hxxps://0nedrive[.]netfliix[.]org/microsoft-com/store/orderID-917884194/track?rid=T5dhpuz

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://0nedrive.netfliix.org/microsoft-com/store/orderID-917884194/track?rid=T5dhpuz
Sample261104-ve2wbas1az

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2196	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{2CF05D67-BBBA-4420-A283-F9B618505CDD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1720	4748	msedge.exe	83
PID 4748 wrote to memory of 2196	4748	msedge.exe	84
PID 4748 wrote to memory of 2116	4748	msedge.exe	85
PID 4748 wrote to memory of 2116	4748	msedge.exe	85
PID 4748 wrote to memory of 2116	4748	msedge.exe	85
PID 4748 wrote to memory of 4828	4748	msedge.exe	86
PID 4748 wrote to memory of 4828	4748	msedge.exe	86
PID 4748 wrote to memory of 4712	4748	msedge.exe	88
PID 4748 wrote to memory of 4712	4748	msedge.exe	88
PID 4748 wrote to memory of 4712	4748	msedge.exe	88
PID 4748 wrote to memory of 2336	4748	msedge.exe	89
PID 4748 wrote to memory of 2336	4748	msedge.exe	89
PID 4748 wrote to memory of 2336	4748	msedge.exe	89
PID 4748 wrote to memory of 4476	4748	msedge.exe	90
PID 4748 wrote to memory of 4476	4748	msedge.exe	90
PID 4748 wrote to memory of 4476	4748	msedge.exe	90
PID 4748 wrote to memory of 512	4748	msedge.exe	91
PID 4748 wrote to memory of 512	4748	msedge.exe	91
PID 4748 wrote to memory of 512	4748	msedge.exe	91
PID 4748 wrote to memory of 2200	4748	msedge.exe	98
PID 4748 wrote to memory of 4000	4748	msedge.exe	99
PID 4748 wrote to memory of 2200	4748	msedge.exe	98
PID 4748 wrote to memory of 4000	4748	msedge.exe	99
PID 4748 wrote to memory of 4972	4748	msedge.exe	101
PID 4748 wrote to memory of 1444	4748	msedge.exe	108
PID 4748 wrote to memory of 1588	4748	msedge.exe	109
PID 4748 wrote to memory of 732	4748	msedge.exe	110
PID 4748 wrote to memory of 2504	4748	msedge.exe	112
PID 4748 wrote to memory of 2504	4748	msedge.exe	112
PID 4748 wrote to memory of 5076	4748	msedge.exe	113
PID 4748 wrote to memory of 5076	4748	msedge.exe	113
PID 4748 wrote to memory of 4000	4748	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://0nedrive.netfliix.org/microsoft-com/store/orderID-917884194/track?rid=T5dhpuz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffa21d7c188,0x7ffa21d7c194,0x7ffa21d7c1a0
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,12275978128976077815,6027389666306835842,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,6119400405613988966,18400274154317984095,262144 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,11270513295490448618,18278297751126504949,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,1243572626408149994,17218694239822768832,2097152 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,10298313151240223073,10815455826821168558,2097152 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,8857041663666421345,13641002281671439724,2097152 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,11158244603033223807,2631435668131855219,2097152 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,6636296273378081133,2855407827580820621,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,6639943623940222024,948331038925578955,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1344127645190569791,12990700814388081928,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1344127645190569791,12990700814388081928,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,1627099212012954641,16713739666683735739,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,15813667574551785778,17428320812213858190,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,12423857672973879166,11819366237966663344,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,17543266066135074741,10217093536991671864,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1283522740742819135,7238595945075146859,524288 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,10664083087954413840,3197045884178341577,262144 --field-trial-handle=2332,i,523483326837633972,5121094263374731657,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

