ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261001-121vesvwhy
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{DFB759A4-386F-4D03-ADE3-401BE8AA41E6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2452	3372	msedge.exe	87
PID 3372 wrote to memory of 4132	3372	msedge.exe	88
PID 3372 wrote to memory of 5016	3372	msedge.exe	89
PID 3372 wrote to memory of 5016	3372	msedge.exe	89
PID 3372 wrote to memory of 5016	3372	msedge.exe	89
PID 3372 wrote to memory of 1608	3372	msedge.exe	90
PID 3372 wrote to memory of 1608	3372	msedge.exe	90
PID 3372 wrote to memory of 2784	3372	msedge.exe	91
PID 3372 wrote to memory of 2784	3372	msedge.exe	91
PID 3372 wrote to memory of 2784	3372	msedge.exe	91
PID 3372 wrote to memory of 5056	3372	msedge.exe	92
PID 3372 wrote to memory of 5056	3372	msedge.exe	92
PID 3372 wrote to memory of 5056	3372	msedge.exe	92
PID 3372 wrote to memory of 1396	3372	msedge.exe	94
PID 3372 wrote to memory of 1396	3372	msedge.exe	94
PID 3372 wrote to memory of 1396	3372	msedge.exe	94
PID 3372 wrote to memory of 4376	3372	msedge.exe	95
PID 3372 wrote to memory of 4376	3372	msedge.exe	95
PID 3372 wrote to memory of 4376	3372	msedge.exe	95
PID 3372 wrote to memory of 4256	3372	msedge.exe	103
PID 3372 wrote to memory of 1376	3372	msedge.exe	104
PID 3372 wrote to memory of 4256	3372	msedge.exe	103
PID 3372 wrote to memory of 1376	3372	msedge.exe	104
PID 3372 wrote to memory of 2672	3372	msedge.exe	106
PID 3372 wrote to memory of 3016	3372	msedge.exe	113
PID 3372 wrote to memory of 4364	3372	msedge.exe	114
PID 3372 wrote to memory of 1244	3372	msedge.exe	115
PID 3372 wrote to memory of 548	3372	msedge.exe	123
PID 3372 wrote to memory of 548	3372	msedge.exe	123
PID 3372 wrote to memory of 2936	3372	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe46c8c188,0x7ffe46c8c194,0x7ffe46c8c1a0
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,15714340768713346092,6787156999020819025,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,17717661223393724393,8842782598609301843,262144 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,11769323300885412887,11412182327287666314,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,4748978546423923825,9193185033117810788,2097152 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4012349453640271723,9551600772431835521,2097152 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,4969204989215741312,4043270842914933413,2097152 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,14667234951593445532,1165946802959485082,2097152 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,10248267364258886978,10170268342221975617,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,15198455219717455716,4298733581313630845,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,12886853387805797073,10339869440567239590,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,12886853387805797073,10339869440567239590,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,10741614457854411211,1972428972317070033,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,11215010738738552631,12346387476905924175,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,6631863845751125927,8457753126801117752,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,3627224835101140449,2358139768921079033,524288 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,298712247661562068,1968633467571044442,262144 --field-trial-handle=2220,i,1614629771864061029,10370849771706829637,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c4c6064-1d76-411e-b108-7bea475361e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c4c6064-1d76-411e-b108-7bea475361e9.tmp
