ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261001-xae7vsvx8q
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{C93822A6-BBA3-45A5-9A33-16B76A65DE32}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4152	5072	msedge.exe	85
PID 5072 wrote to memory of 4964	5072	msedge.exe	86
PID 5072 wrote to memory of 2384	5072	msedge.exe	87
PID 5072 wrote to memory of 2384	5072	msedge.exe	87
PID 5072 wrote to memory of 2384	5072	msedge.exe	87
PID 5072 wrote to memory of 4480	5072	msedge.exe	88
PID 5072 wrote to memory of 4480	5072	msedge.exe	88
PID 5072 wrote to memory of 1600	5072	msedge.exe	90
PID 5072 wrote to memory of 1600	5072	msedge.exe	90
PID 5072 wrote to memory of 4340	5072	msedge.exe	91
PID 5072 wrote to memory of 1600	5072	msedge.exe	90
PID 5072 wrote to memory of 4340	5072	msedge.exe	91
PID 5072 wrote to memory of 4340	5072	msedge.exe	91
PID 5072 wrote to memory of 2240	5072	msedge.exe	92
PID 5072 wrote to memory of 2240	5072	msedge.exe	92
PID 5072 wrote to memory of 2240	5072	msedge.exe	92
PID 5072 wrote to memory of 2880	5072	msedge.exe	93
PID 5072 wrote to memory of 2880	5072	msedge.exe	93
PID 5072 wrote to memory of 2880	5072	msedge.exe	93
PID 5072 wrote to memory of 4216	5072	msedge.exe	98
PID 5072 wrote to memory of 2220	5072	msedge.exe	99
PID 5072 wrote to memory of 4216	5072	msedge.exe	98
PID 5072 wrote to memory of 2220	5072	msedge.exe	99
PID 5072 wrote to memory of 4296	5072	msedge.exe	104
PID 5072 wrote to memory of 5084	5072	msedge.exe	116
PID 5072 wrote to memory of 2984	5072	msedge.exe	117
PID 5072 wrote to memory of 2724	5072	msedge.exe	118
PID 5072 wrote to memory of 1984	5072	msedge.exe	128
PID 5072 wrote to memory of 1984	5072	msedge.exe	128
PID 5072 wrote to memory of 4024	5072	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbbf2cc188,0x7ffbbf2cc194,0x7ffbbf2cc1a0
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,9248105821866875737,17477180767597259687,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7283121916306989388,8155668916462985376,262144 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,12226199972565508328,12903497467234522814,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,7360878749512704906,11081279948517576330,2097152 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,6553311253984193954,13624787598283156736,2097152 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16258458632916739217,922428748217268710,2097152 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,8418074410094270463,17378639212926967916,2097152 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,17308682975628987443,4660761740314251678,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,16758765822942202936,8592878241169604557,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10677738642796488171,15708659081641543904,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10677738642796488171,15708659081641543904,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,8390575652588623750,13289335893969867656,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,18424927683389846330,451242079079282122,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,3321049201637401007,10586383680809796550,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,5103882184841462345,2238551551565279302,524288 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,7990439512627544314,11957740357484025325,262144 --field-trial-handle=2192,i,9408954667709111954,8549098165046048191,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

