,5306763878758495390,2097152 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5160,i,10414241356603691409,13619814060086537527,2097152 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,13204297120475390673,6158464437316840924,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,2943230115442444591,17458459437047759272,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,18057493993718071539,14702240856418576274,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,18057493993718071539,14702240856418576274,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,4723787551958823361,5950505547127327483,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,9285756824534620489,16283800218708295484,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,17200821117924226361,8966326320812779374,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,2309845879051795811,16729046021709492749,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,3343291907359357890,16693358760051167571,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5104,i,8904693410379141300,2097995546593285847,262144 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,18110138124948407891,12891518780365303678,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,2643640759644395666,4469069235920799318,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,2785151067365299002,14536742212478389948,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,7543782515377595425,13026590928983091842,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,3663109485694944756,9478027557021768179,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7044,i,10297999131879888419,345159393668730398,2097152 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,7966463563948206017,2504480726470491080,524288 --field-trial-handle=2476,i,1705065551378848436,7513526369183572381,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 86f58006da590b6a6397eb32ecab83559def6e4467e696655355071b7bf2aa4a
MD5 448f19b0779a65b0be650a956fa5df6e
SHA1 3baed8e409ca650111c9646e8bf0dad44ff672b3
SHA512 f7785f7b3b588df9949bb0ddf9ccce50e7ecddfe0d32752bd78b9bf0c7255c65a9c30533b1b6de2eb00570b5d4f393e3d3d59d030c093e0902b082d13b1d4f37
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T1A5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f1117d5d27fd75025c4af242225d619c19eb3526b088646e2d3d79338e04b270
MD5 4e296883e4858da40f0eb3a8ad06dab2
SHA1 91da9ae579c88eb01812df06728a2e794da61183
SHA512 c0a0745ac8a5045c9bf76dc0eb6ac95f22251de6356e980f011375646efdf8742adf5892533c5bf9b3428d854b1bbb2a7445eaf267835e7ac9aacd8f4af2b105
TLSH
T1FEE020C615D9C25E55047487537C574C92D13A0EB6C8AD4B2B04854971034447683A64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9d54f635e855f099a043750693be85d646e1f447d058af0f380f5ceac77d41cf
MD5 7f1b9b1e5d1ad950b3a9f3c85a40a0ad
SHA1 04e39d0f07135badc6850ff65530174f55aefe26
SHA512 d0f688cf7d9c1bfc883cd0917012b6db2ab386f4543a88fccbf471bc872282a647d5edfe3b909b9a8f3833c80f9898d78906346cc8a688bc50cbc639ac801e97
TLSH
T1C6E0268555CCC23EA660658752AC834DC2C3B71FAAC8AF1A7700848A7283880A6C2AA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9ed533ccfe489e582a9b2c442b8349145216e243d281bfbdc07244ceb382d957
MD5 a42430f6e8867458b231e7f54219799c
SHA1 605dc331a33c6096efaa070b2b3bc86e94f0d793
