9834569b2fe1a0f8a3664d7296b22a7ac4f9aca0aa1b6b4e2950fac5df05c907

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TS2306A-240GF-MSM-9_C388290/Proteus/8.9 or later/Readme.html
Size 430B
Sample261029-vccteaev5r
SHA256 9834569b2fe1a0f8a3664d7296b22a7ac4f9aca0aa1b6b4e2950fac5df05c907
MD5 fc1df5dcea1b830cdc841fffd7f9a328
SHA1 6f3247161fbf05853628eb6f3c9e19c90814c417
SHA512 2c44f0b0e1178850a82b5f1f29f88041cc61295cb4da2a81df1591e3f7dfba8abf67fe1a0cccc7ce43eb340d737b24ac6fc04e5d26ba91b42fcd52b5b7228111
TLSH
T194E0A3E935003C0940E1A2B4FCC4259357765B5C33F68512A1C900133BA31244B6F254
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{67DD07B5-2321-4F8D-85E2-9A08A9BBABB0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3296	5048	msedge.exe	86
PID 5048 wrote to memory of 2052	5048	msedge.exe	87
PID 5048 wrote to memory of 4680	5048	msedge.exe	88
PID 5048 wrote to memory of 4680	5048	msedge.exe	88
PID 5048 wrote to memory of 4680	5048	msedge.exe	88
PID 5048 wrote to memory of 4584	5048	msedge.exe	89
PID 5048 wrote to memory of 4584	5048	msedge.exe	89
PID 5048 wrote to memory of 2828	5048	msedge.exe	90
PID 5048 wrote to memory of 2828	5048	msedge.exe	90
PID 5048 wrote to memory of 2084	5048	msedge.exe	91
PID 5048 wrote to memory of 2828	5048	msedge.exe	90
PID 5048 wrote to memory of 2084	5048	msedge.exe	91
PID 5048 wrote to memory of 2084	5048	msedge.exe	91
PID 5048 wrote to memory of 3352	5048	msedge.exe	92
PID 5048 wrote to memory of 3352	5048	msedge.exe	92
PID 5048 wrote to memory of 3352	5048	msedge.exe	92
PID 5048 wrote to memory of 1708	5048	msedge.exe	93
PID 5048 wrote to memory of 1708	5048	msedge.exe	93
PID 5048 wrote to memory of 1708	5048	msedge.exe	93
PID 5048 wrote to memory of 3832	5048	msedge.exe	100
PID 5048 wrote to memory of 4496	5048	msedge.exe	101
PID 5048 wrote to memory of 3832	5048	msedge.exe	100
PID 5048 wrote to memory of 4496	5048	msedge.exe	101
PID 5048 wrote to memory of 3408	5048	msedge.exe	103
PID 5048 wrote to memory of 412	5048	msedge.exe	110
PID 5048 wrote to memory of 4984	5048	msedge.exe	111
PID 5048 wrote to memory of 4224	5048	msedge.exe	112
PID 5048 wrote to memory of 1728	5048	msedge.exe	114
PID 5048 wrote to memory of 1728	5048	msedge.exe	114
PID 5048 wrote to memory of 2496	5048	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\TS2306A-240GF-MSM-9_C388290\Proteus\8.9 or later\Readme.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffac4a8c188,0x7ffac4a8c194,0x7ffac4a8c1a0
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,5928188586476234073,4564773574089494284,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,10998998760191342394,8111710625866076227,262144 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,1772792998550996660,3083814525620827697,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4142919815678569584,12598006688811963695,2097152 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12759708501670210336,1334447498866538056,2097152 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,4664340627837160380,440091339089601600,2097152 