hxxps://ruitersportwinkel-nl[.]com/

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ruitersportwinkel-nl.com/
Sample261026-s6a6kaez21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4928	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{76B239D0-6FE7-45BD-970A-3B5834703278}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4736	864	msedge.exe	83
PID 864 wrote to memory of 4928	864	msedge.exe	84
PID 864 wrote to memory of 3520	864	msedge.exe	85
PID 864 wrote to memory of 3520	864	msedge.exe	85
PID 864 wrote to memory of 3520	864	msedge.exe	85
PID 864 wrote to memory of 4656	864	msedge.exe	86
PID 864 wrote to memory of 4656	864	msedge.exe	86
PID 864 wrote to memory of 4580	864	msedge.exe	88
PID 864 wrote to memory of 4580	864	msedge.exe	88
PID 864 wrote to memory of 4580	864	msedge.exe	88
PID 864 wrote to memory of 3084	864	msedge.exe	89
PID 864 wrote to memory of 3084	864	msedge.exe	89
PID 864 wrote to memory of 3084	864	msedge.exe	89
PID 864 wrote to memory of 740	864	msedge.exe	97
PID 864 wrote to memory of 740	864	msedge.exe	97
PID 864 wrote to memory of 4700	864	msedge.exe	98
PID 864 wrote to memory of 4700	864	msedge.exe	98
PID 864 wrote to memory of 2812	864	msedge.exe	100
PID 864 wrote to memory of 3388	864	msedge.exe	109
PID 864 wrote to memory of 5840	864	msedge.exe	110
PID 864 wrote to memory of 5448	864	msedge.exe	111
PID 864 wrote to memory of 5540	864	msedge.exe	113
PID 864 wrote to memory of 5540	864	msedge.exe	113
PID 864 wrote to memory of 5208	864	msedge.exe	114
PID 864 wrote to memory of 5208	864	msedge.exe	114
PID 864 wrote to memory of 3076	864	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ruitersportwinkel-nl.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa3a36c188,0x7ffa3a36c194,0x7ffa3a36c1a0
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,3344975008952875892,10669170146101317467,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8375850211237644941,2365301970436523269,262144 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,14764154019770114366,6884567714959165116,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,13613201900506833279,6554202899136708441,2097152 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,1904388044734194346,15086387215354935897,2097152 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,9276884982961529748,8287710650028231868,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,7693175038794841399,12383812807564896690,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16297169835837603604,13497094548615353552,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16297169835837603604,13497094548615353552,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,4737738364818562349,12806840921966907100,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13180899247683562351,2832532851345157907,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16361059074810117471,11023293808877086746,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,4617214612605822515,10742382281819752224,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,12112161921667655231,1916159176614741691,524288 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,179593602853891656,6557662879185621062,262144 --field-trial-handle=2312,i,18009080797190592833,1653302754599908261,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2a096131-a077-487e-adb7-42aa837678c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a096131-a077-487e-adb7-42aa837678c1.tmp
Size 25KB
SHA256 884da98ae603533af2d8d95fa896f8459193295e6176f031e1128941856dcaeb
MD5 839e2afe945e8059300264a72c04a758
SHA1 d4699c326adb360f1c1afae0a2b841e58dfebabc
SHA512 b0f1d371f8193c4faa0169c7f64c94e19ef0f3e0d3c211d07c98f82e373f3b014eb3d6f31cb3652c84c6fed4c3dbaf3211acd188b3ce2af013bce1d683b81499
SSDEEP 384:naiFiZcI63sN28TUNTUlIm2aKMiL4w2fiBCC2TmDGFIK7O6R2FeoivgL/7Iz4ou:RFQ63vwgcgnBC5TmDGFIK7TRXIx
TLSH
T16FC23A36EC98D9ABEDF68FDAA74A7A03DEE00163858C89C4D9D81D1D00975ED130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61f2f8cf-b3bf-4955-9265-9f24370405d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\61f2f8cf-b3bf-4955-9265-9f24370405d7.tmp
Size 26KB
SHA256 bd3bbfe446b20f836c435a2a5afc96330212cd8aa0e7301a8e0a19b624fa4098
MD5 07a6ec4bbdebe9b3089ac77281cb79ec
SHA1 b21fc51890af44b7b7d07ad392bd36c14fff07b8
SHA512 e6339e63e9147092577ad8c0fc7e64a480a2fbb89406d8ec71d9fe73244016b1b5ba775cda38631346022b6d0be9285767ae5ecdcba624e4b337bae808547ad0
SSDEEP 384:nIiFzQkUSvZ3sNe8TUNTUlI4naKMaNyw2fiBCC2TmD9uhiIc2I0gL/7IzEIIlR:TFdZ3bwg74NBC5TmD9+iIc5bLf
TLSH
T134C23936E898D9ABEDE64FD5A34E3643DEE04223CA8C9AD4DAD91D2C00D71DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