Size 21KB
SHA256 f2f978ce9afe08595f76098f356e7c240acedc609243c2b6dd2d84d754eccbc2
MD5 938dadb4141f655a2ec6b66cb2f0d99c
SHA1 866290b9753bf279e59ca71b9946a4de87f6d296
SHA512 5e4e8345defe47653a5047995364505acc7602997461497979f836f6a00518859409410543625d9e93f66413421379f8a63d8e56a55bffccef4e32c615ceac3b
SSDEEP 384:7iFiZcIIJzsN68TUNTUlIluw2IfAZ8COHX58EA8uJKXeJrxKVZh6DKhH5oR:WFQIpnwgr2Io5IaiehxKfYGH5a
TLSH
T1D1A27D339C68DD7BAEF7AA45F45A32039FF54063C689AA90D3D85B1D00DB1AC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a8102c1-61e0-4ac1-88e8-fdcc03a03a4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a8102c1-61e0-4ac1-88e8-fdcc03a03a4d.tmp
Size 8KB
SHA256 a350c69dc9f284b5d9153dc2f3d65625388a4c0c62cb4af6a02684f900f0bc9a
MD5 d5324376ff95d8c047acb67b8ea24a13
SHA1 369dee43b93701f5419b70d829f03a83ffea4db1
SHA512 0919eee39c287c4bf64d78118563c747069c3d04d2c3e1ba022f6316c5a22466f5a4d8643224c25bedfd65c804e3af3f8219153e140bcc6700ae346b1b61b70c
SSDEEP 192:1OND6wlDgQmiUyi0i8W4X58gZYjzoruJyDlj+U6:1OND6kgqW4X58EA8uJyyU6
TLSH
T13F02F934F9687C7B9EF3AE09B4862713AFE5102BE6552F44CAE80A1D00DB65C2346923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f25a2e6-4dc6-46ec-ba8e-53438b985723.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f25a2e6-4dc6-46ec-ba8e-53438b985723.tmp
Size 18KB
SHA256 19fe8c4241a68c5cf54e9e843243ca775c1e016390ed18c12802f15d1fab2030
MD5 d56c71d16605d96deb9d1e690f67797d
SHA1 740fd136bf5f89834ef563ef66bdebf440990256
SHA512 fa07613665a6055fc221d767f12986f6af4506c0b709b64f90c4dd66c3ced712917df0e89244395481489a63124b28572f018d793e0e4af105b43300bb3d7113
SSDEEP 384:sZcIhsNiPw2IfAZ8COHX58EA8uJKXeJrsKVZh6DKhH5oR:6he2Io5IaiehsKfYGH5a
TLSH
T1AF828D32A978AC7A5DF7E145F49A36039FF49053D3892F84C2EC6B1D00DA6A9131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db998f2ab3bc4e87d03b65e45c5cbb178df73d3cf3485b0f37651dcc2814f3c4
MD5 5f5f54c76a35e981894cc5fb6daba05e
SHA1 f502dcb8644de3724c621965a3a911c911ca900d
SHA512 5b35d9868c8c7bc14be58b8d1c82589ffa8c6d4d639a122de36a7603d6e1fdaa95347b26ba4692476227aad23f224b54f96b3ed88d347aa1c403e5ce05da56b9
TLSH
T16FD080B5D9756AF4E465253C02230604714C95425D433105D55145960D9D7C354D7DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

25eca869-b54c-4114-ad14-8c162113750d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25eca869-b54c-4114-ad14-8c162113750d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62ea78f2-12e1-42d3-a17a-b212193db691.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62ea78f2-12e1-42d3-a17a-b212193db691.tmp
Size 9KB
SHA256 7a21be3e2bd5e9438bbd7dd3c243e3b049ce57057605875160853948c312253c
MD5 907b590f3dd9718b69d80115ff045855
SHA1 82bc5f3bf04b64c475a46ea55e4a187241dad5f7
SHA512 b789e348e2d84e6fb93b59b493a64c4dd93acb341b65b1d0e4cb186ccd1c136659a68da40ee59ae94f872961cefe805305e5d28e76e7f3cbe320f08cd3dc9258
SSDEEP 192:sxZYR/Wh/fZsU7Idpd4HW6+WNGYrbjQIg5XJ:sxZYoh/fZsUkOHbGjv
TLSH
T10C22A7526E38A97B8CC7D319BB59BF53E6F9503291D41E58EAFC861C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66a7b50a-256d-4a10-b3ab-4dce6eb6dae8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66a7b50a-256d-4a10-b3ab-4dce6eb6dae8.tmp
Size 10KB
SHA256 52cf1aaf76ca0fc6e5e5fdced5dbc9133c4a9b97346d320a6f86cd4e2a7d8a5c
MD5 073e081191d234a3fd38fd6a67093e67