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,221308845536115566,10431772638912638827,2097152 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8737138915646174014,1403348120091481389,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,18387354223793169091,6206399781870010159,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,7627395257815309823,10946871646359211176,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,7627395257815309823,10946871646359211176,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,11240434890976565413,13754239933127999766,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,5315229239406005913,3141843005044926123,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,15576035847991646501,18235808671294059922,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,4190712918194487232,15812051002142899528,524288 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6004,i,8522213877968692665,5715573533847042531,262144 --field-trial-handle=2564,i,6152768000880729894,9473126170236620361,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3521ff0b-4f82-4c5b-8689-7dd96b808cb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3521ff0b-4f82-4c5b-8689-7dd96b808cb8.tmp
Size 21KB
SHA256 461b295fd0c243f56e81cbc76e14c522fc953ef9ada73f2dec2f1ab8e8aff44b
MD5 f81093412ce87a676c6028842fc5c78b
SHA1 abaef393b9c621b8b781ea62e1317e1124056dea
SHA512 bb2b5cd9a886c1e1f4728a99a4d9fc0b7a8d55755faa83fa3446593b076928443ab7435279b7a6faed33143ce41f433ef25da45a77e120e007d8e20ae6b80a30
SSDEEP 384:DiFzQkUSvfzsNH8TUNTUlIlM6pug3M9iX5Fk+Em/vaTZcPsIIlv:uFdbiwgdPIaQW/vaTZcELh
TLSH
T1DAA26D3398A89C3F9EB6AA10F54E3613DEF05267C6D86A94E6DD5E2C00DB19C130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70bf4199-ec62-442d-b9fe-f9ad4852ff63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70bf4199-ec62-442d-b9fe-f9ad4852ff63.tmp
Size 8KB
SHA256 6d18650e42036b1f903679a6c1620ae3e46730cfcb4c0860d3bb98e74270f6bf
MD5 fcc855b0dea9b2c1bbed46dc653ae331
SHA1 2b4a7810080d82a4017bb3124a20dbfbb4646e61
SHA512 4a704199ee7c8b9ce17f4e092a68cb2757bb2073dc434b12cfe984adcb674aa4566354cdfcd78964f5ab1670fefaf145d4ec21c0f0adf8bafb012b879d1dea02
SSDEEP 192:GONg6AmwpBQmiUyvwcsiX5FJxY+eteemlR5rq1kU6:GONg6ipfrcsiX5Fk+EK/U6
TLSH
T194122C36A8786C3F5EE3A551B48B35139EE44227DB887F84D5FC1B2C05DB69C130A523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82eaeea7-0df7-4c09-bbf3-4eac4a3bfcd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\82eaeea7-0df7-4c09-bbf3-4eac4a3bfcd8.tmp
Size 18KB
SHA256 54d045f9e7cefc761afadfffc935c65918881d1af5e7febc658a36c4e41f59b5
MD5 740b065a0ea8f4176a163f080667b563
SHA1 6627487e53609ae6ae585ecfd7ed4a383ff98592
SHA512 d0ea9e26b883b011b2adad4e52c6ab2e450a45c5862072e1fe371ad769f97c30833dca1b869e54017560fec19e410a726590e4c6d376101f6dfb7e9b397364bd
SSDEEP 384:dQkUSv0sN9M6pug3M9iX5Fk+ED/vaTZcPsIIlv:H0qPIaQz/vaTZcELh
TLSH
T124827E35A8B95C3B4AB2A511F58F3613DEF09217D7C82F94D9ED5B2C05DB298230B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

