ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-e4lydsvw4j
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{742B644A-81E9-43DF-B1A9-2F078E2EC0E6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3372	3300	msedge.exe	86
PID 3300 wrote to memory of 4484	3300	msedge.exe	87
PID 3300 wrote to memory of 3724	3300	msedge.exe	89
PID 3300 wrote to memory of 3724	3300	msedge.exe	89
PID 3300 wrote to memory of 832	3300	msedge.exe	88
PID 3300 wrote to memory of 832	3300	msedge.exe	88
PID 3300 wrote to memory of 832	3300	msedge.exe	88
PID 3300 wrote to memory of 3284	3300	msedge.exe	91
PID 3300 wrote to memory of 3284	3300	msedge.exe	91
PID 3300 wrote to memory of 3284	3300	msedge.exe	91
PID 3300 wrote to memory of 4392	3300	msedge.exe	92
PID 3300 wrote to memory of 4392	3300	msedge.exe	92
PID 3300 wrote to memory of 4392	3300	msedge.exe	92
PID 3300 wrote to memory of 1748	3300	msedge.exe	93
PID 3300 wrote to memory of 1748	3300	msedge.exe	93
PID 3300 wrote to memory of 1748	3300	msedge.exe	93
PID 3300 wrote to memory of 2556	3300	msedge.exe	94
PID 3300 wrote to memory of 2556	3300	msedge.exe	94
PID 3300 wrote to memory of 2556	3300	msedge.exe	94
PID 3300 wrote to memory of 1960	3300	msedge.exe	100
PID 3300 wrote to memory of 1960	3300	msedge.exe	100
PID 3300 wrote to memory of 2784	3300	msedge.exe	101
PID 3300 wrote to memory of 2784	3300	msedge.exe	101
PID 3300 wrote to memory of 2568	3300	msedge.exe	106
PID 3300 wrote to memory of 760	3300	msedge.exe	113
PID 3300 wrote to memory of 1680	3300	msedge.exe	114
PID 3300 wrote to memory of 4552	3300	msedge.exe	115
PID 3300 wrote to memory of 4500	3300	msedge.exe	124
PID 3300 wrote to memory of 4500	3300	msedge.exe	124
PID 3300 wrote to memory of 4532	3300	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff1e38c188,0x7fff1e38c194,0x7fff1e38c1a0
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,10876727814052824620,12198677111772015258,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,5632283170476731369,6014421074866897429,262144 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,11302068304197471656,4684740339533315067,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6693481052499877630,3652731828754837213,2097152 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10763819107189229104,15701073668414926779,2097152 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,6896646997354285725,6641174608432330988,2097152 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,616964428318466982,13251608301845254977,2097152 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,9424960735244111847,5404805483615997200,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,9588335009212970242,16470748999250475664,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6513542036537292218,1825410503604069967,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6513542036537292218,1825410503604069967,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,10255147108975232828,3331773687953590870,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,4584144117371427451,2807356028426204154,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,11674903924357267114,882589356422157138,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,831429204374515376,17109473097970654447,524288 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=992 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5808,i,18409263763364666489,10805570118532955462,262144 --field-trial-handle=2312,i,3176843952226676635,6925068209243844104,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2dd78b0f-2669-414e-a2a8-3ff9a21eed01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2dd78b0f-2669-414e-a2a8-3ff9a21eed01.tmp
Size 18KB
SHA256 11484f85b0134d28ec27550de305dfd45a53cd6f1b16417f9ebc4d0be562d6c0
MD5 be0530f7704ab645eeda778c83961edd
SHA1 ca695aff85bdc054cd348eae100e33c9699ed70e
SHA512 7fc6523262105bfef01167608558525a5aedad430fda3b8d27b8f093def197c8403b3f1347b5b29759234b165499bedd269f01e096152faa0282fd71ae75c28c
SSDEEP 384:3ZcIhsNoUOwsO5GvxBGYX5ECm9TD7GtgOIwZOykxo1:/h4ujGYuCwH7GXs5+
TLSH
T15C827D7698B8ADBB1CEB9141F58736034FB89127E7C47F84D4EE5B1C01DA698130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46e7fde9-dbe8-4194-a973-9b94705cbfe0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46e7fde9-dbe8-4194-a973-9b94705cbfe0.tmp
Size 18KB
SHA256 8c22745655569cc1b2d610656435aab31cd63d5f51f72638a419834e9883ae90
MD5 237ee830706578322ee948366b56f52f
SHA1 8101fcd75ef30205702d50f84647a93ab6df9a1f
SHA512 76364b5debf547b184a7878c0949b741e0d41f3114e597ee50c8f3f7ed273dacf91478ebbe166581f51e740b33948cd7733a25e28e11d6f9cf1f99aa48e86817
SSDEEP 384:XZcIhsNoU3wsO5GvxBGYX5ECm9TD7GtgOIwZOykxo1:fh7ujGYuCwH7GXs5+
TLSH
T1E0827D7698B8ADBB1CEB9141F58736034FB89127E7C47F84D4EE5B1C01DA698130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d9e8752-6f59-4034-bf02-b6e638f6ad24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d9e8752-6f59-4034-bf02-b6e638f6ad24.tmp
Size 8KB
SHA256 80c586de089694f996ed18f18fbcff0e2417adcea8996b745a1cdee21fde427d
MD5 2cc39c60a6e3a9d6563115aca31c83ef
SHA1 e37d63031a30c8cd784571cc3c4fefa4242da1f6
SHA512 ea27fa7a96aa289c27a2b4a30e7004a5933bb1cf76d4d0a1862ad601327c691422f8ba896d5ac0600b104c9705baf144b1dceff0803246113b65b4cda278b2f1
SSDEEP 192:LJONK6Dph5qQmiUy49DwGYX59ezbCMmI9TDrPkIIWq5IU6:lONK61eLDwGYX5ECm9TD0GU6
TLSH
T1E312E835A8B8BC7B5DD3A591F48B35034FE8522BEB847F9495DD1A1C01DB69C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7728ac6d-38f6-4c8e-af2c-283e6653d9e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7728ac6d-38f6-4c8e-af2c-283e6653d9e1.tmp
Size 21KB
SHA256 4b0443a89fa438e533aa96f7b29d424cc00df7578cc2ed11a466694fb7be1907
MD5 9378040ef5a8b6d07c8f629352733875
SHA1 580980db1b06fd624460d30d3930ef9784cad5f0
SHA512 2dd709b03a72488723409479aa7d8d37730c5ce5a8e28d82f2ae11e7d261245b89e4c36aad579a1f3e8654651a5e5d6d8f2c75aabe55122b223fc6b04f777249
SSDEEP 384:RiFiZcIwzsNp8TUNTUlIlOwsO5GvxBGYX5ECm9TDbGtgOIwZOykxo1:4FQs8wgfujGYuCwHbGXs5+
TLSH
T168A26C7388B899BF6DFB9A81F54A36038FF85027DA85BB90D6DD5A1C00DB1D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