00fe2040-16b0-43eb-add6-6a8841f8b0ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\00fe2040-16b0-43eb-add6-6a8841f8b0ea.tmp
Size 21KB
SHA256 c8c87ef211f988fcf3aea4115b287816867aec8e59869d6c9d62b102ad57363c
MD5 466b7510f020b8c62743b53bdab607e3
SHA1 0ae450ea72bb86487582d65aa54141bb225f1f6f
SHA512 e8bc8cb62f5434224501b73e182925a0aa8ab03efdd8b21a20088b6333dd130b1f3e03627c42a3136e725e3be5c0f3d39f6c5a8389bdc0458077ccf81713c755
SSDEEP 384:9hiFiZcIAzsN08TUNTUlIlSwatiIZ5OjTVu6diGrnRwJr6ktgOIwZOyvE4oB:9IFQchwgst0nbNih6kXs/4G
TLSH
T1DBA26D339C644DBFADF7AB01F54A32038FB480A7DA95ABD0A2DD9A1C01975E8134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39cbe1d9-cb55-4547-ad75-8480e9d8a854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39cbe1d9-cb55-4547-ad75-8480e9d8a854.tmp
Size 8KB
SHA256 ef608c0def99026b00bae70c36e77ae368cd9dcd7b0b5cc8adbb7b8ffb4d59e1
MD5 46f3e39059db3ce48c4b885be0a1180d
SHA1 15a760309f8cd72bbc84dad209607f35c0ce21a2
SHA512 4c4bdb29f15d1a44183e17fa21b8bd2d5a8bb8b66db8247d9541ae2a5c3f03161e2bc9716cfc144d71234dfb8f9de266debd49765525b337aa732fea78204915
SSDEEP 192:SONd6ygQmiUyr/7OCTVg9l+FdV0R0rnhxFJSJrs3URrqRU6:SONd6vk7OCTVu6diGrnRwJrhkU6
TLSH
T142120935A8686C7B5DA3B901F48731139EA49167DA8A3F90D1EC5F1C01EB6AC234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a15de24-a7d3-442d-a02b-3c0539e3fd68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a15de24-a7d3-442d-a02b-3c0539e3fd68.tmp
Size 18KB
SHA256 877d130edcff614cde251cd13fbb58fe760d068525216aa908bca14aa36581fd
MD5 1bdadf9928822f572e0f8fdc78748fd8
SHA1 e877a6d893387127773548a972552f28069d10e5
SHA512 2399e2ed125d8d5b4e6ea6f71e891f80fcc95364def77b53bef8bdae094499eb9dcef78c5c1f64a64bdba667b699bbe9fbe7813f58f8653596216f1c0ce9f791
SSDEEP 384:iZcIhsN8TwatiIZ5OjTVu6diGrnRwJrIktgOIwZOyvE4oB:Qhzt0nbNihIkXs/4G
TLSH
T15F827E369C781CBB58F7A601F58B32038FB49067DAC96BD494ED9B1C01EA6B8134BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

1ef226ba-84a1-4da2-a9f9-6068953a2ac6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ef226ba-84a1-4da2-a9f9-6068953a2ac6.tmp
Size 9KB
SHA256 f5c5eb735b827e77b04d855ccad0eb0ce5ad397dc3a0a47cb9743dee2afd738d
MD5 e4149f6655d58826aba8d6d72e970a0e
SHA1 15a5803a07d80c8e2d1be33b82b783f59040c3fb
SHA512 1c0b6fed2289f0e9543c703cc9a1417b70b6ab948c82fe10baccca9540d1243888c359c28a6d88ff086eba39e30325550c8f26aa5eca7e3a35ce6231811eb1ed
SSDEEP 192:sxZCR3WZ/fos3PAIdpd34HW6+WNGYRPRcWIg5hJ:sxZC8Z/fosfB+HbGmJ9
TLSH
T18E22B8126E28A97B8CCBD61DFA257F53D6F9503291951F88EAFC861C05E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38dde5a7-431e-43a1-9fd0-2dcb8d3e8def.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38dde5a7-431e-43a1-9fd0-2dcb8d3e8def.tmp
Size 9KB
SHA256 7427add984a2a9788201dfbefb51c6e20912ae4143beaeecc1304bccdf6a66e9
MD5 3bc5ca5516b0bdf0f74e59899559394f
SHA1 c5cd0bd628ea6853bd0c538e3bb76c34af7352a9
