hxxps://faporim[.]de/nXVh/

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://faporim.de/nXVh/
Sample261007-3l3eesys9k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4416	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{410C7725-7884-4E44-B069-BBB88DF4B208}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
724	msedge.exe
724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3900	3208	msedge.exe	85
PID 3208 wrote to memory of 4416	3208	msedge.exe	86
PID 3208 wrote to memory of 2268	3208	msedge.exe	87
PID 3208 wrote to memory of 3896	3208	msedge.exe	88
PID 3208 wrote to memory of 2268	3208	msedge.exe	87
PID 3208 wrote to memory of 2268	3208	msedge.exe	87
PID 3208 wrote to memory of 3896	3208	msedge.exe	88
PID 3208 wrote to memory of 3248	3208	msedge.exe	90
PID 3208 wrote to memory of 3248	3208	msedge.exe	90
PID 3208 wrote to memory of 3248	3208	msedge.exe	90
PID 3208 wrote to memory of 4932	3208	msedge.exe	91
PID 3208 wrote to memory of 4932	3208	msedge.exe	91
PID 3208 wrote to memory of 4932	3208	msedge.exe	91
PID 3208 wrote to memory of 736	3208	msedge.exe	92
PID 3208 wrote to memory of 736	3208	msedge.exe	92
PID 3208 wrote to memory of 736	3208	msedge.exe	92
PID 3208 wrote to memory of 3440	3208	msedge.exe	93
PID 3208 wrote to memory of 3440	3208	msedge.exe	93
PID 3208 wrote to memory of 3440	3208	msedge.exe	93
PID 3208 wrote to memory of 4664	3208	msedge.exe	99
PID 3208 wrote to memory of 4664	3208	msedge.exe	99
PID 3208 wrote to memory of 4904	3208	msedge.exe	100
PID 3208 wrote to memory of 4904	3208	msedge.exe	100
PID 3208 wrote to memory of 4872	3208	msedge.exe	105
PID 3208 wrote to memory of 2972	3208	msedge.exe	110
PID 3208 wrote to memory of 2972	3208	msedge.exe	110
PID 3208 wrote to memory of 2972	3208	msedge.exe	110
PID 3208 wrote to memory of 3912	3208	msedge.exe	111
PID 3208 wrote to memory of 3912	3208	msedge.exe	111
PID 3208 wrote to memory of 3912	3208	msedge.exe	111
PID 3208 wrote to memory of 3884	3208	msedge.exe	116
PID 3208 wrote to memory of 3112	3208	msedge.exe	117
PID 3208 wrote to memory of 1784	3208	msedge.exe	118
PID 3208 wrote to memory of 1072	3208	msedge.exe	127
PID 3208 wrote to memory of 1072	3208	msedge.exe	127
PID 3208 wrote to memory of 5028	3208	msedge.exe	128
PID 3208 wrote to memory of 5028	3208	msedge.exe	128
PID 3208 wrote to memory of 724	3208	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://faporim.de/nXVh/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffef294c188,0x7ffef294c194,0x7ffef294c1a0
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,12150795928263670309,1783068960985295463,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6470579392285240277,5197501747983857359,262144 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,14681296784877967593,154034357215811544,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6315233438208060984,18438409794465577135,2097152 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17025219636017792979,16545619817486611202,2097152 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,11283909844979831466,685111320657551354,2097152 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,3680792680222388238,3321555399623674027,2097152 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,1767741737465744550,9995776203378520326,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,5701025263969965334,18445200920531593631,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,3240318206226458220,2695951524143605443,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,3240318206226458220,2695951524143605443,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6328,i,17620974080277261101,8412094837278928208,2097152 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6508,i,16648362425835882761,6428999023502991929,2097152 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,1459336365022853231,6772136592250024185,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,3984704456915909090,15928912913999533032,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,11571373242882995351,13384026600884164977,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,7955809342080420552,17344388260902207889,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11742983192396178521,12468275280442582160,524288 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,1009632541254928487,2160323717237281924,262144 --field-trial-handle=2508,i,13486608116910221584,9215478544594270640,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