SHA512 c9b8df25c3477828dc3218c759bd19ea398bb587a41080831674c4d8f5f713b65477c0074f25bf499bf736c45e3f94b11a97075c756618db4775da51334008f0
TLSH
T1B4E026A526CCC2EFAB406447927F430CD2C0360FABC8A90A2709848E7203040A687FE8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 350cd9473786d13b1de0882d9d41c35f514e5fbce1928691ba3006a8b2317a4f
MD5 738bcd34fd9a318082462c84d5ee8e1d
SHA1 952ca610165edc8438d0059524b04c5ab095048b
SHA512 c24f4d30a7c789a4157f52cf8ceeb96e0612ac0db1b150b9a162276aa392a823ee8e401a78c101c949b870251bd21a89092165b20b8f4cc6d678b619e632b825
TLSH
T19EE020D554C4C3DE9504648751BC430D83D5761BA6CCEE453700C48F72835C06AC1D60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 724c26094b1bd2181b6b83fa07d2784f923be6699156117d613566ade192f269
MD5 261ef758ccc2b02092600be1c051fdfc
SHA1 76fdb7a3f92ea4ae043dfb38a782743d22193564
SHA512 5d76fcb46c0055738700410d7929168e656d7cd767edc146a8bdb5c8cda1b7180ab737048ce079686dbf27f347fcab2d9c581518843283a0440cd2c7763cc145
TLSH
T17571810D05D20492F3E51E31F4D336D7757284B84A4B0E760680ABBD6E16F2D4CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589de1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589de1.TMP
Size 3KB
SHA256 d923533cfd1e8f29938e09b7d2ed475699d3b6f7ae30a96a431bada5fb7447c4
MD5 006233c87e348974d436b9e46d95b83e
SHA1 c98042519542a59181ea2e8f93f187050979bf93
SHA512 6ee2762156bdca8f771967e6c7faa0d7107fce34e00b8c0f006ecc2b596355b40f492c1b5ef3fd03e208a0c739fb2fe05952d94bd211c08cb2fdd5c10c842726
TLSH
T15F71801D09D20492F3E51E31F8D236D7757280B85A470E7206809BBDAE26F2D0CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6428548d2ac533baab0e34bdae1f81da3dea813b587bb71190dc03c0b3d9f456
MD5 f0ce11b52758bf26a7899c88a7fe30d0
SHA1 e0b9ba601b35d94d6713ed4948f0e6b45e0085c2
SHA512 ea07d5040fc1672b5399aea56dc2b7f4734cee45b8daeb20cba5a3aa503c61e1d8ee5b2e7b0b0a3ed2eb0a27ab9ef396276c94897ea41ac31e691adae16ff50c
TLSH
T114519CF2C3F4566EC9111AF0AA146F2BDE1D092A42687C1689D4EF4BA3E25B5D011A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 dc4b5055fb2434e4a9400981441e54dc01482539935dddf1210b637a147f1b91
MD5 6d6ed6a1f0b92a161eb63e35a7a153df
SHA1 f54dbb99b1a2ef4b548b6c016a1f184f907d1fe6
SHA512 73058ac812d07fe935d04229778bd68ff892a4f1420bc36bf680344d359099dbd0f6273a58a8f47da1c3f0b3a0b972c053ae8036ed9c73d0c9bbf161f7d6766e
TLSH
T11071CCF683F4466EDA1156F0EA04AE2BCF18051A436C3C1A89D0EF0BA3F24B1D111A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f12e2871168a72bd2a04806b1d5f6e8c6d0b13ab4e3efca68f65fb0a0ce5a639
MD5 e29a7f26f22be646511df290c14c0b20
SHA1 23dc49fd938ffe9e4f3a39e175fec17eaa53271d
SHA512 b02fdb9b80f3971ab44396540806955af793d252be9fdc8518161bd7bb47bb00b5a985d64728b08a38bea9a09b61806f235417168d316cd432a29dce448b1f21
TLSH
T1FF51ABF383B0566EDA1156F0DA04AF2B9E18051B436C78258AD0EF5BD3E30B5E051E4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 07088c7151eed0f2b5ec088877e73899bf1865572e982a8a2dc1a7543bf758b1
MD5 993a835624511e1eb929746d5e625cee
SHA1 077a2fcefebd5153bae1c1956f3917acc1fa3477
SHA512 4fa6e991106373fa107905510e19c4c7ebdd9f930e31f96b5e15ae757deea89cee0f7ec500e329521515def93c2ce65e8368a34757b11be6d6db78cb8595f5ad
SSDEEP 192:sxZJRTyM/jK1Ml8Mkv/fQs6uUIdpC+HW6+WNx5h/YwV6GwIgrJ:sxZJRMv/fQs6uNhHbV/Y9
TLSH
