bbea28ff574ef6166428f6dbe09f8d9bfc9cb121859b5d7a145882790d3612d3

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3proxy/doc/html/faqr.html
Size 48B
Sample261107-nktcssbs9t
SHA256 bbea28ff574ef6166428f6dbe09f8d9bfc9cb121859b5d7a145882790d3612d3
MD5 623dee957e5ce68c21096b5f8c8ddec7
SHA1 4d32e0447804f979a9669862b77197da03c42833
SHA512 33503f090c9cc36a3bf929ff21546f766b4595550339257280ab7a536d86001d4e7501a8792f834992e72235736ba5f0ab9bd4d7135f672bb14ffb9bcd6a65a1
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4788	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{55C08002-F13A-4A8B-A442-83419664E351}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1472	3960	msedge.exe	85
PID 3960 wrote to memory of 4788	3960	msedge.exe	86
PID 3960 wrote to memory of 2756	3960	msedge.exe	87
PID 3960 wrote to memory of 2756	3960	msedge.exe	87
PID 3960 wrote to memory of 2756	3960	msedge.exe	87
PID 3960 wrote to memory of 4916	3960	msedge.exe	88
PID 3960 wrote to memory of 4916	3960	msedge.exe	88
PID 3960 wrote to memory of 1508	3960	msedge.exe	90
PID 3960 wrote to memory of 1508	3960	msedge.exe	90
PID 3960 wrote to memory of 1920	3960	msedge.exe	91
PID 3960 wrote to memory of 1508	3960	msedge.exe	90
PID 3960 wrote to memory of 1920	3960	msedge.exe	91
PID 3960 wrote to memory of 1920	3960	msedge.exe	91
PID 3960 wrote to memory of 228	3960	msedge.exe	92
PID 3960 wrote to memory of 228	3960	msedge.exe	92
PID 3960 wrote to memory of 228	3960	msedge.exe	92
PID 3960 wrote to memory of 260	3960	msedge.exe	93
PID 3960 wrote to memory of 260	3960	msedge.exe	93
PID 3960 wrote to memory of 260	3960	msedge.exe	93
PID 3960 wrote to memory of 4416	3960	msedge.exe	97
PID 3960 wrote to memory of 2668	3960	msedge.exe	98
PID 3960 wrote to memory of 4416	3960	msedge.exe	97
PID 3960 wrote to memory of 2668	3960	msedge.exe	98
PID 3960 wrote to memory of 4020	3960	msedge.exe	100
PID 3960 wrote to memory of 3572	3960	msedge.exe	109
PID 3960 wrote to memory of 4596	3960	msedge.exe	110
PID 3960 wrote to memory of 5004	3960	msedge.exe	111
PID 3960 wrote to memory of 2076	3960	msedge.exe	113
PID 3960 wrote to memory of 2076	3960	msedge.exe	113
PID 3960 wrote to memory of 4548	3960	msedge.exe	114
PID 3960 wrote to memory of 4548	3960	msedge.exe	114
PID 3960 wrote to memory of 3864	3960	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\3proxy\doc\html\faqr.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffadf9ec188,0x7ffadf9ec194,0x7ffadf9ec1a0
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9495647483683738499,18322403773878536746,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10193069758766246205,14837538835856697096,262144 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,13755487941546980644,16171003879512956591,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13335735655140373147,12269955964262240057,2097152 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,11326050262147484869,7395075918443437592,2097152 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,7587448675687754191,10679050676302328754,2097152 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,3792548496600880929,13308395131848837710,2097152 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,18035292022693245131,413291105832480468,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,5598570067449190646,8237958939139275894,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6337184841054839853,15351442589703900470,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6337184841054839853,15351442589703900470,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,18394921273468322768,17241546035943841630,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,7947504295771524141,4916811968390997741,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,10628956356262853349,7682403320406540531,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,20986149469199070,14956305728901177746,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,12745252933565341014,10766051614607935583,524288 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=776,i,9445868028604263045,8037877881983733429,262144 --field-trial-handle=2116,i,16066932137876216531,33166447215749598,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c7aa70e-ab1d-4114-b97a-a75746d62247.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c7aa70e-ab1d-4114-b97a-a75746d62247.tmp
Size 8KB
SHA256 889d957bda3053a1f2c11647b69b9a38d3ece36439c37a084d8d1e092816e04e
MD5 6725456e35a52f1282e042a9deea9739
SHA1 15c565f80086088a16f99e8bc82c32f5f8f55a1b
SHA512 3d0d05437fd65955aa73a16a76831a768d44989053523b0f1a56a88f2ab32f036f422c8b459ba70c543e7caad061a8bb43498d8e4fe52a33439e8ab40ab82189
SSDEEP 192:1ONg6wlDgQmiUyP9PW4X58gZdjzorkJIDlaIeU6:1ONg6kgi9W4X58Ex8kJsIU6
TLSH
T11402E835E9787C6B8EF2AE09F48627139FE5112BE6552F44D6E80A1D00D765C1306D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