SHA512 761cc71bcdd254f29a501003966e615ba928dedc6584e39e227ed398123023d1a7c3cd036b88601783d81d41532f8beaae70881888e55322100b0171b380b0dc
SSDEEP 192:sxZCR3WZ/fospPAIdpd34HW6+WNGYRPRcWIgrJ:sxZC8Z/fosRB+HbGmJ9
TLSH
T14512B8126E28A97B8CCBE61DFA257F53D6F9503291941F88EAFC861C05E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53b8a1f6-bba3-4949-af41-2577873ca1df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53b8a1f6-bba3-4949-af41-2577873ca1df.tmp
Size 10KB
SHA256 bb711891ee40d2ba5248921fb78c7f1547c174466cc6c442c88faf06d4e85a28
MD5 90a2841ae9f532ee8f1f26f298fa9772
SHA1 e37ec23392ad156714aacd0dce1ce11e5502938e
SHA512 7558177176fc24f4bc5eb65e2d17a99e2cc003f9bbdcd2af5ebdb64b34cb194d4ee11f4662884655217f7dd3d74ec08c741173bd339510585c595a078cbbd6b6
SSDEEP 192:sxZCR3WZ/fos3LAIdpH34HW6+WNGYRP/cWIg5bJ:sxZC8Z/fosbBIHbGmHz
TLSH
T18122B8526E28697B8CCBE61DFA15BF53E6F9503251941F88AAFCC61C05E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87c7d6c0-2db4-4470-9048-73f90611c584.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87c7d6c0-2db4-4470-9048-73f90611c584.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93c7eb95-63d3-4974-a5dd-5bfcfc41c44d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93c7eb95-63d3-4974-a5dd-5bfcfc41c44d.tmp
Size 27KB
SHA256 d6a1302e155093a63eac6470fdff73b7f78cafc1e1d4a5a298135010c05d1a2d
MD5 5ce13400af274f8741ee090d0b05806c
SHA1 a0c0ad8ffc4f746c4cd29b4a17a144119964245f
SHA512 ed71fc054a0af9e4c9ca21cd8b95f90d173a91fa8248015cbf6f8b4957a6e91b046adaca088025e483967fbc581dd2b8798f9961dcd2ce17c29f01d9b78e590e
SSDEEP 768:OIK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3lroV+OU:OIK9uzYWvcQWsu1ja0HL7Q3eV+OU
TLSH
T1C9C2FA3F640CCB7E5FC01A9DDC5A6F973E9802D7A6684D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 bfe851f8f56f8c890bf1e3117f2b60b5f4405075bccfed1d1cb98c6ee158cc39
MD5 0c5e43ba7b4003c00f37b28497cbb76b
SHA1 31ecc8d921b365a744b05474b415ef3b7ce8dbd7
SHA512 7b315e94de4022c862b479c1251495c3c0db5cb726716d9470652a054f3c648624b40574a2c670ced8b3d4dab49057d011f2e43d628642a0c8fa9a3811327292
TLSH
T19651D9C4DCB14354FB991F79D2D801CF36B867A16687DF3E1A9DE4B9580AF19500C348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 59191bd5972c303c83087e021a1444ec5065f4c8e0e0fe196b1f02d6d510674a
MD5 9463acb78442050110a793c6eefc9dd5
SHA1 ff367f84668813948647642f0137af31ef15647d
SHA512 45a2c5f082972201f6a0b496d4fce45697b095c1d6dc479c6d3ab9302797bb4dbc755999f4eb22620cf5bca8151db49b96d6578c161eb0add8c79612c95a5e8b
TLSH
T13C51F7C4CCB14354FB990F79D2D801CF3AB867A1668BDF3E1A9DE8B9580AF19600C348
MD5 SHA1 SHA512 TLSH

Submit Download

9b886a9a-4617-427a-8936-f32e1171b0f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9b886a9a-4617-427a-8936-f32e1171b0f3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

60db6af3-292e-490b-af1b-fa014880f1a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\60db6af3-292e-490b-af1b-fa014880f1a5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b14d1fcc-2dd9-453e-99d2-c71252f2aa8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b14d1fcc-2dd9-453e-99d2-c71252f2aa8a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fb9bc579-53e1-4600-b0de-d3c57c59a0eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fb9bc579-53e1-4600-b0de-d3c57c59a0eb.tmp