52c7783a-fe92-4405-a372-01d7d7046221.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\52c7783a-fe92-4405-a372-01d7d7046221.tmp
Size 8KB
SHA256 33bd8d27afeeecac19c4451bb8d3ed9285f29331f2bf2f683d5e6418e1237353
MD5 bc2afedf60b683d8b3a125411b7165fc
SHA1 e271885c1f0c8a5eb03879d0316e01b8ad880dcd
SHA512 71144b4c39ac5644633b364c4f06b24f1dbb0776bb35c46e1aaa3d7467d021595316b264a71d72e7d519c96aca3d135157ee673bdfc3147ad4a256c0673b5721
SSDEEP 192:1ONO6wlDgQmiUy/4W4X58gZejzorxJlDl1oFU6:1ONO6kgLW4X58EC8xJL1cU6
TLSH
T1BB02F934F9787C6B8EF3AE09B58727139FE5112BE6952F44DAE80A1D00DB65C130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d400f82-e3f7-4d11-b8e7-48fec3335589.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d400f82-e3f7-4d11-b8e7-48fec3335589.tmp
Size 26KB
SHA256 5dab32e5c0a820927e22ddcc3841c05ca5b6812ead7ac9a3147c8a55580d7b60
MD5 9b0afb9a7193b95ac942efa7ea448fa2
SHA1 fc905b9357719200a592388fb06d977831f66392
SHA512 79e9e07fb0b1625352feddd965bb60197fcf642598f055b742e45d55a3318182b4c3feb407f75e80d848ed5964eae029c912370dd88e779c39e4118ea7dd8796
SSDEEP 384:piFiZcIpzsN58TUNTUlIlC9nH4Z0Zcn+tpHX58EC8xJgXw+2K1O5o7:AFQJUwgEYr+t9aHwlK1O5I
TLSH
T1E6C219F258D7893AD9AE9747B37D2D028EBDC057F585AA50B798460CCC9A1BFC30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

1f1e367a-4038-4970-bfe2-3e1abb009ce4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f1e367a-4038-4970-bfe2-3e1abb009ce4.tmp
Size 10KB
SHA256 f9c38dc669a33d0ee1d4bc71d325a26321ebc2851187a92a1c587cc35e97c8b4
MD5 046db316e7ab93b5aabbbf928bbc384d
SHA1 734db23ae42dde94316f60b1416cd8f43e81296d
SHA512 dfc7714643f03a1c1318c6ec939969bbcf9f04651b5c76d4c84d9574193251f97173b5d8933be1244ea7f08b76cd042d37c1d751c8b6b3f776ba41d04807fd1e
SSDEEP 192:sxZX6RzWW/fNRsLtmIdp2R359HW6+WNBl3l7OV/YryukIg58J:sxZKUW/f7sLtHKfHbBBC/du
TLSH
T1BF3297526A346D7B8CCAD209BB15BB53E6FD507295D41E48BAFC8A1C04E7BDD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25d6bf0e-c94c-48ca-a828-0c0a0c9f70f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25d6bf0e-c94c-48ca-a828-0c0a0c9f70f4.tmp
Size 10KB
SHA256 d58884bbde05e10e94098b8e5780e849305c6a411f0ba0d3a2da1ea316b61f5d
MD5 462a51b5faa006fb7961e75f2a9ef9cf
SHA1 2adcc8f21a28acb0e18715a3e0bcb99232c0df64
SHA512 49f08b64de1cdce2c5b2223502445fe801304a07e46db40ee7f96b381cffe2b69d75a9febb4ec2a9b9e2f5ce2c81c342238a0121ca64fd1e3a8e25ac409dd7e8
SSDEEP 192:sxZX6RzWW/fNRsgmIdp2R359HW6+WNBl3l7OV/YrXukIgrJ:sxZKUW/f7sgHKfHbBBC/i9
TLSH
T11B22A8526A34A97B8CCBD21DBB25BB13D6FD503295D41E58BAFC861C04E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79693a0f-dd0c-4d8a-8a9b-0cf6c9a1ee39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79693a0f-dd0c-4d8a-8a9b-0cf6c9a1ee39.tmp