15408e0a-8bf7-4964-995f-632d0191e9b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15408e0a-8bf7-4964-995f-632d0191e9b0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

461386d9-3199-41c3-a7dd-334cb5199ad3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\461386d9-3199-41c3-a7dd-334cb5199ad3.tmp
Size 10KB
SHA256 12b5a840fcf0af27e64fdf92144da276d4fdef5ce6c3015f7e45d338d7bcd9e7
MD5 95af02088c0d4577a6617ac7523e6382
SHA1 cfb88178017ba6bd5b88dfddda1eebd22d14722c
SHA512 551f482a05d1254e7e48cdcbba19882878c9f55298460dd44d4f1c75bebbe1d303e1756d7df64964fe28ccf6a3d991440bc2865e65790e9eaf2ab2be4764a181
SSDEEP 192:sxZoR9Wu/fzsAjeIdpdNHW6+WNGY3SHdqMKIg5+J:sxZoSu/fzsAjPnHbGOMKg
TLSH
T13E22D951AE38A97B8CCBE20DBB55BF53E6F9503251941E58A6FC8A1C08E76DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

509b1482-9f23-480c-ac49-32ebf4723e61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\509b1482-9f23-480c-ac49-32ebf4723e61.tmp
Size 9KB
SHA256 8630bf53ad40f23f34166163b901fcd3f49ba8a9c390d7c0b14971488a4f35c3
MD5 c59f5207013412e438d92bcd8061f61b
SHA1 f9cc87c9ea2b71a63e919dc4f54025b0c426ecf7
SHA512 ccd10a8f46605a0372c3d46dd3e6bc2c8d56071e9a649e5f8cc2c9da563b95d85d560d283dbb8efaa7a2e382e047eacd5dff4f9db7f0d17af94a2582aa3fdc67
SSDEEP 192:sxZoR9Wu/fzsjjeIdpdNHW6+WNGY3SHdqMKIgrJ:sxZoSu/fzsjjPnHbGOMK9
TLSH
T16022C9516E38A93B8CCBE20DBB65BF53E6F9503251941E58B6FC891C09E7ADE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90e24ea9-d987-4879-bd93-50975d011e95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90e24ea9-d987-4879-bd93-50975d011e95.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9e811779-d881-443b-8b44-b72760cb3368.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e811779-d881-443b-8b44-b72760cb3368.tmp
Size 10KB
SHA256 8b47b2a9ad07cc7883b29d1fee4cb42a1cb957c82f6a9ab2a0f9bc6b6b3159cc
MD5 814419b04b41072e73410e06fb552ccf
SHA1 77f4b1101926356a9726dc08b62594cd31918f4a
SHA512 7015501b3738d9e792352bfe1c989e4386e70eaa6d2684707bd03ea1942145cc7203b838f0cee8db8ee8c4aa4aaf43c8acc42caf171ad322be51a5e54ba247ed
SSDEEP 192:sxZoR9Wu/fzsAPeIdpHNHW6+WNGY31oDqMKIg5UJ:sxZoSu/fzsAPPtHbG0MK6
TLSH
T1CA22D951AE38A93B8CDBE20DBB55BF53E6F9503250941E48A6FC8A1C09E76DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 831bc81123e7a5f023830d81f30d6f23e4cac1fd596bd957a284160b04907f90
MD5 87fe06d0d29acf5d0a081d362f045905
SHA1 ba5d0e3868a822b0a90480371a88a5f083e33937
SHA512 ea9a661f99f420edbb7720d1a90425a14cd375516b62b892ada1afdc8e8795cadc431a8d30ab55169decfcc604988937a9c512b3dec8a12ebbd59fd3c73e998c
TLSH
T1ED611AB232AF4C52EFA4227C9CE1A0873E386DB424835D178D75F4F94BAA7075155807
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 27e91c1e495cadb27bf96ce1104130bb274970595fb50a6bd0e90b8b00871f8d
MD5 8547039decf97925b81b09aed42753d0
SHA1 36188bf08e38e1d83b2ed5b007df298b47ed5510
SHA512 5ea66b847b5bd80d53132c0367f3b80f471568d67fa4a681b07f92948e6c0e3119faaed9afae300a7aa9cf4003a847b1efcb9c5f463c5a2a61dcf16c786d737d
TLSH
T14E6119B232AF4C92EFA4227C9CE1A1873E386DB424835D178D75F4F94BAA7079155807
MD5 SHA1 SHA512 TLSH

Submit Download

4ad44e84-6125-4bb4-b91c-11de3f1ca761.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4ad44e84-6125-4bb4-b91c-11de3f1ca761.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4e0b82e8-b2c3-43b0-ab77-120092742365.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4e0b82e8-b2c3-43b0-ab77-120092742365.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

659ecad7-d556-428d-b165-7332dd6310da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\659ecad7-d556-428d-b165-7332dd6310da.tmp
Size 733B
SHA256 b14fd2093a86c49848b12d19cab723c1ac8a260a82387637ed40b5b1059ba77e
MD5 491476cb5b2be28526fcb74853cc768a
SHA1 7836b0c3c5564876654308b4410a2d6b24db2177
SHA512 7369c7014066cac46cac04d068c790572ede04180e4e225c82915731ce6553808ed80cdf8ed68429717fcdaa7a9436aa8e9bf2a2e7d5996cfd79e486eca6f572
TLSH
T14F019CF3C3E4996E8E0596F06A18AE2BCE2C0502431C7C1AC5D4AE2B93E3475D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