SHA1 2589d3efda8cc78f205360280e78e036a92003e1
SHA512 0e00dab800d8dd3a3c7e85f909289c15e5863f327beb1766dd80aa223bb39528d7be0530841358b8e52f3cd8d65c39d5e6872f6c76ddbc0736c721a61ebb39be
SSDEEP 192:sxZYR/Wh/fZsa7Idpd4HW6+WNGYrWjQIg5lJ:sxZYoh/fZsakOHbGax
TLSH
T1F922B9526E28A97B8CC7E30DBB59BF53E6F9503291941E58E6FC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71fe9285-7f5e-4305-a8ac-20395a5e5d26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71fe9285-7f5e-4305-a8ac-20395a5e5d26.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

75c70a03-d4e9-45af-b448-c0dc2011095e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75c70a03-d4e9-45af-b448-c0dc2011095e.tmp
Size 27KB
SHA256 9efa644beb37a1416db236bee240282a18a56b96be19712d1e69c033243f706c
MD5 9c9e13bc3d58cac9d013f0574c701607
SHA1 fd164fd08a9648aec3026f6c8c7b958bb994f50f
SHA512 544ad13a10e4a13d4ab85b55c5fe88583fd8b0635b72303f90caf3477416c56c8fc579509da5d514a27a02ce4a1d24e6977283bf392ae201b513e57646846e45
SSDEEP 768:1uy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbqroRyB:1uy4J/DWvbtBhu1jajiLm0bBgB
TLSH
T19DC20A3B684CCA7E4FC00A9DED5E6FD73E9802C796948D4047FA994C02C77EA91264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

807760d9-082e-4f68-a805-0c18bc3c76f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\807760d9-082e-4f68-a805-0c18bc3c76f3.tmp
Size 10KB
SHA256 7e7d83703026cc00f0a30fadc63962ac74534c0094381570057ea19ae7571c2d
MD5 5b89728c36d99603d35e0da31ebac64e
SHA1 8352f92cd2aec96df751b0f86418afa4306865be
SHA512 32e6bc67a71a678c762c3ca851b3ab68d7f7782eab406e4ee4066648c50bbffe3d5db568574e68ff1fffc39a4d56c4c544f58bb2fcb783a3c9c8a6fcc841a3bf
SSDEEP 192:sxZYR/Wh/fZsa7IdpH4HW6+WNGYrkjQIg5lJ:sxZYoh/fZsakYHbGQx
TLSH
T19622B8526E28A97B8CC7D31DBB59BF53E6F9503291941E48E6FC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7557a72e7aba48027b67f4a44f8f926e73f541fdd47298d93c3f936dbade7d68
MD5 cc2e11b5723617ca1b50023da8787d9a
SHA1 b74b38e7eb0bfaec112ee9de6358ff034b251c68
SHA512 5218ba6716d161440dc6a477083dcb38eee917989ce2f7214ca9578cd5392de0ac40232e3a07190f214c0d02d547032964f9a08667aacf0b8ebbbd1fc1262dab
TLSH
T12661A2F1B580D8DDFBE4917282E6DEC336B8B881DA833E630964FA75F846B95500C49C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a98e8aed0de12bcb4d21d1f0b92952cf13dc8ea6dce9ac9cc4e494182de03d95
MD5 ca8131bb73635241cc6f3b86f295a9fc
SHA1 d1f9ff215aae8f125c39465efd3074adcb874468
SHA512 2b8591365b1068d2767ebd4c57a16613dce188bcd209c6050d52500cab5cca5e64e3831a4440b11d8c63e217dbc7431778abacc71a1f3a051ef2333224130609
TLSH
T14061A2F1B680D8DCFBE4917282E5DEC736B8B882DA833E630964F675F846B95500C49C
MD5 SHA1 SHA512 TLSH

Submit Download

0a7af47d-d19d-4730-859f-155df5c064c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0a7af47d-d19d-4730-859f-155df5c064c0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4c835fe3-535e-4712-92a7-5380e30840c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4c835fe3-535e-4712-92a7-5380e30840c4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

8b66411a-e669-4e61-a04e-fc5a8ce9a84d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b66411a-e669-4e61-a04e-fc5a8ce9a84d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a10de82c-30b4-445a-93db-98aff5c83a9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a10de82c-30b4-445a-93db-98aff5c83a9f.tmp
Size 949B
SHA256 80d70af782c4afcb3746939f16d22949c1dc3872d7fa8ce9931e487fbca452fe
MD5 399857b98438a91ab43005dddf66cd50