07ac93d8-b389-4e2f-83bd-327b3986fda6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07ac93d8-b389-4e2f-83bd-327b3986fda6.tmp
Size 9KB
SHA256 3d86435070004788bfd889030e2b971aa3a87c7fd3f021f6d758358d32c5c0ba
MD5 f9d1034b9f3b55dd6c4877943f4ebf92
SHA1 f9c0d4cb1fcb0e4595cd9ece7f7835e0beb3c10a
SHA512 5d51389a292331cc397c57e105045aa2841712fa16a25efbe38bbec63a3089928d1365c709f6c8d198591b6d1798b8ef99ae2f2031e4d11fecb2c46926786f8c
SSDEEP 192:sxZERSW//fssAEIdpdeHW6+WNGYgUF+TIgrJ:sxZE3//fssAdUHbGoU9
TLSH
T15612B9516E28A57B8CCBD20DBB15BF53D6F95032A1951E88EAFCC61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14499374-d4f5-40c5-acbe-1faafed9578a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14499374-d4f5-40c5-acbe-1faafed9578a.tmp
Size 10KB
SHA256 191571abf03d5e3fea4f6495af9457382d9fd5a719e3a18612ef2d9614ebc974
MD5 222b8c08048e4e2cd6c09f7b71930660
SHA1 6443a3366cf35160194f781fb3da99f37973c74f
SHA512 0a2ae6f98d94b4962858148f00c4e7850cd57fed0a3090b6a2a5abe415299e2b94a03e8f9a4ecaa0bfe1a96ad63fe3b3a31e8a199a63085a0445f83a6f49be1e
SSDEEP 192:sxZERSW//fssfEIdpHeHW6+WNGYg5F+TIg55FJ:sxZE3//fssfd+HbGNU7
TLSH
T15822C9566E28697B8CCBE20DBB15BF53D6F9503251901E88EAFCC61C05E7ACD224741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cbf47d9-20ef-479e-bc14-13f54c25a9d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4cbf47d9-20ef-479e-bc14-13f54c25a9d9.tmp
Size 10KB
SHA256 485d10bf83213b29bf6712e659fd1382f46487443603a71a2bcf53f344067316
MD5 a26900654b1a6b28859330ba5112d4e8
SHA1 7682908995fc0d56b5d77bab291d0cae021650a0
SHA512 4e75a3e4bf72463c7e89efce2ba6e33173dff22caefdf49cd327f175e4a67accb459974eab4f2d22d9638683b56271f6ea533d26033b5b72647dda2a5e770e77
SSDEEP 192:sxZERSW//fssfEIdpdeHW6+WNGYgzF+TIg55FJ:sxZE3//fssfdUHbGnU7
TLSH
T11E22B8526E28697B8CCBE20DBB157F53E6F9503261911E88A6FCC61C05E7ACD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