367bc347-9214-4d98-8e7a-4e81a1d6f29f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\367bc347-9214-4d98-8e7a-4e81a1d6f29f.tmp
Size 21KB
SHA256 6232aa1b512d32f2614bd23062c6b1b08ddaec4b6cce7cf9e758c5da9665f6cc
MD5 c2dd06b5796d719294869e5e5ef82898
SHA1 7a11edfac90be76b173ab6bccaeb72cd458f31f5
SHA512 37a9081a821b02eedce8ac29ed975eb56021e2c13117fe53bca257f7e2eadd06cf683d5c0896c1d90ef0e52ec067afc3c054f7baca9bfef0fc6de2de489870da
SSDEEP 384:QiFzQkUSvpzsNB8TUNTUlIlRbtZtdEbHX58Ex8kJsXb+2T0H7vBEnj4IIl9:rFdJowg9xEjaBblT0H75E8L3
TLSH
T1E3A26C3698689D3BAEF39B05F14A3213DEF59067C699AB90E7DC5A1C00CB1DD234BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59e21a17-70f8-44d8-948a-05ce47109c9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\59e21a17-70f8-44d8-948a-05ce47109c9c.tmp
Size 8KB
SHA256 84a9d87b5acad8eb22c6a289db2f6438c608137432aff6e34c7de1aa1d37cf56
MD5 c8b2ebdb24d48b360cb5c4c9bd084ee4
SHA1 9d9d96418c1e7229ddcccd84307d03378e19889e
SHA512 697654a0a1204949a7a7ab17bf14d7e65e85de667a1eae33ac3188a4196dcb8ddd89bbe1e5c19ce76b179464fabc13acaa0ec28fed63e686fe7c4777cc21a608
SSDEEP 192:aONC6wlDIQmiUyPLP54X58gZdjzorkJsXh7R+2yvezqPU6:aONC6koib54X58Ex8kJsXb+2V0U6
TLSH
T1BE121735A478AC2B9DE2A545B08731139FE59127E7896F90D6EC1F2C01DF2AC534EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6578e5dc-c9b3-44bb-9215-12e0e0ef4b32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6578e5dc-c9b3-44bb-9215-12e0e0ef4b32.tmp
Size 18KB
SHA256 8811779bb6ec9215a608ef3277362010d423e5af3ea4be111ffd04ed4fd6d866
MD5 7886e463ab6a95c543d55d6234f632d3
SHA1 443798be0a19e8a3645237a78d4e9ef45c47e7a3
SHA512 cdbba34ec637eb3eac0c446ba2b8493870bbb6f4ee289f7a45c2ca8d9bfc10fdf81866cb04b702be7135dedb13b5b0898ff67b2ec55bf0bd9449addcb7a6e6f2
SSDEEP 384:mQkUSv0sNfRbtZtdEbHX58Ex8kJsXb+2o0H7vBEnj4IIl9:G0mxEjaBblo0H75E8L3
TLSH
T14A826A35A428AD2B5DE2A205F14A3613EEF5901BD6C92B94D6EC5B2C00CA29E235FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8457af29-d55f-4d9f-bb0a-15e5e951404b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8457af29-d55f-4d9f-bb0a-15e5e951404b.tmp
Size 105KB
SHA256 66577e04ed9dc05f1bbd9e68e75cc41aec19afaf3ebea8acfe870bd36e3106d3
MD5 699f81963d83c997a12c0b5e6e155744
SHA1 ed659493a68518d7e51698aeadd058871ef5c5ff
SHA512 148a0f453c0b38c87181cce242127e41d1630844a2e2284d6fdb19794dea9e0c89770f50637e85031a59ed404d4e485747c49e1408f3b73e5fbe6ecc5999dd0d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1B6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

