cbf430f08664a584c765f2375e27f9ed36633e815b3aad7fd211e94486773464

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
redirect-to.html
Size 4KB
Sample261030-jtkd2adh77
SHA256 cbf430f08664a584c765f2375e27f9ed36633e815b3aad7fd211e94486773464
MD5 4cccbdb64d17d73a1146ef48b5a8ae02
SHA1 7ee149c19467d624e49446448922deec726d2f70
SHA512 ec3eff4a188214911568b55dadaf2bac6a6b19ee137ea38d2d65eea8b411109f232ff00cbcc636aa6d45710af3912e9427edea562b4ac593a5646a6c0277c970
SSDEEP 96:1j9jwIjYj5jDK/D5DMFWC8rZqXKHvpIkdl27RslvaQxvbK:1j9jhjYj9K/VoWnYaHvFdl27qlCejK
TLSH
T1A1916426BAFD217E10A391A226EC63487EB0C553C6A705A076ACC1391F9FF59FE171C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{80298B33-F3D6-4709-B224-B6558F1D50F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4820	2064	msedge.exe	85
PID 2064 wrote to memory of 3516	2064	msedge.exe	87
PID 2064 wrote to memory of 2976	2064	msedge.exe	86
PID 2064 wrote to memory of 3516	2064	msedge.exe	87
PID 2064 wrote to memory of 3516	2064	msedge.exe	87
PID 2064 wrote to memory of 4432	2064	msedge.exe	88
PID 2064 wrote to memory of 4432	2064	msedge.exe	88
PID 2064 wrote to memory of 1876	2064	msedge.exe	89
PID 2064 wrote to memory of 1876	2064	msedge.exe	89
PID 2064 wrote to memory of 1876	2064	msedge.exe	89
PID 2064 wrote to memory of 4528	2064	msedge.exe	90
PID 2064 wrote to memory of 4528	2064	msedge.exe	90
PID 2064 wrote to memory of 4528	2064	msedge.exe	90
PID 2064 wrote to memory of 4048	2064	msedge.exe	91
PID 2064 wrote to memory of 3164	2064	msedge.exe	92
PID 2064 wrote to memory of 4048	2064	msedge.exe	91
PID 2064 wrote to memory of 4048	2064	msedge.exe	91
PID 2064 wrote to memory of 3164	2064	msedge.exe	92
PID 2064 wrote to memory of 3164	2064	msedge.exe	92
PID 2064 wrote to memory of 4912	2064	msedge.exe	99
PID 2064 wrote to memory of 4912	2064	msedge.exe	99
PID 2064 wrote to memory of 3912	2064	msedge.exe	100
PID 2064 wrote to memory of 3912	2064	msedge.exe	100
PID 2064 wrote to memory of 4904	2064	msedge.exe	102
PID 2064 wrote to memory of 3048	2064	msedge.exe	109
PID 2064 wrote to memory of 3928	2064	msedge.exe	110
PID 2064 wrote to memory of 1624	2064	msedge.exe	111
PID 2064 wrote to memory of 2376	2064	msedge.exe	113
PID 2064 wrote to memory of 2376	2064	msedge.exe	113
PID 2064 wrote to memory of 1272	2064	msedge.exe	114
PID 2064 wrote to memory of 1272	2064	msedge.exe	114
PID 2064 wrote to memory of 1868	2064	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\redirect-to.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ff8cb41c188,0x7ff8cb41c194,0x7ff8cb41c1a0
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17548230559683117639,2586094150270430190,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12158268938998159949,4180212565579132180,262144 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,1243051474658659797,6018982141358804828,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2857526871296584131,13077048555967289919,2097152 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,957050298802990627,13213933592671759423,2097152 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,11678429322395800591,12500675792315038256,2097152 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,560657995713742597,1089006686828747723,2097152 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,12180253453599725427,3746903409045870380,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,4631233959518787662,15468609284288160527,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9208877463010846704,17393606331510308205,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9208877463010846704,17393606331510308205,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,2641885549219281030,16316623852589202886,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,3854957801242085968,10002604427393898950,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,2069921139958514807,10505743519862127242,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,7214492812276680847,13284816118026497701,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,12654771673391956652,4356347725360727755,524288 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,17455360663637468686,1354510664205468227,262144 --field-trial-handle=2256,i,3700484608799413280,2458150672728246489,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38ab7ad0-ac98-4b40-ac4d-48f3a556d029.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38ab7ad0-ac98-4b40-ac4d-48f3a556d029.tmp
Size 8KB
SHA256 842453762a791635325693b301f6efeb908d8dde63226810eb9b0acfb7718dee
MD5 81c52de823c91818d91daca0b4f19e28
SHA1 ee15f0aa3beca4ee2f3e3fe65d5b7b04029bb850
SHA512 46866f799f02c11d7731c6e991a3a348e5bfe3addadb53227665128c821dc3e18e61404e398e1e595b5dbd1fa98f2269cfe8c6cef0cbb57428434bc141e506fe
SSDEEP 192:/ONH6AmwpkQmiUyTnfsiX5FQVQclRtnrqqU6:/ONH6ip0efsiX5FQC2zU6
TLSH
T134120B35B8786C2B9DD2A454B48B35139DA94217EF887F94C9EC1B1C05DB29C530B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67726969-9124-4e3e-80a5-756553db38f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\67726969-9124-4e3e-80a5-756553db38f1.tmp
Size 18KB
SHA256 fcf4213ba4892d64bc4985be665301f4c15676216a6511871546771a306c2923
MD5 d6411c75b63600de343061d8f9698dc5
SHA1 383836665d99e96d51724eccb2cc186a94d7da80
SHA512 2a4dfd61e45f1fa1caed4dc70a9cce31b0f49752c79a72d02d349b1cd514043a1ad39db4588403dc394d5cb53b7f6250bcebf17a9b0af06c9ae68b110c955a4f
SSDEEP 384:8QkUSv0sNGIqnpu5cE49iX5FQCgz2IoMtU7QIIlv:80fXE8acDz5dUcLF
TLSH
T1B3827D35ECB96D3BCEE29550F54A36038EB8821BDBD81F94D9DD6B2C05CA1DC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c55e2b9-ae23-4c35-a538-5029ed15f8f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8c55e2b9-ae23-4c35-a538-5029ed15f8f5.tmp
Size 8KB
SHA256 a9da79ddde26959400e08dc48755203eb4a95e8b35d7afe5bf5cca6057ec9f2c
MD5 658db5ab26cf93fb9c88645cb0e7392c
SHA1 7dfd98ef6fae5df89ec3db75cc6d997f4816c8d1
SHA512 d5856f17ac27f46c41b923dfd50a4c16478265bfdeefcd1d947cc118520df55ba3c6f52677dac09e72531a24366d9e1d944d213763a4e3049622c28454ddae36
SSDEEP 192:LONV6AmwprQmiUyVn6siX5FQVZJit6LU6:LONV6ipdK6siX5FQc+U6
TLSH
T1E102E939AC786C7B9EE2AE05B48B36135EE5112BEA942F84C9E81B1C01D729C1307933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