3c27d1c4-ec38-4a52-ad64-3fb1d1376e4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c27d1c4-ec38-4a52-ad64-3fb1d1376e4c.tmp
Size 414B
SHA256 63929f4d460570cdfe77c72b8b8a199d03b5890a2be8f19441add6cf6700a399
MD5 d009de9d60e9a2f9b843ce0a2d678864
SHA1 1ebd9f55599e11999da4ca1f416f2608a05d3eef
SHA512 46cb27dfdf72d044963b06a8ac26e96735b7e33835ade77474ff53c4fc3b2352154653be03973faa80ddad0dca65d90185833c2e3d4d9c44757b31682c7b1333
TLSH
T1B1E0E5AAC915A82B08FD0A7D54540245E70013272B40984B7B3D940C8FF0936428586C
MD5 SHA1 SHA512 TLSH

Submit Download

745f41a0-62bf-4934-a30d-a2d612c638e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\745f41a0-62bf-4934-a30d-a2d612c638e0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 beabc4dd741804da155d316afee49507dfe89de68b469056911f3072f516a5ce
MD5 831c2c1dc6443c88d49700e62ae2624f
SHA1 a0894109a05ae36263bfab9a35938374d48bd8a6
SHA512 644b62ffa2038d49fa5443d85db5a82c5b666db8df08630bc63faec90b73cf8c80a313a64c5a5d9511aa74cde8ec4ddcb666f45a076ffaa4f3eb939b44676909
TLSH
T120E0209406DDC21D5704A487035C938CC380265A96C2A90F1704C699F0864406791790
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 33KB
SHA256 4c0688d7f9afb83385fe2b9aac2d2919252fb3eef930f67808d4214c63acb5ed
MD5 83d7c36bdaf4dfedb1b7d948d56ee873
SHA1 95d395d3017b8cb57160d62b5192b116cb97970e
SHA512 0b135d6872bf7e14695d315bd7df291c5e3e210fe3025bb18517232e714f9a4f3c0936e38a425c7ffc44907051e044e934f18f87b2d826391987e9965158632f
SSDEEP 768:TyQQZyVH6ER994U89pHLv4pomamYqVqSWkO3m6awoWPHUUGeR9bRau9f:m98B6ER99RGFuoaFItkO26aiP0Ujb
TLSH
T183F2F1459292FCD8AFF8BE78610CF05C74058483C972DADC6A4A35F76A89D7B0CB090D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aa58b33802fedcbebd525a0a9a9122c3cd12fbe18e72b813d01507837880f6ee
MD5 4fd7366b74fa171e0a105b611b1503b9
SHA1 7381dbeaf475b5f439f5fbdbe4afd564c33d30af
SHA512 d736d3fa998ad21f6e85e82b6af295fb92d0c9b48cf3b2f6f938780da480933a9e416f984d1acac582dc9faadd98e1596db0aba893c20923eb014db9043eb820
TLSH
T15B71EE61DB984A64FFDC647062E49E77363C19429FE3BF9380E6ECBAE8573985120204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb3334c4f6fdd60df55412f187e05a8b9b70e941afc7fb86d0fababa7b03f064
MD5 27567819fbd009ccbc6ff7eb36018eb4
SHA1 6212f536011e8f6f4448c36dc91014b956876be9
SHA512 540e4827b486b9b79860bdfdc888d3281deef389ee024462faf1cf7c78f5d2933dbcd01644a1e6a620a19b7f9892f2c1b94339a49bd9301ad122dcc7fab4c26d
TLSH
T1B751C861D7504874FFDCA570A2E4A8BB353C4942DFE3FE8384E6FDBAE89A3146200214
MD5 SHA1 SHA512 TLSH

Submit Download

02c06027-35f3-403d-8c90-1ca3b7b0171e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\02c06027-35f3-403d-8c90-1ca3b7b0171e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

532b0109-5874-4d67-ac6f-457038e8f04a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\532b0109-5874-4d67-ac6f-457038e8f04a.tmp
Size 1KB
SHA256 b405a00241ae518430fa513e804c57d05dadb7b212b2ee4c940965ae9904bf63
MD5 9b6c138697218436cf69d15f44c5cc02
SHA1 72b5cf1d727cf46fcf91344d98aa087b2d89b61b
SHA512 83ce9e4c31bf88be40bd2fb4fc1e9e8cf2b5e62f0902a036fda06e0512e0f54f1d346dcee2f150d58141fdd573d715aa5e60d16061d82a6d6583bc5ff33b2cfb
TLSH
T182318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