311e4e98-4004-42d7-8685-b3462c915202.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\311e4e98-4004-42d7-8685-b3462c915202.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

38b8fc14-563f-4c3e-958e-c37518562456.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38b8fc14-563f-4c3e-958e-c37518562456.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3eb6f0dc-4461-44a3-86ac-6e29387149e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3eb6f0dc-4461-44a3-86ac-6e29387149e3.tmp
Size 10KB
SHA256 feaf419e0e626cddb53d33114cadb051cf3498869664e953510c07953d5d2657
MD5 4859e2fb8f82f80df19ea97c311f5a90
SHA1 6e10be63c58c64c4f68e97a383f61177e4883e85
SHA512 7f6854e3159158976ea88827f564484351d3907a65eee592173b1373f95f608af268b5c2ed9587db146a4f22c8110a01a567641268fb36ade03c1be33f3364d6
SSDEEP 192:sxZpR4W//fjsm0Idpd96HW6+WNGYrXFezsIg5vJ:sxZpR//fjsmtOHbGRwn
TLSH
T1B022B8566E28A97B8CC7E30DBB157F13E6F9503291951E44EAFC861C09E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4df5fd9e-db7b-4b3c-a6e3-331ea390c175.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4df5fd9e-db7b-4b3c-a6e3-331ea390c175.tmp
Size 27KB
SHA256 92d602f4ad374ba2874b5d2d33a92f2b5b48d483cd68f760d2c26a9d35ac87b0
MD5 002498f5963f6eaaa632c8d0304321ba
SHA1 724cf097d11c59c0dc755300fdc63b37e5d704bb
SHA512 588c71603fb0c532288f589da4b40e8e412958ca64807ae1809b31fef14c300c8cff8307aaffd7cf2d1dc43e5cba71c1503d03dbef478881bfd1da604d1fbc6b
SSDEEP 768:3Qy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbSroRYl:3Qy4J/DWvbtBhu1jajiLm0bJKl
TLSH
T1D2C2FB3B644CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65429325-e08a-416c-8641-c4fe20517c68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65429325-e08a-416c-8641-c4fe20517c68.tmp
Size 9KB
SHA256 ab11db0d35015e7675e000dfd49f29df3f370e3e5313b074ec23f664f7580cb8
MD5 236def375b3cc72d2ad20cd831d5bb0a
SHA1 af0a959e0e4228d67ab44a3fe6e38cb499af2cb6
SHA512 8374f71cd2cb5ac4cac6196a78ea276bfe5ac436a5b015a97d1b16c4d8432cc8708458496b4026e0c49ccde35406ef9fbc579f5b12c050b84440389392493aea
SSDEEP 192:sxZpR4W//fjsW0Idpd96HW6+WNGYrvPezsIgrJ:sxZpR//fjsWtOHbGXw9
TLSH
T12222B8566E28A57B8CC7E30DBB15BF13D6F9503291941E48EAFC861C09E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