516995c4-28b5-4d4f-9fe8-e8da145b5a4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\516995c4-28b5-4d4f-9fe8-e8da145b5a4e.tmp
Size 105KB
SHA256 e2d1a78ddd4a2613e2e137a9b8a6ee6a025f24ce78c71783944f051445e3063d
MD5 a68138180bf134fe6e360a0e37c3184b
SHA1 359c64103a0eb1cbba384f963ad47bd6cac7e41c
SHA512 a8338bac44852d511db583b349822cd7e5ec3c426141655b68ecc184832731c5830c69e5af34998dd6e85c0ddb2400530e818deb283053d561c8afc2b615cacf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T178B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

186ecb31-dc11-4034-a9d9-990ab6c5f900.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\186ecb31-dc11-4034-a9d9-990ab6c5f900.tmp
Size 10KB
SHA256 55aa84e7801fe2dd1844b6dcd809061f6d6c8011b015f76486a791ea588d4777
MD5 59b10b47aa4ebc4b9416936d038d5dfe
SHA1 534cf5598f4667bed4a87676322c2e0622761756
SHA512 bb07f0d2cb68432cbdad9f09b67cd158f24e0c85d4bb52fb447d2abcc5837bf11183540484577c67931ab033344f4651423058f036eb890116db3814140727f6
SSDEEP 192:sxZZRLWd/fLsvkkkIdpdHHW6+WNGY3l01VxIg5lJ:sxZZQd/fLsvkk9hHbGxF
TLSH
T1CC22B7117E38697BCCCBD21DBA15BF53E6F9503291951E58AAFC8A1C05E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25df73ed-d387-4002-9dbe-7d52225ef492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25df73ed-d387-4002-9dbe-7d52225ef492.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3945fc5f-4101-4481-b8a4-149c0c26cbe7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3945fc5f-4101-4481-b8a4-149c0c26cbe7.tmp
Size 27KB
SHA256 2db092edfa185d06e98475a646a627aa2ef68526dafc92e59a1ccdac26c200b7
MD5 1d906a4b588d87b5384ab72c08f8b904
SHA1 5e98998618e155d60374b7aec3b4e36d6902cbde
SHA512 856c224923193af31f065a0f348d5e7605f9f8bdb33fb0bd98ed111b0495149c10c36072df00ede1faacb91d66ec5716454acd766712277fd7511afc3ed8db96
SSDEEP 768:8w30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72zrolZMG:8w30AbSWvS2l9u1jaLmLZ12A5
TLSH
T194C2DB3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796644D4047FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50b59f5e-1674-4a02-b888-9d65bfb5ec1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50b59f5e-1674-4a02-b888-9d65bfb5ec1e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9728a4bf-15fa-4cf1-9517-c3a5ee688b6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9728a4bf-15fa-4cf1-9517-c3a5ee688b6e.tmp
Size 10KB
SHA256 de08af8a2a7d0d71a160fc33184fbca19758a310156bb14dcb8ab001f90b0562
MD5 642a9e569477e6eca340fca439a08727
SHA1 505a748d52a029465db62dfb6aa59486d3c44bfa
SHA512 e2c6c4c263b753d13b1251d8a2ecc8e71e8e167c9c1e66b73cfdc585b44d382da56ef7bda627fc7b3da91f22a211c688d754bf8582b78637c75473aedc7a8de2
SSDEEP 192:sxZZRLWd/fLsvkkkIdpHHHW6+WNGY3D0CdxIg5lJ:sxZZQd/fLsvkk9nHbGaF