T16F42FA116A349977CCDBD209FA55BF53D6F90472D2940E44A9FCDA0C05E6AED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 814dcb09c0f71402476a4934859a2da9b6c5bd405cdc442dbf1e9418fc08f4fc
MD5 c05513b03a5c5be8122be8376d5bde7f
SHA1 46f42018e6f8ce969793c266cf59feb3bafdb871
SHA512 c567c70c1ab3a8b2d3bdd1fbda7957bb97d38574e2fe348cab7bb8ff347649f59db87788e2c4d8c6555876edd9702786837fe5dd136140cb4634e281c36ed937
SSDEEP 192:sxZJRTyM/jK1Ml8UQ9kv/fQsHAUIdpU+HW6+WNx5h/YwCvGwIg5/J:sxZJRqWv/fQsHANvHbV/2H
TLSH
T1C5520A11AA345A77CCDBD20DFA85BF53D6F9047292940E44A9FCDA0C05E6BDD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 cefcaf6eb859abd812df75e2fe1a39f9b98bbcc83d5f7802ad889f4578375645
MD5 2b964741b9276d70e10a8ac30a5d06b7
SHA1 729a95f177875e1d13f17f811e0b185740ab207b
SHA512 5b2bbff8a2ada8059dade1839c865e5df6dae0cd23d7b6e20027bfeab19e43ceef07accc8ab4084abd0ba0ed5f08b1dcadb6277effcdfb4f8c79270ed4fb114a
SSDEEP 384:sxZJcqWv/fQsHQ66s8qMpRiYnazAW8pZS15posJWeT+ONvHbLdEH:sRrWv/f7Q4Mnc7WeT+OVHbx2
TLSH
T1ACD219059924C877DFC39D18A47C7E33D9EC40A26285CEDA59ECCA1C019D5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e7274e9e219380ad12677455d7b622008a58e37520cfc0ff0f13ff669aeb631a
MD5 c0ed0c2acf68d252ee67af970cf261dd
SHA1 f583af3ce0439484644eacc2de0eb5fcf967e8af
SHA512 55c91030fd719afc9d69fd2b1cd2659d4768f3406b185891c5fff0291edbc41d61eb942b969e45733920a3c39366974b6d67baafe4a3b166e033053b62586987
SSDEEP 768:Ri4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dGrohHlhac:Ri4jeXmWvmKxEu1jacPLZQd9/R
TLSH
T147E2093B280CCB7E4F844E5DEC26AE976DD802CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 627382d74d3a3928edf8dfa24741f35bf6ac054e52fa891b1bfc26fa8d572b38
MD5 51e76f71042777dcc988466a248db412
SHA1 c60039b684307ba499f0e18154ea1d0bf611ec12
SHA512 6630c62a6ac3d789a05e352cae89e3a910349c323513130c4b04178001903d72a1f9adeb7077dff71d8b2ac03bbf9b86d6359c780a223d96f28d459fac8147f5
TLSH
T1B431204D8E91AD5FF46844B71573B9E8B370C9CC4620E323987C62722E1678A1A5B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd4ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5cd4ad.TMP
Size 1KB
SHA256 f138eb58713fd25d0fc4e957825bb96b9207da0b6ec501768023804cb99c6200
MD5 2c2d75522fa69b63af492d648075fcc1
SHA1 93e189b400472eb067761ae1c9ac38694fe146cd
SHA512 77ca85679252a085cc3bda67a47cfe208be74aab985044d8d03933bc7b52d785778e4ffd2cb01ebe42cb918ae9793576e422b35c742d72bad5482e64104abdc4
TLSH
T1E631325A4A918E0BF8D4507B1A63B4B87335C8404322B393A87C6239AD21B8E2E4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c031ba27a2818b2ac6034d81158f44726cc451a7e64d4c1e499f8541d175e1dc
MD5 a2623bad4d9143b7ded6a2d7dbbff911
SHA1 6b94a3831d8b19695284966fe443ae8b76193488
SHA512 45488c7f887ed71699ca54bb82cd333900e830d2b1122ef495fb35e16dc338b489159bb0413467f172ac18ee78dc46bde7fad6cb12076202d5da1a36485dc7a8
TLSH
T14DE068FA2CD72E20AC7F47E628B204A44006B428C554AC8F2416A2E750A02682016C20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b4478e752c4ae143f3c62f8eae771a11c965a20e8ee20a90ff7c67031400766b
MD5 17bceb430890cdde064be4000ea987af
SHA1 c6c05836c6fc8c5e315d792170fe877795397e4e
SHA512 d8cfa0a349c89d218e136ae24432eaac248a1637a58566c0fb8a5cc2d0da1413593ddc2c5082a529f4885c60c2794409bcea2da9b57d600c91ddc185c107c105
SSDEEP 24:Kd9f4LiandPrD4bf+yIj3DKiMhaZD1ElTSmtMI8LAyXY0fbwRaudmWy4uK+BIjcm:KsiIfKnKQDyN1IRK+0MWMIPKNGc/yc
TLSH