32adadbf-4492-4fa0-a7f7-89de2c28e291.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32adadbf-4492-4fa0-a7f7-89de2c28e291.tmp
Size 10KB
SHA256 09d918edd68d071a643330fd413528fb7cb80658d9105aea24e3d4578601e21c
MD5 9231e0a461c6f714b3f302de726501a2
SHA1 b9753cd0f9e245327c90ece080dbf08d827e4d69
SHA512 dc12f6af2581ba2893776f82395ed89e8e96bdfb7ba57cf095dea41f781169aad6af63ccfca9ffc13f8fecaf8f77121877f4d40595da71dbf9a2468433bcf7cc
SSDEEP 192:sxZTRqWh/fGsQ4VY9kIdp+SHW6+WNa6o/YaXdzmRIg5DJ:sxZTLh/fGsdW95HbQ/Ef
TLSH
T19F22B7126E78A97B8CD7D20DBB19BF53D6F9503191D41E48AAFC861C04F6ADE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38db6917-f34a-4968-a1fd-41fc835877e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38db6917-f34a-4968-a1fd-41fc835877e2.tmp
Size 9KB
SHA256 dd56e7dac981cce2d6e98a55a92983ae4e6f26dc88e16e65fc3dc64e1cb354d4
MD5 60dd70182503e08234e3051c97f3fc68
SHA1 8b44f78c4ea8c4eeb9a10c756daf6e91438298e8
SHA512 6c8a0dec64cb5d1e4bdc7b9acdef4a0d4a3a977e8590b95eb81fc8a93897f7124cedeb0252a489618afdf1b3d2bc8824cebdbd59069d5c05cdbce0b8c009eda5
SSDEEP 192:sxZTRqWh/fGsD4VY9kIdp+SHW6+WNa6o/YaXdzmRIgrJ:sxZTLh/fGsaW95HbQ/E9
TLSH
T11222C9116E28A97B8CD7D20DBB19BF53D6F9503191D41E58EAFC861C04F6ADE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

699e318c-5805-4226-9f26-3184db0a6de2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\699e318c-5805-4226-9f26-3184db0a6de2.tmp
Size 27KB
SHA256 463f335a3d76a102a4f6b6baf6324714d866aa82ba967da0bb80431e0ffc71e5
MD5 4cba63b3615583bda3e99776c7d9d6cf
SHA1 49614b5c39efad025d10f87cc7c00c8b1fb2ddbb
SHA512 f5ae7d5517bee8b2efeba29e0e4bdfb31d9d07377e4fa1ad4cf831db27ac9914361c3c775bee1ae38b90cc50fe5d0c774b1f8010443f1a96a4b92b1c5160a8b4
SSDEEP 768:QhyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3Tro8Zhs:QhyQRbrWvvlpZu1jaXKLf33g8Zhs
TLSH
T1C6C2FA2F640CCB7E4FD01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93dca21c-00cd-47f2-9881-8348581bab9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93dca21c-00cd-47f2-9881-8348581bab9c.tmp
Size 10KB
SHA256 2d868b37f34f406ea68c4ce5a1fbf5019fb9422d5563e035ce64a6c2db44f928
MD5 79d35fb8b615ab31f19058f4ae170ec6
SHA1 5c9f49c2d550009a8030b39a28cd0c2777ea9dbe
SHA512 cd018c848f7e06ce731d04c7df6b32c65647f8aab27d656cde15b4d923278c27a572616626ba90cde4a9b4ec90395634fbfbe5f4ae963ad09dba6742ddf59f07
SSDEEP 192:sxZTRqWh/fGsQLVY9kIdp+SHW6+WNa6o/YaNr/zmRIg5RJ:sxZTLh/fGsKW95HbQ/FKh
TLSH
T1C222C8116E68697B8CD7E209BA15BF13E6F9503291D41E48AAFC871C05F7BDE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4d1418048e09af13d183d5f1d06ca7ccce5547f376062f26fd5ec54633fcb751
MD5 a10e98c808afdb31cab20ec10b009de7
SHA1 a3a5999f5d0906d3084f4677bc405a43e4459ac7
SHA512 fa681474c728b2f3c8b9788f5cb87c37e812c4b4cbb54955bc5e8aeb36af26ce74d74f249b3a457a2250ddd4a2699e1eb40b5620989ba362af84ccb4c0164668
TLSH
T12BE026C518CAD23FA30CB48B19A85F0C82A03A1B9BC06D8E2B08CC847485450EBDB6A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 151affe4f7499d926eaefadfa1ec242929c0f6ad09f825a4524644c1ab8a2ee8
MD5 c16a6eb42645b07b8335dccafe4f2e34
SHA1 d79ccd910b5620d2a017c2ac21875bf1835f7acb
SHA512 9826179a2d45a92739b8b992a23df15efca0ada8b4448d37a4638328d42fcca6ce0b8e503eebc9bf80458042e8eb29b131dde85167e5e466e0f94db1251b019f
TLSH
T14261728CDE818577F794C4B187D131B77AFB44B958833D31A3ACE5E98B56B423310044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68f38cef7d2614c781bfb0b9c7d753be74c9d97637903b3537d86f37c2a3db8e
MD5 870ee1da51204758b3f6ded37e2af097
SHA1 d820702e77cbd817148717a6234cc5e0d4a333fb
SHA512 df11c8e10d38db4a62eb79640756659e2d535852743b9dbb2b0a8cd1ff552c8f1a08d58c1a8ad841fe69be9c99e575e03bd3cc7f20f1897ff6819fe58933e279
TLSH
T12F61728CDE818577F794C4B187D131B77AFB44B958833D32A3ACE4E98B467423360044
MD5 SHA1 SHA512 TLSH