TLSH
T1EB22B8117E38697BCCCBD21DBA157F53E6F9503251941E58AAFC8A1C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c3064ac-8040-4dc8-b86a-a48788b35aee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c3064ac-8040-4dc8-b86a-a48788b35aee.tmp
Size 9KB
SHA256 9e5a36ffd06fc6ef9157fe20e76d962703eab74db93bb835ea88453e36c2ec8f
MD5 79c748aea48d70219ed060eea72ba9de
SHA1 b9d0691a52eec220ec4be6c898bffee1dcc1b882
SHA512 069cf02a19b64e2f0b2647e6774758435bb490f0c8bd6ecea317625c2679cf288b168226721a0ea6149e140d1902f97973b1a7cce76db62a6df9269f32597f58
SSDEEP 192:sxZZRLWd/fLsvckIdpdHHW6+WNGY3S09VxIg5XJ:sxZZQd/fLsvc9hHbGmT
TLSH
T1C822B6117E28A97BCCCBD21DBA15BF53E6F9503291941E58AAFC861C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 93e4b0a47df6f59161f9901cf4dfd0a3cf2d2ba3a838e557427c632ba1b1ca8d
MD5 078439b0a7c9707188d043849914bdf5
SHA1 e6c689030df8306b197bf845de8f190cd7dac2b2
SHA512 b0e1cca630648c7a7396ba26c477513d1a1695b35f01fe992aad953d76683a2128bf91b657ed659ff69dd637b8dcd02270c799eb1f4ae3bd2e4e8d7640849f8b
TLSH
T118E0209599C4D21DD32CB547027C930C83F0761BD2C06A2E3704C6C87105E84E7995D4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 bbf0d5d38308f55c5c2932af12dca72c8850d3093abdc7686674ed13a0af6dbf
MD5 1734d73693e756e4dc689ea33a1d7a51
SHA1 b586b4551c1807751fc84d4276e21c05f5657b7f
SHA512 f2941338d5cbc8ef5af7938f8c618abb2473950dede668ee558aadcc08ac4d326bd3eefbb10117c91dd44ba6c0edbbd35a3205261da7a5150e6f403812dea019
TLSH
T16661EB85E55101B5FBE5B033B5F057BF363849B29DEB1E9ED1A4E278940E721313804C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75ea8b0a7817db27a2a36840aa97460f4430828b5bbf7bcb3ee5e189633ad842
MD5 f39568c2b557b0effe2856924d04fbfa
SHA1 a72cbb1c088c7244316b4b9ddab9cea586edb00b
SHA512 19d9689642e3d440dcd558e97a33ecfeb465b3b22f10d2d8d0b314c2404241d27d7caf9ad1e160f46339478318c707070f44bc4aac798a2d4a18238c484dc0e3
TLSH
T11C61FC85E55101B5FBE5B033B5F057BF363849B19DEB1E9ED0A4E278950E721313804C
MD5 SHA1 SHA512 TLSH

Submit Download

a0f49e49-9588-44d8-959d-ce44c0856b10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a0f49e49-9588-44d8-959d-ce44c0856b10.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3cd2779c-26fd-4358-bd72-807817168f63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3cd2779c-26fd-4358-bd72-807817168f63.tmp
Size 949B
SHA256 fcc3d1fb043041e36c3a613c7a73339722838ebe54070545c3c4188bcb28e948
MD5 35a7fa6e6eab25aacb6b0acb07ea28a1
SHA1 9a82827092ca4f2d3565bcee7597f4ac7349dae8
SHA512 b59570b87766143c096cc0b209dc922df65d27c7f8539c83f434ae9d137efc991d9d871a35e8388b8cf8247114744afd60644f3ef12b8755f224b207438ac4b7
TLSH
T14211BDF3C3D585AE890117F05A28AE2BCE2D0505431C7C69C5D4EF2793E3075E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