573641b6-f941-4c2a-85d6-54d335da8912.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\573641b6-f941-4c2a-85d6-54d335da8912.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84e40b71-408a-449f-a80e-12d3125747e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84e40b71-408a-449f-a80e-12d3125747e4.tmp
Size 27KB
SHA256 0b5ee7a4d7600de9c7bbca1db6b23e8b75c313c3c38e42c0b8d37542c9c29b47
MD5 ebefa962300f9ff1bed10d363e4910e6
SHA1 1e50194292b652103444b39ca77d2410bd7339c1
SHA512 912e14d1ca97792fd761bf34656a8fb8d5d9ac2e1efe137943794d6b9fc3196b0e79edd67188c3665d08947834ec628b7e23ad17fe6d5712ec83bbe0c273a048
SSDEEP 768:KvichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzhrotTI:KvichfPWvPZplu1jan+LKgzaRI
TLSH
T11EC2EA3B640CCB7E4FC01A9DDD5A6F9B7E9802C7A6588D4047FA984C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fef7d4e-7e2f-4ff0-a86d-331471aa469b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fef7d4e-7e2f-4ff0-a86d-331471aa469b.tmp
Size 9KB
SHA256 0012d25ca1beef0c73be57e7c304c287a04fc7e240e89ad306d7f7a0e4696210
MD5 151de8669f3a05264c2c7aa079822019
SHA1 9b54e6d574d55c7378aabae52bdd264cc0315e35
SHA512 5a0ed86af0aa74e6406b6310db4c4a9bb78cd4afc857a185698330e688a73a69273712bd6c513c5c1b12757fed12e6ed0c6d73892ae2afe23a6f529208c1622f
SSDEEP 192:sxZERSW//fss0EIdpdeHW6+WNGYgUF+TIg553J:sxZE3//fss0dUHbGoUV
TLSH
T11422B8526E28A57B8CCBD20DBB15BF53D6F95032A1941E88EAFCC61C05E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c1a2af4c5880ad1bbf191c22b5026e8642604dc40e14ec6eddc78c1b60a1231c
MD5 25722d0eb47a81b344e373119cdc8116
SHA1 2ac43ebc72faebae7051ff7e054ed442d45cc4e5
SHA512 2ffc02a8be32c96c74855d585ee8f3cbea08775216021c3458183292072726979f1e450536a681772288c84316bae65eb9fd79a804a5282ea4b1c87cdabd6fa1
TLSH
T15161C6CC554180AFFF948178ADDD70CB37365D827A4F0DF38198D4B6A886BD4C38A890
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 223279ce16ff222e2b90ad572c8b714eed7b0f8566ac486ab94aae7d6a916fbb
MD5 965ae0a616abfae99e329d70acd8ec13
SHA1 506748620f5a019caadc0fa2d520d86b2c7426a4
SHA512 1c3d5c1991cc9ed3e907e4df0dafee7000148f68f601ae8cd788578ad113eb85793148bf7c8810ac1e576680b3b8dfb5132b3b1b2463fcfefd03a819fd560f70
TLSH
T1E561B5CC454180AFFF9480789DDD70CB3B365D867A4B0DF380A8D4B6A886BD5C289890
MD5 SHA1 SHA512 TLSH