799dcc12-6e43-402e-ae99-0f7ca62c5b1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\799dcc12-6e43-402e-ae99-0f7ca62c5b1e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dcf23b87f4187f04aaf06d4ca88853bc3734ada36f0ad250e26c3ff26c35747c
MD5 0794c1a2c26f7626b966deef621d625d
SHA1 205438ac5c3d8ac096ba477124f3da970511ebb3
SHA512 5795ae4c6de1b7fbde4b723977d4225456367b9850922daf40a45a9554c88413cddc40dbfe11dea9f0d202a8d391170312d53aa00be6e44f4b02a5c82d213d30
SSDEEP 192:sxZoR9Wu/fzsAPeIdpdNHW6+WNGY36zdqMKIg5UJ:sxZoSu/fzsAPPnHbGuMK6
TLSH
T18722D951AE38A97B8CDBE20DBB55BF53E6F9503250941E48A6FCCA1C09E76DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 04f6125ba0accb6c0ec1510471f6111080530e89fcecf6f2702b697894d29ffc
MD5 3c2a056dbee5f8e43953e12fc0003171
SHA1 ba6228601076f752cdfb26c10e4461703356c882
SHA512 5f1794e11136c2a0f53407dfd9e0e4c5ed4880c003c49b12b35204165b16bb1c52cea0f2e3f2d4850d9b755a872f95a0b506944c7b7ced7c8f7923650b1efbaa
SSDEEP 48:K0rOPrVNNubdQ1ISLuK9b1ZuxD+YYp7vyL8rKfhBh6bZ0JISv6K9P1F6xfqYMNg8:KcYwKR6OB4gKRmqowK1CCmzq3TN11+T5
TLSH
T1A6916415707B574138BE268C4278C65A128231B7705AFA6F7BAC40678FAFE054DFE9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4adcec1-aed7-40fd-97e8-4d509d693443.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4adcec1-aed7-40fd-97e8-4d509d693443.tmp
Size 27KB
SHA256 8f4c64d0aad906f2d7e3e6ff8f3efb01b3974042a0d34faca3b8b74c8ce101f6
MD5 8e3c301a981209d2edf860262c23c98a
SHA1 f49894a77c1c4ffc3019119b0a36051c14877edc
SHA512 68358b3b7a4dac3921b048ed67e6c508f06e446d8bada0708b82f82ead9d6e08fccb57115e01b4147e94ec2efe103be55b803472677abc2ed8dcc8c46e48230b
SSDEEP 768:9r30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72GrolZMU:9r30AbSWvS2l9u1jaLmLZ129P
TLSH
T1F1C2DA3B640CCB7E4FC05E9DDC6AAF9B6E9802C796648D4047FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1929908c-80b6-4142-9876-0a77e1ed8a64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1929908c-80b6-4142-9876-0a77e1ed8a64.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce698dc2-ce3c-4fca-82a5-a8567ec4ca3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce698dc2-ce3c-4fca-82a5-a8567ec4ca3c.tmp
Size 18KB
SHA256 48b9a63a3854d5e2107e40179e4288cb082a272d3918a51356cd3d2812cb749c
MD5 30f5084a005ab969198ed6f0433d772c
SHA1 c45eb8648e956df8c9a3b19349763b2f5a667dd0
SHA512 fc0f00b11739db80915a4bc7a5552b98e509d57ff5ef5d1d1c8cfc8b7a438368e9e87aa810740982e054634c8ae68d0b4e22489f4ea967f0b09f495cfdaeb694
SSDEEP 384:CQkUSv0sN9N6pug3M9iX5Fk+ED/vaTZcPsIIlv:60HPIaQz/vaTZcELh
TLSH
T134827E35A8B95C3B4AB2A511F58F3613DEF09217D7C82F94D9ED5B2C05DB298230B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4270b49-2a49-4032-b556-de3539baacb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4270b49-2a49-4032-b556-de3539baacb7.tmp
Size 8KB
SHA256 4805aced27bb6318162a53a68f146ccfd30412908a4f22022e46d44c38a9da09
MD5 6ae74e9542760b1ec80e2c2deac6ccb2
SHA1 28283d9175d9d40b1c7f141f75696a390ba0d44e
SHA512 8f51a8803ecb38e74f248174a1c59b0401a24d659e610fbf3ea8eb9bbd9f59ab2ccccab9eac73bc145d9749f3e4d143a09d07e4bbc5a206d97be3c58e10db54e
SSDEEP 192:LON16AmwprQmiUyUw6siX5FJxY+MJi4YU6:LON16ipdU6siX5Fk+51U6
TLSH
T1B402DB35EC785C7B9AF2AE05B48B76239FE5112BE6942F84D9E81B1C01D765C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a77ef166-000f-4da1-9a0a-c8b31f2287e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a77ef166-000f-4da1-9a0a-c8b31f2287e1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 df3c45ab671983fc97368d732c3752fc5e14f4b6ee8b41b51079d60f9f1faa0b
MD5 4c630ab342efab82b73d370c4ede3a48
SHA1 ac583cb9de4ce623e6b70593ff37a2d701b98769
SHA512 246124ae54a69cea65bcff7b7987b90a74f66cf62ea4eb280fc06c4e7568275db76cf759771d3388b8d6d7971c04d07140ff0a88150d75f38d09f09b083fb169
TLSH
T1F841075CB7E91148B3B76E1AABF7A8AD487FBC372E06945D10110D4E4633A40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download