5d269d1e-86f0-473f-994d-7be2d15a8cb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d269d1e-86f0-473f-994d-7be2d15a8cb2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

dcb1eb93-e74c-40e7-bb8b-7d4cfa057b41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dcb1eb93-e74c-40e7-bb8b-7d4cfa057b41.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e55fe3e63de9d38f624730ce7f2becb79a5a8d984f148fd9453d9e8b9beea8da
MD5 cbc652f41fb33af810e04b8e49cf1dd7
SHA1 4a102ce736a3cea9f0e34f7ed241ca98ed967a2e
SHA512 79e8d642326e9d73c87f1bb52698e921a4472bd5a901de952358381a0d669f5a5c5e3d95d822b394b78bcd0c73bbf354374f196fa0bbfa4088890ad7031666c4
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL2xMwuUUNb4PgISINK9s1uNxmdYHY0H:KoZeK6kyeFGK20hsYKBKKCL
TLSH
T14B915001726A129138BD2B4890B4867F464236733429E57B7FAC92F64E2FE158CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9a1e3d5-54b6-4907-a3d6-70cae69f0091.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9a1e3d5-54b6-4907-a3d6-70cae69f0091.tmp
Size 9KB
SHA256 51f7fa7c73ac04384db4a8af624d1d0cb8e05fe8f2e43d0bad3adf81f357bebd
MD5 553d336679f5eb38923c7f0520dedabf
SHA1 9541567678d032a5842601d504c300283d205f32
SHA512 3b05e061a4736de9136508eb709b70439f30e71c21d36e268e4d454e2a764e750d11fa397e325d5471e3b2f9787ed09558fef57bbff09f50b3bc2b157bc9feb0
SSDEEP 192:sxZZRLWd/fLs3ckIdpdHHW6+WNGY3S09VxIgrJ:sxZZQd/fLs3c9hHbGm9
TLSH
T18222B6117E28A97BCCCBD21DBA25BF53E6F95032A1941E58EAFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90230a1c-c295-47be-84f8-319c66159f32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\90230a1c-c295-47be-84f8-319c66159f32.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ab5681a0-80de-4fc4-ac93-260babbf34a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab5681a0-80de-4fc4-ac93-260babbf34a4.tmp
Size 18KB
SHA256 5936ff4f4f35011f87e34517f6ce50ca5b1980824d3885b5feeb2d19bf038e33
MD5 976c1973891da1b4c78008cee3355743
SHA1 95354921c18d450575747742ce0ac171e465581d
SHA512 f108515c8b60566fd669ec2b5d7d46d85b135fee6d5adfb04abaa3d8f067873c187db96b0fda55b1161c28b49c955120b29f7d48099297e09373c36a494db162
SSDEEP 384:XQkUSv0sNGhqnpu5cE49iX5FQCgz2IoMtU7QIIlv:p04XE8acDz5dUcLF
TLSH
T11C827D35ECB96D3BCEE29550F54A36038EB8821BDBD81F94D9DD6B2C05CA1DC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d3d6d4b-648a-45e4-8e2b-0f1b93bbcb30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d3d6d4b-648a-45e4-8e2b-0f1b93bbcb30.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fb3622a4-80e9-4663-9675-2c25bf2738e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb3622a4-80e9-4663-9675-2c25bf2738e2.tmp
Size 21KB
SHA256 2eb755ae01e6ed2d7ac812563428ddd63682844d27cccadcceab27b803b73f8d
MD5 06d0683f0e94ba63874dbd9d7e2fecd2
SHA1 c32425a83fd09a056fc05a36faf0bd2c1d305b64
SHA512 87c9f1bdf4717a4543a53de0cdd08d0a4b3c92d0774dcb2af9cb611f0d8e910540396052f06d931b1549c380f8cd0a2f6869ab7fc0e8935d1847ac951ca820d5
SSDEEP 384:EiFzQkUSvHzsNG8TUNTUlIlIqnpu5cE49iX5FQC1z2IoMtU7QIIlv:fFdTXwgnXE8acMz5dUcLF
TLSH
T100A26C36ACA89D3FDEF69A50F54E3603CEB48157CA946FA4DADD6A2C01C71CC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 23258e9c686284d806aba4c73e50b2dc20b18d3625c0be92468201312a5461ab
MD5 b3c1f5db7108832af83d13d71e4add33
SHA1 f3daa2c145da6c8d057d3fd5a1358a064fcb9b65
SHA512 3986129a235411e8f7f92c542feaaafb15bc27e9efdbc5c9f3714af75c6b0fd1053ced5a27b0383f91c9aec80efae6518429aa70dfcb2827b714aa8407470ca0
TLSH
T179411A58B6F91149B3B77E1AAFF6A86E487FB9772F06849D00010E4E4666E00CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download