Submit Download

e62447e3-f505-49da-9eef-22b328793d42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e62447e3-f505-49da-9eef-22b328793d42.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

51a58679-dbd2-48c6-870d-10dadf846bb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\51a58679-dbd2-48c6-870d-10dadf846bb8.tmp
Size 1KB
SHA256 d39186342f50021d724e6c745a0cfa0a13ef41b02673847c1f2da641196f0175
MD5 06235eb57c2d9f9d3595cb4ddd458271
SHA1 baac7240fb880acff51ded6f990f17bf1924542c
SHA512 29a482a868f6330123fb1802f736dbcc533b9f848dcfc06e6435298577d7b131ed17c4c2ddb714b7f0c79bc19539f6112b991e06af0b4c441e45c700c1f7ea65
TLSH
T1F211AAB383E5896ECE1116F05A28AE2BCE1C0516432C3D258AD4EF2B93E3479E00155F
MD5 SHA1 SHA512 TLSH

Submit Download

896c88fd-32b5-4be3-9b6d-a952861bd9a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\896c88fd-32b5-4be3-9b6d-a952861bd9a3.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5dec43259d59658b380f564ecdd5c7a343fecc0f552d18cb588330d07854144d
MD5 ce3f72002d7c9a7e94c567c883bf3534
SHA1 c64010b3b72c104134f255bf3ded6dad8de64536
SHA512 ad58cac27737d5940186d4e0fd8111ebc4b468426349bedaa9a31f73e386b3852d60a894c3530a1e6dba3aff5b9c353a3e08efff4a6bb032d15091b19685d8a5
SSDEEP 96:Ko5aKiwyMnur351JgV9Iz//gK31/RgbP/4x7wgKtGSh:YRMnur351Js9Ir/z1/REP/4xMrh
TLSH
T18C913D01347B0202797F388C44B4966A024271B37069B56FBFBC84A79A6FE191CFF9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0f69c1e-f424-4128-9140-5de04f96febb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0f69c1e-f424-4128-9140-5de04f96febb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f00e1401-b678-4c55-9ec9-87373f5d6c1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f00e1401-b678-4c55-9ec9-87373f5d6c1b.tmp
Size 10KB
SHA256 7aaaa08695de21c39678064dff5761a88477f083d030756e980e06fed7b62625
MD5 8f8eb57458c25ff58c0b3f7dd3ed9612
SHA1 c83488661af0221fd90728b542e4e17f04b2a194
SHA512 d9beeeb3bbbed9c4c3c5d586fbbb4a29336a5b2f1f415542ed1c5bdbc74567bb8e584a4ab8edfc17d27286aded4f82cc7d4b0b324ba5025050f3fd8462692563
SSDEEP 192:sxZTRqWh/fGsQLVY9kIdpASHW6+WNa6o/YaMrEzmRIg5RJ:sxZTLh/fGsKW97HbQ/UPh
TLSH
T18922B8126D68697B8CD7E209FA15BF13E6F5503251901E48AAFC861C05F6ADE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e1777b6-b188-475c-b9fd-cd36f8d795a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3e1777b6-b188-475c-b9fd-cd36f8d795a4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b51ae9e4-26a4-419a-b932-b5a32059f808.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b51ae9e4-26a4-419a-b932-b5a32059f808.tmp
Size 18KB
SHA256 9ed54f0f8aba3f820679236452d6de80651012cfb3a5c09e7e3bba9b87a7164a
MD5 0d2ae33d7bb5b37252c316cd2b954da0
SHA1 545d94b1d1fade8c5e94f427aba64f22ea3e6087
SHA512 5a3c5bc406286908ada1707c96589ae472b8ef553c2ad434266d4f183ef092086750b3e4312678eb13e3f632e6540b3c2c948c731316aa03d7a420267dd59408
SSDEEP 384:YQkUSv0sN60GtH65eip5u8i2ppYoE1H7vBEPrIIlo:Q0TvAk2bM1H75EPrLe
TLSH
T180827C3568646D3B5DB3A520F64A37139EB4802BDBC81F84D8DDAB2C02DA2D82707E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9078e55-a635-40f9-a55d-0fd1261719f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9078e55-a635-40f9-a55d-0fd1261719f0.tmp