Submit Download

950e9caf-be61-48f1-8971-b0227abeb834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\950e9caf-be61-48f1-8971-b0227abeb834.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

0d016155-a8dc-437f-a617-f5ddf2332b01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d016155-a8dc-437f-a617-f5ddf2332b01.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ad80f696-face-409b-bd17-84e87c738221.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad80f696-face-409b-bd17-84e87c738221.tmp
Size 949B
SHA256 34909e6334f0678b27ce51e20087ad5e3b4ecddd257073c82b4580d68ea7ee12
MD5 72fdcb5c408f103be6883c216146f681
SHA1 5ee203d2811674f182e8f011742e0605180fe8d1
SHA512 0951b6b0f4d859abc126e197e18b0b9751504af8ec0a69653269a2226eb2efac4e6010dc62cb40e594a194f2c29211307599ca40bcb406cdfaeff1f4009f7470
TLSH
T15B117DB3C3D585AE890516F0AA24EE2BCE2D0606821C7D19D9D4EF6B97E3076D10159B
MD5 SHA1 SHA512 TLSH

Submit Download

e11fb837-5512-40fe-8922-b5806e110d13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e11fb837-5512-40fe-8922-b5806e110d13.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a7ac37c4-ef6e-4818-a0c5-753baf59380a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a7ac37c4-ef6e-4818-a0c5-753baf59380a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7de86a5-743f-4f35-bc91-b12cf9219c26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c7de86a5-743f-4f35-bc91-b12cf9219c26.tmp
Size 8KB
SHA256 c204b6821102b3f88c84d46ac9b367bc457c7057ea614a4a87a45bfe658418d7
MD5 371325e2d8443ae393c036cc2ae785e6
SHA1 3ca968dfb6848d9e252da527260dc4570c4d4d6d
SHA512 ba04b74a73427d5cbe323b3fae02bdaab130d5bcdb59b73e393fcd49618e75648944fcba347b2d8921897d7e4c6695a69397e07c6495a5e26bfb182180e9cfba
SSDEEP 192:LJONk6DphmqQmiUyu9q8wGYX59ezbCMmIXkk7vUU6:lONk619TRwGYX5ECm/cU6
TLSH
T14002FA35E8787C7B4EE36E45F48727175FD8112BAA906F84D6D81A1D00C768C2307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d1b4e65-0198-4907-b6fb-c916362d38d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d1b4e65-0198-4907-b6fb-c916362d38d5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d5e526e1725979d6a164e4ce688e1cea37317ac13a062926434766a68d14b1c3
MD5 993a16517b5980fd5848da02149b4d87
SHA1 9d38b2908495a84dc6a81067f184b4411555a1a4
SHA512 ca5823b6e5057784dfb5158e946086953ecb110121114a1b4c4df29a050ed7428a11b6ced84e07b5741639e9fdd935979dfe4e9596726239ea8b60fd0e876c65
TLSH
T11E412A5CA6F91148B3B76E16ABF6682E487ABD372F02C09E10110E4F0A62A40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download