Size 949B
SHA256 4c26aad3915642644de315785254e1696f7fba5cc101af00b0527a2f7e98f7a2
MD5 16a0bb93ec9400ff209925861916b25e
SHA1 06ecdaa4e2a1e3fd533a575bafcdd39f3db6daed
SHA512 e62ca685d707f32286caab194c5844979df3b4f435c46e607203a10d64054f9af3f79a59b14299d171a53d5aaa20693a920ed25237cb4491cd749f597b7572f5
TLSH
T11B117AF3C7E585AE8D051AF05A28EE2BDE2D0606431C7C1989D4EF6B93E3475E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

a7314643-0ae0-4658-be24-2d71adc569bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7314643-0ae0-4658-be24-2d71adc569bf.tmp
Size 10KB
SHA256 0657878685ccf66c9b242ef729990383e0039bc5e79e8e248a125032a8842002
MD5 ad86f2521c58e7ffa93df38928f3ae1c
SHA1 acf31f9c8b37f347318167b111ed8cb440df4779
SHA512 0cf1c58167793e45855d7fb9fd67f9b32930742e2a571f97acd69c1adf67f9f4445dc55b1524575651db2bd381471c2aa5514865b73b0debd3b746b7a60b6cb8
SSDEEP 192:sxZCR3WZ/fos3LAIdpd34HW6+WNGYRPBcWIg5bJ:sxZC8Z/fosbB+HbGmpz
TLSH
T1D822B7126E28697B8CCBE61DBA157F43E6F9503291951F88AAFCC61C05E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f71eba10-8ff7-4ec2-bedf-31cc4cb31bdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f71eba10-8ff7-4ec2-bedf-31cc4cb31bdf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c32c0e22-8bd2-4a1d-981d-47716e82a82f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c32c0e22-8bd2-4a1d-981d-47716e82a82f.tmp
Size 8KB
SHA256 c49eca5a7fc8c49e4124cb4cc7caaabe294be5f8296d49d9684ae7fe277b8941
MD5 85e4f713b61eafa8cad839ea3ce29fa9
SHA1 f5edd8645282e34af4f4716172edde283e0caab3
SHA512 a549b5acfbdef4206d304c4388675b1af22aeded3a0ff9dc17d649c6f9c83a529efc0109e962e56eab5f22d3a3bee49d034b5ed2b481488fee04a7e818998647
SSDEEP 192:SONa6ygpQmiUyE/tOCTVg9l+FdV0R0rNzP30U6:SONa6lHptOCTVu6diGrBkU6
TLSH
T10302C735AC683CBB8DF3AE06F48B36139FD4116BDA952B94D9E81B1C01D765C2346C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fae2694-766b-469c-a414-f5e2ace4c2da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3fae2694-766b-469c-a414-f5e2ace4c2da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fc1955a8-49aa-4bb9-b303-ff56adc840de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc1955a8-49aa-4bb9-b303-ff56adc840de.tmp
Size 18KB
SHA256 310d33057284b220b052b3e134e8d8de0c6d00c9f27df41af2ef1b64818e049f
MD5 75996266ac5b44684e7c0f178fb249ba
SHA1 cc5c9cbbf54ddc0ffa921b1b73d987ac1b35cc09
SHA512 2bb63decbe4163b302d3bb9771477ea42b185ce0392b76f6ec490323924251408a504bc4598a86459dfc8bb80bc9371038751fdaaf8c8db9bb6a6c979d807a4a
SSDEEP 384:HZcIhsN8SwatiIZ5OjTVu6diGrnRwJrIktgOIwZOyvE4oB:vhat0nbNihIkXs/4G
TLSH
T191827D35AC781CBB58F7A601F58B32038FB49067DAC96BD495ED9B1D01EA6B8130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b8dc20d0e4927488f11bf37c777c2bd5fe4e6a2e967e981387e0503f013ed53c
MD5 d77549aa14e47ee720b26fb35f3bc9c2
SHA1 7ba49083ebfeea2f2d5745ef07efda2d08215066
SHA512 1f28f6a2994d52d7ed20cd25179503dabc435b19c0ef960444f733e437f9fd7253e94c154ab26f977e6aa717fea6cc1ab97e7e1e193f5eeafe110e5abbeeb63f
TLSH
T13E412788AAF91048B3776E5BAFF6696D48BF79771E0BD49D10110E4F0622E00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download