Size 18KB
SHA256 ffb1f32bfce653ac2a27e3f7ef3fd3ebaebf79ad962904a565f0bf3c9f02b53d
MD5 1af415f7b367cd5df9b2de59821d7e92
SHA1 01100f689a1936690539f9099a7c5b5387aa68c1
SHA512 933c0831651403ad695d04de393c9573a2d9ff273c852649604f4e33bdf2b735da519b2716ae3d5ec0802d0709fbe4617264f599939c3eb7ac91b2f312697df5
SSDEEP 384:uQkUSv0sN6FGtH65eip5u8i2ppYoE1H7vBEPrIIlo:e0CvAk2bM1H75EPrLe
TLSH
T17D827B7568646D3B5DF3A520F64A37139EB4802BDBC85F84D8DDAB2C02DA2D82707E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c90221f0-d3cb-4fc9-8892-f7182f7f9c29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c90221f0-d3cb-4fc9-8892-f7182f7f9c29.tmp
Size 8KB
SHA256 a2119d25cf5cf64b4c3acc25a1fa03a3aabbca53d247e79e444c7cab16d339ee
MD5 4990c8bb9d5211d81639ddcf3320f614
SHA1 51f8d11e6215448cfdaeb005b5a33f80663f2ac5
SHA512 96e36c58490f29b4d1596905d883cee60ad12e885f4421868a3bc3c6d18bce9da015fda8e1d69c984ea2e68a0879ca55b343e0d2107986965390dedcc68c9c2c
SSDEEP 192:SONtB6iDCQmiUyCYHq5u88P/uhgVSqPoiU6:SONtB6/EHq5u8i2AHU6
TLSH
T10202F8356C687C7BADE3AD15B5877B279FA4013FE6941F84CAE81A2C01E768C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbbc97be-ead1-402a-8343-b9a066a6c6b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbbc97be-ead1-402a-8343-b9a066a6c6b8.tmp
Size 8KB
SHA256 5e2cc0d40c0752fe61c446407d5d4f2c43804a7704931fc3eed0f7529ce3a2b7
MD5 ca99c381c197b57e7ca8100887254ad9
SHA1 b63f5b89551b09ed4832ce9db215ca8f252fb4d4
SHA512 42bfa00bbdcbb97c1cff150b1c87313bf6d6af80f375efb0c0171bbf1ac19dd6f312733d9586375d88d50d6e12d7d288b906674d0b4d0ffbf13c8de6b72fa650
SSDEEP 192:hJON+i6iD5QmiUyGY+q5u88P/uhgKpPwoj3uZHq2U6:zONT6+2+q5u8i2ppYom1U6
TLSH
T1C6121A357868AC3BADE3A860F48736179EA4412BDB886F84D5EC2B1C06EF5985307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fd4cfdf-acf6-493b-af56-ac18358d3666.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1fd4cfdf-acf6-493b-af56-ac18358d3666.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f3d47e69-6407-4e47-8178-9622198c3fd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3d47e69-6407-4e47-8178-9622198c3fd3.tmp
Size 26KB
SHA256 59ed6098a0917a90f91ec141db2d0ade376bef7aacef2884cb34dfadc2f06532
MD5 471a514b4398effe5379c6ba5a62b8bb
SHA1 f5d390eb3125ba9e39840b620c8e4f5be6aaf8e8
SHA512 09f885c082daf52ef41320b2dd2f443ed5bcbc5bb43a180ad9dc225954ca6664b13e065e5c9aec5f57e4bc90119408c86e5f1de317407f502748be3607266135
SSDEEP 384:biFzQkUSvQzsNC8TUNTUlIlFGtH65Iip5u8i2ppYo71H7vBEPrIIlo:2FdM7wgOJAk2bz1H75EPrLe
TLSH
T180C217F258D7993AD9AE8B13E73D3E038E7CC067B5845A80B788561CCD961BFD306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b42969d227bf1829cf9d01b0122abfa6ad4f080e1d38a52b6ea95131ac3ec34a
MD5 cf7471f5ddb003bbc63947e66e64a171
SHA1 db5f2f8578e007cc64afc36cef830f412c1ac30d
SHA512 62f6464d59319b9bfe3cf6961a185526d14023d389bdd3370b6ec8f139be780013bb10afef2db0eba0e635ad48792775e70af991ea26eb6c92a2c4461f0b18bf
TLSH
T15F41285CA6E91148B3B7BF56AFF6A46D487BBD772F06D46E10010E4E0A62E40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download