T1D091855774BF06013DBE2E0DB164AA175B41B067315DA82B7BE844E24E6AF221CFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ea0be68-41a6-4889-a2bf-8fcdb07fcb60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6ea0be68-41a6-4889-a2bf-8fcdb07fcb60.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 03cb1b8f5dce18c8e65b04bde680c9cf02020f8172e2ee833ab0643a8b97ce6c
MD5 e66f3dea878bf2b4fa24e42dbdad5fb1
SHA1 e37f9ebba658b8f25475dee5e1adab0bead75892
SHA512 0ec7385a6d96c1f7a9c8de6ffbdd253c1e3d1d383af599e0c92d7a18650a0c155ec3826530d32c40a7b10a438cc5a0676604a9df2bf9268112419238d0aa1fb8
SSDEEP 384:oZcIhsN64dUcH9N/f+xOE1hpxJrqFK6HlytEDq1wWT:Wh5KXYOshLhcKoy6DqOWT
TLSH
T1F0928D3159785C378EE6B551F48B36038FF95023AAD96FD4A1EC7F2D00DA6AD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4d5d632493561e23b5d3747024018d89eef548d1f4534b8d37d30ef280134127
MD5 174538b98a0e33c1318e961286e11cdd
SHA1 aecd37a16b516057722cb7fab3c6240a467ea576
SHA512 72900e7bcc8bd2fbd1ffdac224fe64844dcc8fc9a98c9ac7ef0185f23a1fa69937631c9b3bcaebccf3f2df6877e34d94c0135071992267f4a4e2072d02992119
SSDEEP 384:v7iFiZcIgzsNC8TUNTUlIlhdUcH9G/f+xOE1hpxJrYFK6HlytEDq1wWT:+FQ8vwgqBXYOshLhGKoy6DqOWT
TLSH
T1E5D21AF145E78836D9AE5B43E77D2D038EFCC063B595AA94B3986A1CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37038a50915894a7f4ee03eb74ce9b9d9fff813db9923a22bc3c27f71793780f
MD5 ff6d1b0f0ded566fc98745f223f5496b
SHA1 80471427d7ac7c2cada4656695176d504ea79d9f
SHA512 88ace2ece4055ca7abfb206a7ae3fd3097000a2aba09a4f3a786973415dd01d5031531b43448a97fa45d02e486f06809bb6dafcbd49552ede77bf8a93ec7093e
SSDEEP 192:EONa6hZ0QmiUyBDpc/+jVnO1u1m5wOZy5fvU6:EONa6oupu+xOE1F2+fvU6
TLSH
T14D02D83568786C778EE2AE45F48727135FE5212BEA956F84E6E82B1C00C779C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 13f77d28fb14e29b41b57ac29371bffec751a0e8ddefe5221b070aa8ec05867a
MD5 266f77b5daee6a8818955b1fb530fdc7
SHA1 1761d53b5bb685fddca549540ec8175d7e64df1f
SHA512 776b1c99295735affe9e2a4a5b8ecb81afee9dadadf1465ba74599e4854a9d045e78ad3b9253fa3d977a1dacb1cf7bf2cf6c988a1f78f4bfbdba74c7e28b41f9
SSDEEP 384:HZcIhsN6hdUcH9N/f+xOE1hpxJrqFK6HlytEDq1wWT:vhaKXYOshLhcKoy6DqOWT
TLSH
T160928D3159B85C378DE7B551F48A36138EF85023A6D96FD4A1ECBF2D00DA6AD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c2cd5986f15d0ca08afcbcc8738aa4f7bb11801cd10681fdf8be58dd1025a54
MD5 2539b07982b9163aabf4c8d4f14f72f6
SHA1 9f2525e878ace0d733e0ff0fa870c7b6a6ea1604
SHA512 13c6f74346ff1304bb092879450fa32dc4ec837e16e741f78c649ece3fb11d731009513d946172c918b726fd234799329c0000ddeeb13dada90393a21cbaebb9
SSDEEP 192:FONb6hZvQmiUyJDdc/+jVnO1u1hjFuSJrV5cOq2qmU6:FONb6Fgdu+xOE1hpxJrQ9KU6
TLSH
T1AD12F93168A8AC379DD2A991F48736539EE91167EA897FD4D5DC3F1C00DBA6C230AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c074b878-be83-4777-add7-8e2bea968b46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c074b878-be83-4777-add7-8e2bea968b46.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5df7fc095546561f9a475a9aeba11bd33d39b0622b33f28a604b8974e35f50cb
MD5 3781fc4c316cebd80e58267b6f99f673
SHA1 f58d0a3e20298d7574750304b23d6095e116d994
SHA512 84a33f3ef89f7d9b657a4a21720ed4e36ddc83494b0fc10acd703c1636259519f7c045b3a4b86ffe47303863b8f4b52c7a67c6affdb311817365a018df79f32b
TLSH
T13541D858A6F91148B3B76F5AAFF2A46D487BBC772E0BD45D10010E8E0A22F41C962737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download