Size 10KB
SHA256 dbdf8f8bbe5118cdf76b5b479e54ad4e7571227f2098f3711a1c4a0aed6eeb50
MD5 952879966a9d67e0c38cffd90ea5ae52
SHA1 9ffc51173a7a639a403c6d3b9e38706b66bcf93a
SHA512 dfde9d4278dc7e9dc470545b1ab3f40b1434a2a304b3ff4fe81e3bea3b8cd2c60e5290fc0094977c5426060c3294ca300e7cc40a7e2af3a2d2ce90e405a64959
SSDEEP 192:sxZX6RzWW/fNRsLtmIdpoR359HW6+WNBl3l7OV/YrfukIg58J:sxZKUW/f7sLtHgfHbBBC/ku
TLSH
T1AB32A75269346E7B8CCAD219BB15BF13E6FD507295D01E48BAFC8A1C04E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85754216-b023-45ad-8d0b-a457157caa20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85754216-b023-45ad-8d0b-a457157caa20.tmp
Size 10KB
SHA256 d31dd3597e3b9c26e67a6f9798ebd160b653d784e8aa33294588158cd26f0c57
MD5 9de0432c11c822570db80d6dc4737ac0
SHA1 67c43dab33e36761d6fc4f094b1b3e27f377730b
SHA512 610ff93fc61d20f8282394f0a472ee5b8e12b5e37c21279851f9ec3328affa63c711b2f11fb065a5558312d67fde625afb9efa2197f352ff3467cce222cd80b2
SSDEEP 192:sxZX6RzWW/fNRsCmIdp2R359HW6+WNBl3l7OV/YrXukIg5WJ:sxZKUW/f7sCHKfHbBBC/iE
TLSH
T12322B8526A34AD7B8CCBD219BB15BB53D6FD503295D41E48BAFC8A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eeec268-0398-4c60-94ba-ec376b22060b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9eeec268-0398-4c60-94ba-ec376b22060b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 68be5f5adb62763837632f0bf0f183a950cafeee0f90bd9ef0201f5ec4da3362
MD5 82995c13cde63c4fa604fb4c5b435334
SHA1 a0f1ec410902f2a8a9766d9007563d610df991cf
SHA512 b4be4bf1129ee4349a6762b4f94e9b8455d12645c0ef0f8c226f8a33cef9da025feccfc07a1790315714ffc5b0b10063281315dad9ea1f931c6ac84f760f63cb
TLSH
T17EE020DC14DCC22D6224648F0174B30DC390371AEBC0A94D1714C94874854446EC3DF0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ce8a2d5bd5a0bcc6a1c69de6cb5ebf6ce2f3c37308c60e35ed84e0b890e03452
MD5 f5290dcf982b683ef514bcef1a5fc65c
SHA1 798f8db3bf5c446498c77e09d6086507adbe064c
SHA512 932297902d2c0dec819011c457578917082342270c5bc4fb0c4c029c5243120970076ffa43786e3ae2319859fa81bb725a781c503db75ad1b4a8dc2b85f0fbc0
TLSH
T1AB612D86E48E4463DBB4A1FD8DE12CCB3938C6F052AB1D5A0798D8795F27F9272B001C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0760a7e0e4588355a9553230ff6ff657a226d836eee868a98b5564b7f488101a
MD5 264648adaa14409f1ce0a74aadb68ab7
SHA1 35582f26e83603eb45cc74500eee3cf6e940c68a
SHA512 28956b3f042c490e46f06f4ba39c8c10094478c251c65a5c3034e306cce2e64aa433022b135537b3fd5368b16b0b4ee49b5f0c27eccd8802d9e1731899057c22
TLSH
T138612E86E48E4463DBB891FD9DE12CCB3938C6F046AB1D5A0798D8795F27F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