58ba454b-fccd-48a4-9fb1-4921da44dafb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58ba454b-fccd-48a4-9fb1-4921da44dafb.tmp
Size 1KB
SHA256 ce4043574da71be16df3e9760945fbc211a657edb8093bf889cd5aa97acc8db1
MD5 d8dc7167f8c7447e3a39d69b2cd15b73
SHA1 37f48f2d898c60af824cc9143c152af54f0a868a
SHA512 ebae0aeeddc837448afa32eb768f7ff4d7c26dc154cf337c51c7c76d2e4ceffb1b00e4b7f567ff17cab1b1a96ed4f8e47c9ffc0d2b7fb3ce3d94aa51fcbe68ba
TLSH
T1FC318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

b553a1af-440e-45b1-b208-cd0cada2d4da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b553a1af-440e-45b1-b208-cd0cada2d4da.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e62f6830-012b-4feb-8778-26fd6dc39fb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e62f6830-012b-4feb-8778-26fd6dc39fb5.tmp
Size 2KB
SHA256 d39845a9bd22bf0d57531687ad5f5ce64ee1dd0a316309bf65950983d73a5638
MD5 2ac3e5c0c6db696f657eacfe1e8b0598
SHA1 4c4c043fb0555d45a6a06d2ce65b0e9f3b8e3282
SHA512 9df214dc2ce41feca8071a60fa2800efbe12902820df77a9a6911a3e3dc746d72fad5e67682432880690c4a71662a64d92204d6f0bf4017bd4d3e44cd9076366
TLSH
T122510DF787F4865EC91556F0AB056E1BCE6D0416932C3E5A84E4EF2B93E2071E102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

ec5a9ede-5266-4bc6-b1ba-a209de0c0a04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec5a9ede-5266-4bc6-b1ba-a209de0c0a04.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 cff9e6d98251423af2bfdcfd288668339c0d99e547fa744997c45bd4db697a72
MD5 0186a4fc55be4d97958eb42a2c8c9d38
SHA1 1f5cf505c5c7f79a5685823aec5cc8f0caf7391b
SHA512 e435d5a121121c0b77bcec4d8d62a4abf856836160deea6c4953cee353090dc7cfa4eaafa1fbd377f342ce2a0de1944e93112fddf3bd99ac7f6635559bd8a0b4
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3+tfOE1wUqe6PWzwsI1sSX8sjyktg:SL29ObJffppdNlrt+l0W
TLSH
T1BCB2111571BB421039FE291892B5972E068231B33119E66F7FBD04B69E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a24907d5-786a-4bd5-8ee1-c0da7e836cb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a24907d5-786a-4bd5-8ee1-c0da7e836cb8.tmp
Size 12KB
SHA256 d16c98315f3f7495a75342dcb9622fe894a8bf495bc6b9ea70ef10f1b69f6a7a
MD5 69412e0fdfa904aadf17d961485a1400
SHA1 bbb18f6ec6782c3d27231cefd62935d4a5c465a1
SHA512 d15bd4ef09f512d97488d9b4ffeb5a16cbccc6bee067577532a40b1bcec08f0a340493b26502d130ff81b035f62087a6b6fc1387c0c09ad71b66efb54f1f2511
SSDEEP 192:sxZJR7kY/f1svEaQZLZ82zodp0KHW6+WNBHL/YoOo1SPWIg5qtJVJ:sxZJqY/f1sv9OaNLHbp/ZSmotJ/
TLSH
T16942EA15AD38A93B8CCBD619BB557F53E3FA503291811F48AAFC8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb4537a5-ca8a-4fd2-ae2f-c125bd2c1060.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb4537a5-ca8a-4fd2-ae2f-c125bd2c1060.tmp
Size 12KB
SHA256 15baf468ad29920ca103bfe5b7f1b86d2e008ec659577321456629b8481a1923
MD5 6ed22788e9175aa30cd9155c3c6eac2d
SHA1 35df5896348cdbd3b066fc39ed9dcd73980e94ac
SHA512 2b36cbb037d320c5de52634c10b1a3f98bf604ee8f22ae55eb246c5be811d809ff485a0f01a7780b06088b85dac9dad27de9ab7a9656bb8c7b20b6ce1929402c
SSDEEP 192:sxZJR7kY/f1svqQZLZ82zodp0KHW6+WNBHL/YoGo1SPWIg5qtJVJ:sxZJqY/f1svqOaNLHbp/RSmotJ/
TLSH
T17342EA15AD38A93B8CCBD619BB557F53E3FA503291811F48AAFC8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d54ae7d5-155a-4336-bf8c-35331cc9a912.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d54ae7d5-155a-4336-bf8c-35331cc9a912.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e393bc5d-6584-47c0-961a-f28f80f5dfb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e393bc5d-6584-47c0-961a-f28f80f5dfb1.tmp
Size 12KB
SHA256 8e85890f16f19a450bd42208a7d71caa96e91cc38de90e37140b99f65f61187c
MD5 755507b78e11a848939e48bb5d58604c
SHA1 7d7460eb5ecc86a02f71b64f890d520cf92d7746
SHA512 35c57c92bd69d62c9bfac71f3781d83776da02dcc0f156294002d6ae9c9f4f8d97ed0b9aeef2604c91a4fef8276a0377d144cd2126f55c90f9d3d46b4a0e4f97
SSDEEP 192:sxZJR7kY/f1sOEaQZLZ82zodp0KHW6+WNBHL/YoOo1SPWIgjtJVJ:sxZJqY/f1sO9OaNLHbp/ZSmjtJ/
TLSH
T13542E915AD38A93B8CCBD609BB557F53E3FA503291811F48AAFC8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