964b4a01-7fcd-4c93-9dce-206374407f06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\964b4a01-7fcd-4c93-9dce-206374407f06.tmp
Size 10KB
SHA256 ff5a27a6f27a15688d28178b3a2df0a7033ae86d950b2f103bdd9f52a239bae0
MD5 d27f75e5661b8b56ec571cf2277f597d
SHA1 747b63ff0e983f2fb7f6c3613596be423b33c2a3
SHA512 82337fdf06d57668930356b8bebffe0a09cc4cd257cd01752674ec6b42f10d95218cdd6ae4d829d5854be84c4a0f39a97bb9cbc5ff0bf825366650fadd263507
SSDEEP 192:sxZpR4W//fjsm0IdpH96HW6+WNGYrYqezsIg5vJ:sxZpR//fjsmt8HbGBwn
TLSH
T14A22C9566E28A97B8CC7E31DBB157F13E6F9503291941E44EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 613c1d8d1c1be5091814cfea602578299a4372ea6069a105c66b644a9d6257a1
MD5 fd617705e9a46dc1f3c1f8abba94df9c
SHA1 0cfc67388151189a2444393aaf15d69aae138d5f
SHA512 aec2ada30decc6847913492e1b5f59d9875dd4ebce21d8a1ee7c8b40376fb881537f9d4850db51f7119738d7f0e31b1b97b02402b564ae151ce1e1d72b236334
TLSH
T117E0D8CC15CDC62D6504688712A4530CC2C0371E93C0AB6A2F08C5D97203590668E974
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 c328c6dd9735b4e969f98058275a955b4bd243e4fd65d648bf91bab24d160cab
MD5 e1a34e0d7a2d93216f0b506de1605d6b
SHA1 e59b98c35ed3dd8395b919702da5330172dd6167
SHA512 f7e3cc11881dd363caf849a1b33149910cedd3e5c27a633dd1f9f76ad0051b4292eab8468382aab0cc350862a41788efd0499c4df28941705d24739ad1f8b6c6
TLSH
T156512C4126A0636CF7EC307081FA92A736B48E72619FCE76E394F47A9946384F15502C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 871a415285b40434a2aaf3de7eacd34b5af9b35f6271f27c209b29664a739b3e
MD5 e690e8f45f6c4bf70582577008171d9b
SHA1 4f5e3f556fc985913f95742bd70ced42f820f5ec
SHA512 6f472fb7e2d25c5fc7afd013cf9861016ef1e29bcea9baab4e02127344a7a3ce1c6d97e7bb28a7ed2ba3d43392ee1cd0840f72c0000df52c2458c57d755253b8
TLSH
T15D510B412690636CF7EC307081FAD2A736B48EB2619FCE76E794F47A9946384F15502C
MD5 SHA1 SHA512 TLSH

Submit Download

38beca38-deab-4d05-985d-e5c5a0082f51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\38beca38-deab-4d05-985d-e5c5a0082f51.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

06af5214-31fd-42b5-9e69-41777f94d26d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\06af5214-31fd-42b5-9e69-41777f94d26d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