a3305c00-5d49-48ef-be2c-5220b95ae334.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a3305c00-5d49-48ef-be2c-5220b95ae334.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

a6eaa2c2-e4dd-4262-b06b-8d15279de274.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6eaa2c2-e4dd-4262-b06b-8d15279de274.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ac5bbc1b-00b9-447e-be18-38bd6d2f5116.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac5bbc1b-00b9-447e-be18-38bd6d2f5116.tmp
Size 1KB
SHA256 18726dc309b01421f5c5342e5c83acb28b12414dc7bdd6a42fd2554ead437dd2
MD5 f70df84365fa29a3e1d35ff715dcb50d
SHA1 5eca207827511f60db74c491b9bf4b8601acb911
SHA512 db2d1fff2565070c45de605631d9a3ca145c54278c6915bdbfc251b3d6868eb1d50c9e3a4f4bbbd98d2a828ebf122dfca83826ad175a22aad6dd198c44e2566a
TLSH
T16D317AB3C3E4866E890156F09A28AE2BDF1D0559431C3C2AC9D4AF5B97E3871E101A8F
MD5 SHA1 SHA512 TLSH

Submit Download

b6bf31dc-242e-4ba8-9418-d47b242a85f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b6bf31dc-242e-4ba8-9418-d47b242a85f1.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b0e5ae2bc73fde55cbf9e23db01d91eae6872bb3dae924097c59df21c1a08437
MD5 8ba79e440b567fe8514e40b470ac028c
SHA1 ae121fe78877a2405f1d92b4618b45877554e85d
SHA512 b8e0d28db57dcc917fcf8e5a4294caaa5d911f6c0bee27bc8ccdd44ec2f6e4e60caf34563f8a52a1efd4dc03038bec7131829552a5bf6ea06ecd16db0d3ccc29
SSDEEP 48:KIDI1Ks04jyL10JF3jXYbLuLISDeIPKLioLyZKI/KnKl:KIDCKs0+iSdeEKLi+aK0KnKl
TLSH
T1D9915F4971BB4210387E2A5941B9CA1A125336B33018E56F7FBC95A25F6BF484DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8c8fbea-a37b-486b-83c7-d4131f0ecec8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8c8fbea-a37b-486b-83c7-d4131f0ecec8.tmp
Size 27KB
SHA256 684d63d21ab7d134fbd718091b48af9e09a331a289df74d57824d044f14702eb
MD5 46b9708661beb199f984571d0c4accc4
SHA1 7437f92267e1f31ae76bb9f164a179e6d7bb6e19
SHA512 d8031bb4b570b38da90b96f44349624b40d0b53c8b603133b3cc6622c1dcd4ed0a16b00d9bcb7ff721980566512a8af5372dfcfd29a7a3a923f71b4947723047
SSDEEP 768:pWy4J/DWvbtJh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbiroR70:pWy4J/DWvbtJhu1jajiLm0b5R0
TLSH
T148C2FB3B644CCA7E4FC00A9DED5E6FDB3E9802C796948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d3fa0af7-fd4e-493c-9438-c289df5cd81f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d3fa0af7-fd4e-493c-9438-c289df5cd81f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b217528a-2327-4f22-9550-ad360b201830.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b217528a-2327-4f22-9550-ad360b201830.tmp
Size 8KB
SHA256 631637501a8a17eeae5015a7f737450955f4de7d9f4bb22325c9676b2d8383fa
MD5 b40854536dc8962033869c6d3c608aa0
SHA1 60bf489003318b19c2426af8a13e265817acc8b9
SHA512 df7da09a2211cebcb8161384d9bd1151b433e6ba23c991dcf98252c19a6ae6955df3594d5dd1fa024a4af8f1c413c0208419a13f5c607242e529d08b7705eda6
SSDEEP 192:1ONy6wlDiQmiUyqh4L4X58gZejzorxJgXA7R+2mve1Bq3U6:1ONy6keBKL4X58EC8xJgXw+2p1OU6
TLSH
T164120835F478AC2B5DE2A549B08B31039FE9522BEB896F90D6EC1B1C01DF66C534ED12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b73d0186-c300-4f9f-856e-2e9e3362b98f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b73d0186-c300-4f9f-856e-2e9e3362b98f.tmp
Size 18KB
SHA256 bbb6f3e958fc5c2ae427241ed2b2b6450ed0b5dacf70689b8fc0b4ac297b2a4d
MD5 512f1b1f0dbdee5ff23e609ddb58eb6a
SHA1 81c8b6d2b00bf74a1b24065a0e24c4fcd586f6e5
SHA512 011adbfd0bddcf6330c9b5b1b739a71b2d06d878182acd970a3bf3d2a04daec99567e94cc0fe7b21eecd71d464dbb1e5b8d810c6a2bae26c294f213cbfc95df3
SSDEEP 384:5ZcIhsNnC9nH4Z0ZcVpHX58EC8xJgXw+2Q1O5o7:RhbYR9aHwlQ1O5I
TLSH
T196828C71A878AD6748FBE249F14A35039FF89027E7CDAF54D5EC5B1D00DE2A8130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd1935eb-30e7-4f9d-b432-de201335e87e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd1935eb-30e7-4f9d-b432-de201335e87e.tmp
Size 18KB
SHA256 35cecb0df71cfb9811e155f722e8716a1f2c20b75d6f60a9be7e5c72e18b0375
MD5 85bfa69c7f0b9b58307c97014ccd9a80
SHA1 d4545d2229bcebe61a121eec456bfc76b489ed77
SHA512 ac8f6e32ee8e7a3791b25cff7c8e2c6242d5f7d2a599b767fa44d4bcf3d759e5a6915f42afb04758538cd0e86758f3e08fa0b64b650ad31a6005252206c6c0a5
SSDEEP 384:gZcIhsNnF9nH4Z0ZcVpHX58EC8xJgXw+2Q1O5o7:ehYYR9aHwlQ1O5I
TLSH
T11A828C31A978AD6B59FBE249F04A35039FB89027E7CDAF54C5EC1B1D00DE2A8130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c5b4ce4-9477-49b2-ba0f-22135de31b9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9c5b4ce4-9477-49b2-ba0f-22135de31b9c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c38384d3abdb837484e1391dfdd605535071789411ae7c69593313f4b6c5c038
MD5 544cfd131b4832fc29cbaf5a211b6146
SHA1 194b54156bc5759e1ccb3d7dd26cc8bb437ec33f
SHA512 36025265de1dec0c305d9bc34f33a566841c803ac15e9025d12c28afad3790476ec25d3a24fe5787001db69a6562a1ab89461ba120ce8e60c20936e4261e6da9
TLSH
T16241F858A6FD1048B3B66E5A9BF6A86E48BFB9372E07D05D00110E4E0B62A40DC61B37
MD5 SHA1 SHA512 TLSH

Submit Download