add24492-1eed-4dfb-b95a-a4e6d39fdf4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\add24492-1eed-4dfb-b95a-a4e6d39fdf4c.tmp
Size 31KB
SHA256 112971cb2d130718e5c5181e2554258fdffd6a853514bd0c1e8b5314e7791c3c
MD5 57c80ba6df75062b27c17be917e2b03b
SHA1 f8c82c76a002a02a1da79ae5e77ea27a34e8f36e
SHA512 645e959bc6e57108b49337ae791f4befad3c762cc43055f3e719f6f9c19341d2e6592acfe16f8f742c9179a1a5a2a73ada02038a0013b54eed874fb79f1add39
SSDEEP 384:n9iFzQkUSvsk3sNe8TUNTUlI4naKManyw2fiBCC2TmD9u+GmIc2I0gL/7IzEIIlR:0FdF3bwg7CNBC5TmD9RGmIc5bLf
TLSH
T1B3E2A1F598D79977D9EE4B97A33D2D0299BCC123B5884A84B7C81C1CCC961BFD20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af2ef241-80e1-454a-994f-29609fe9f6ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af2ef241-80e1-454a-994f-29609fe9f6ce.tmp
Size 26KB
SHA256 ea3235ac08c4921c1178a02d707923ef03d2d146c2c511b3fc027c7c941ba653
MD5 f98cfaeedb9f3f8071c9966629b73410
SHA1 b3a71128ae4ef9eb2759f34f05a76d598de7dbf5
SHA512 d0ed9760081928f019ea4aa5185d4104ba6afb3205e2879c5a4312e622c0fb1900c74f4ea44499b44ccab5c1ce7cb08e084b7ecbf83751fb070db9bf4b182b32
SSDEEP 384:npiFiZcI63sNa8TUNTUlIm2aKMdEDw2fiBCC2TmD9u2iIc7O6R2FeoivgL/7Iz4x:AFQ63rwgcYcBC5TmD9riIc7TRXIx
TLSH
T19DC24B72E898D9ABEDE64FD9A74A3603DEF14163898C9AC0D5DC1D2D00975ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2bbe1ce-15fa-4c96-becb-23bc6330e7a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2bbe1ce-15fa-4c96-becb-23bc6330e7a4.tmp
Size 26KB
SHA256 752c55ba4f593f24abfb6a59261f9f50f945b739b1ae31508a1a2d8dac964ddd
MD5 6a122f2b9ec5de902903478b06eee29b
SHA1 8a974f62c7b0ac42073bc69d3375b04cb1ee9bca
SHA512 cfe7911f69483f858a5b968f6ce8559b371f00a7e36942aa8796b04cc935341ec944cb13fab52d9bcd735f5a202954420d4d03350b06e003ba928d576d115876
SSDEEP 384:nciFzQkUSvZ3sNe8TUNTUlI4naKM8bNyw2fiBCC2TmD9uhiIc2I0gL/7IzEIIlR:HFdZ3bwg7ENBC5TmD9+iIc5bLf
TLSH
T1A2C23936E898D9ABEDE64FD5A30E3643DEE04223CA8C9AD4DAD91D2C00D71DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e936045309cdfdd8371a136ab94bb9e73c105aa671375d6634baa1d50153378
MD5 e52543db03966737ed1375dfe53240fa
SHA1 f579a7dfeb74949f8f6d24e81267f25393b53f1b
SHA512 e7a87e058a54ffbab0c674d83102b49ed24ee40d36a4576e4e390b5a8f82b72173ed47a8c4b3be1ab551962135992fc7bb41f4bb75ef38f045a00b746d3d6fe0
TLSH
T1C3410999A6F91148B3776F1A9BF7A8AE483E7D372E06C59D00110E4F0662B40D972737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-280-0x000001FCC57F0000-0x000001FCC67F0000-memory.dmp

Download