62eaad20-6e85-49b0-88ee-ae8d3dc5aa92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\62eaad20-6e85-49b0-88ee-ae8d3dc5aa92.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d41af23b-759a-40e3-a906-08fe8fc64bdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d41af23b-759a-40e3-a906-08fe8fc64bdf.tmp
Size 949B
SHA256 cd1f55e00805e1bc8cc18de3bd7b0ebc3d168238d2d0b0eb989fd8050f585048
MD5 e987359f8cf2a24561d6f6bf6cefc23d
SHA1 1d8452ec9bda4f6b82fa3ab8f4e3d878a1905688
SHA512 89be88f4c352aab8f2e1e0f4d6cc0e60b15760a6fc64c784beff62182cba76a90384a3cde1b717464eaa256cdcf67627bab71fd90c60965c66409859b7e9d2b5
TLSH
T16D117AF3C7E589AE8D0116F05A24AE2BCE2D0A16431C7C1A89D4EF6BD7E3475E00259F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 05a475bba4b6760b5bbce093a7339481ddbffffe80b5c6d4c87509c9c775729e
MD5 427a61913c2aff2e6741479bbaf0167e
SHA1 2508867398e0cbffa1ec15876e48b74fe95dd1ec
SHA512 92352484dfc947aefa66a348251a55d708eb9fa16a28cfc4650291a6e93c43d785c22236efbc5f47788f897e26dbd7c9b626d7beebbad5ba3507def61a9174a5
SSDEEP 96:KIDCKs0+aMgKdKO2T+K42BiKK86iGQKvKnO9y7:E5PjxJV/gO9y7
TLSH
T12BD1028930BF025439BE258881B59F1A62813277751CE67BFFBC50519A2BE085DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e09b3b9b-3b5c-4073-a67e-d0376ad1003d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e09b3b9b-3b5c-4073-a67e-d0376ad1003d.tmp
Size 9KB
SHA256 6fccdd09e5c1ea7df01d42b638996839d0f01db3b7f1eefd42e9cce4352d4457
MD5 86d726e44b3a31dc6a3962fec41d0a1c
SHA1 97fd579b2b48a4752d942567b5fbf71cd939daf4
SHA512 11a9d789749b8d6781643c92591fbbe43e76b1599ba3a48f3f32e35cb178831926bbc343fa3d6277f291ea8e74d2e0fc1810245f424a35ab6b62e72e4a7d692d
SSDEEP 192:sxZpR4W//fjs80Idpd96HW6+WNGYrvPezsIg5FJ:sxZpR//fjs8tOHbGXwB
TLSH
T14122C8566E28A97B8CC7D30DBB15BF13D6F9503291941E44EAFC861C09E76DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c57da1e-0d09-429e-aad3-3cede2d9c7b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3c57da1e-0d09-429e-aad3-3cede2d9c7b3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a4320c92-78f8-47dc-b30f-4746fdc64a8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a4320c92-78f8-47dc-b30f-4746fdc64a8f.tmp
Size 18KB
SHA256 8dfe2057ec51ef1cc25cd0fc9eae30cff061085f661dabc1c3b5b2ca2043fdc6
MD5 0eadedeee4be35641ae9c98f6063ca28
SHA1 937cda22693ba6b5d8db88b5148d84816b1792a7
SHA512 b2e2fb6c93127debb0bae29046d83653250a1ce60ddc5366c81bd3850081290eeb8bd51a002dfa57e3e62f662a5c64e7756f47871526e64f4b8fae95df51615c
SSDEEP 384:1QkUSv0sNfkbtZtdEbHX58Ex8kJsXb+2o0H7vBEnj4IIl9:P0FxEjaBblo0H75E8L3
TLSH
T193826B35A438AD2B5DE2A205F14A36139FF4901BD6C92B94D6EC5B2C00CE29E235FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87b0556d-6d72-45d0-bb87-894ef8302ace.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\87b0556d-6d72-45d0-bb87-894ef8302ace.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 92d8e1348a830c76cdc1d0bd3420698b542d3fe391b2fc31c680fff77389d2e0
MD5 8ad19fd1fbcdddefe156c746435c335b
SHA1 c6900b352c2c90dbdb99c96aa713ae7c8c49ddb7
SHA512 078ca5fc702aff4bd3db65b71a5bad1b1a1d12eda72dddcd863279a3dec1aa177971b2db2432e86248e14f514b183a55ba0d4c23609b0a598c278162e8818f52
TLSH
T1FA413A59A6FA1108B3B76F1AAFF6A86D487BBD772E06D45D00110D4F0A26B00CD71737
MD5 SHA1 SHA512 TLSH

Submit Download