SHA1 ca6e2738087a918dbd698b6a414cb59dc9530c07
SHA512 f46af6df0b596df2050de5c6c13de87da4fbc04cf58af16505350d39250134b0e77540ee19d8038122bda9f62dcf004b1a2d65ce2ed3c9de5dcb539f2ad4e930
TLSH
T1C5117DB3C7D595AE890516F05A24FE1BCE2D0606821C7C1995D4EF27D3E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f0b0f3d918d52ff7cdc91d556e89a0687cf661fd1d6b1cae4cd327c08e8e817a
MD5 44f67cbc4f8c7d2f4fe334fb485a0a62
SHA1 bfbc0ca753bd70144fcb85f56a18a929bc666269
SHA512 373d164e21d822613e3a8d6a75d8f443d1a073979d44b4344fef9f87e2ffe635ef6810bfa9cc3a9325d157de18b3ebfba499f0710a9b2c2a6d41e54deabe8fc1
SSDEEP 48:KIDI1Ks04jyL1i1t1w1c1i1A1g1xb181L1sIS101xK91411C1xx161hY1j101g1v:KIDCKs0+eb2Kws6yYgKNaL
TLSH
T1EF91614172BB061038FD69988175CB1B074232773218E62B7FBC50A65E6BF086DFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2bcc4df-9911-4154-bbcc-d249af251f52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2bcc4df-9911-4154-bbcc-d249af251f52.tmp
Size 9KB
SHA256 40006977404522cc2af8ab281ff18a4f5607811443bb56d361954378ecc1e64b
MD5 143b3d3161566d6cb7671e4b6d8d4730
SHA1 16614eed61bf407d48bfef3e52797897061a36eb
SHA512 7f8415497fdcc02a8ed936abf7f037c962d60ec7eb75ce189ef8b6f42cecc6428b1472643b4f43240d96b4371aa32e8fb1a9180768191a360bdc612e9fe341bf
SSDEEP 192:sxZYR/Wh/fZsP7Idpd4HW6+WNGYrbjQIgrJ:sxZYoh/fZsPkOHbGj9
TLSH
T1DF12A8516E28A97B8CC7D30DBB59BF53D6F9503291D41E58EAFC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea7fd55d-c0ef-4a73-ba7e-3cbc000abaca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ea7fd55d-c0ef-4a73-ba7e-3cbc000abaca.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9f7ab8e-4906-4a67-a7cf-a0b39e217b0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9f7ab8e-4906-4a67-a7cf-a0b39e217b0a.tmp
Size 18KB
SHA256 04c894ed1d56a2ed8f81d6db48b865b74daaa3300428a10f0b619f1f405ad310
MD5 6d957f97d8b0b854411aeece8614aff3
SHA1 7f78ded21af018385751ad39afb266e2702f9d08
SHA512 915ff12ad15e9da42949c445b977b2505220e5622c41f4fa27096d5e08d6ec2cf4545e3d644ccbc23615d4dfc9977060996441b019518059d6aea99b49094fde
SSDEEP 384:0ZcIhsNiuw2IfAZ8COHX58EA8uJKXeJrsKVZh6DKhH5oR:yhD2Io5IaiehsKfYGH5a
TLSH
T192828D32A978AC7A5DF7E145F49A36039FF49053D3892F84C2EC6B1D00DA6A9131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93705111-d8be-40dd-afff-b09076e9ca3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\93705111-d8be-40dd-afff-b09076e9ca3c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f81c9716-3646-41d3-a118-6fe0e1f46bf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f81c9716-3646-41d3-a118-6fe0e1f46bf3.tmp
Size 8KB
SHA256 2d3a3fad7e22a472e4fad8a66ea094ca75d7bd94769522559d20c319d711e372
MD5 d43dbfa4f5dbde16f5c2193540d8204f
SHA1 f310a300178a6781dca515fa5ce25229a1247cc4
SHA512 9d375fcff8ed307e836151135d5bb1cde32973bb2069d1eea8daf67ad55db8b300c4f70fdb7fae606d793807803ec6a102ceaa33d943ee947701a29a0b4eb637
SSDEEP 192:1ONL6wlD5QmiUyiIi8q4X58gZYjzoruJKXrSJr1velqjU6:1ONL6kX+q4X58EA8uJKXeJrEKU6
TLSH
T1E1121736E968AC2B5DE2A549F08B3113AEE54117DB897F94C6EC1A2C01DF26C534AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5dc2f4207322d4ae1183736df333749ba981da65ea63979d829b359b5ea985fd
MD5 869b8b1ab18738fb85c7c05801b21c30
SHA1 540023f984f729ceac0c0af955b61ef5e54124e4
SHA512 799d85916367ef35ae7f8abc7c7dbce522f77f069855c8732abe20d9a28910eb2ab6d004312e7cb9a0e6602838ff7dd0c635587e287b480c9191e4e77206314b
TLSH
T1F9410658B6F90148B3B76F566BF6A86E447FB9332F06C56D00020D8F0662B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download