ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-e72g9ax1fx
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{5AF447A0-B767-4DD5-BD80-7FB8DDE48626}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1512	684	msedge.exe	85
PID 684 wrote to memory of 2644	684	msedge.exe	86
PID 684 wrote to memory of 2140	684	msedge.exe	87
PID 684 wrote to memory of 2140	684	msedge.exe	87
PID 684 wrote to memory of 2140	684	msedge.exe	87
PID 684 wrote to memory of 4772	684	msedge.exe	88
PID 684 wrote to memory of 4772	684	msedge.exe	88
PID 684 wrote to memory of 3364	684	msedge.exe	90
PID 684 wrote to memory of 5036	684	msedge.exe	91
PID 684 wrote to memory of 3364	684	msedge.exe	90
PID 684 wrote to memory of 3364	684	msedge.exe	90
PID 684 wrote to memory of 5036	684	msedge.exe	91
PID 684 wrote to memory of 5036	684	msedge.exe	91
PID 684 wrote to memory of 3952	684	msedge.exe	92
PID 684 wrote to memory of 3048	684	msedge.exe	93
PID 684 wrote to memory of 3952	684	msedge.exe	92
PID 684 wrote to memory of 3952	684	msedge.exe	92
PID 684 wrote to memory of 3048	684	msedge.exe	93
PID 684 wrote to memory of 3048	684	msedge.exe	93
PID 684 wrote to memory of 3812	684	msedge.exe	101
PID 684 wrote to memory of 1468	684	msedge.exe	102
PID 684 wrote to memory of 3812	684	msedge.exe	101
PID 684 wrote to memory of 1468	684	msedge.exe	102
PID 684 wrote to memory of 2260	684	msedge.exe	105
PID 684 wrote to memory of 1076	684	msedge.exe	116
PID 684 wrote to memory of 2556	684	msedge.exe	117
PID 684 wrote to memory of 780	684	msedge.exe	118
PID 684 wrote to memory of 2932	684	msedge.exe	127
PID 684 wrote to memory of 2932	684	msedge.exe	127
PID 684 wrote to memory of 4404	684	msedge.exe	129
PID 684 wrote to memory of 4404	684	msedge.exe	129
PID 684 wrote to memory of 3648	684	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x268,0x7ff89516c188,0x7ff89516c194,0x7ff89516c1a0
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12423886567915464934,10260507438240319067,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,206098445146035865,429767055603897303,262144 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,9593661360755137192,800294454498292062,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,3244738918734137276,2879247423694822485,2097152 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,12718110814013986551,16021812660982467876,2097152 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16037065833733047478,413777993087559944,2097152 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7852402886680069675,14160490457448483019,2097152 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,12770706473330406188,908487779910939391,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,6276686064102052410,9634281386514201457,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,17547419896715300251,17404508474114175668,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,17547419896715300251,17404508474114175668,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,8368160892005890035,14293527222725725866,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,3633405989881114638,12105373919392964756,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5413432834281550244,4576933299957348732,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,3413067253264341187,6822722132516707280,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,14502201895457056199,14230886272119024826,524288 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,122271966002988001,17281449990458006405,262144 --field-trial-handle=2288,i,16430073000509032180,1492290233692321465,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a245d3c-6818-41c9-9f58-51b4641177e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a245d3c-6818-41c9-9f58-51b4641177e0.tmp
Size 21KB
SHA256 30bb354dc8a124fa90d53d137e853de27dd7424641341b41ca42694049672945
MD5 5c70c8699b8866d56b2acee9760a9c71
SHA1 3c7dbdf8ecd98beba6288590f2117cc5c95b5c3a
SHA512 9c3b2cc1ef3abc853eab96d74edb05a99e95a06e9b28ba4556eb5c5371de1330261b1aa4bec88d51efe9b56b4e8480904ab2baa58167db70c345a2da07c5ce39
SSDEEP 384:niFiZcITzsNO8TUNTUlIl5wiOhq2bE7OjTVYudkG8+DuVZh6DKhHTos:iFQ3bwgzOcqnhlDufYGHTf
TLSH
T1C2A27D335C685DBB9DFBAA41E84A35039FF491A7D985BA90E2DC9B0C019B59C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38a52b7b-5e90-4d0b-a6f2-a4c9bf03eb77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38a52b7b-5e90-4d0b-a6f2-a4c9bf03eb77.tmp
Size 8KB
SHA256 8e35cfd611d36d9f2fa27a6e7e52f6bbc7eda6a94a4099fa1e272dda6bc04fb1
MD5 4046ad1e9ebccf59fe2dd61e0296f8b3
SHA1 ebbf589baf77a3068bc68e8c6c7e77f41d05110b
SHA512 d9da786459fe73ddeaac062286b048b51ca115bd52552f5b24ec5af3a7eac9dc743069ee83f73cee530e78bd11f3a0547b9ecc6ca54b9a82ef77c57fe122c454
SSDEEP 192:SONU6ygpQmiUyADtOCTVgvR+FdV6R0ozPxGU6:SONU6lHhtOCTVYudkGSoU6
TLSH
T19802C735AC783CBB8DF3AE06F48B37135FD4116BEA952B94D6E81A1C01D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63281680-3af6-438e-a8a6-09b2c0dca4cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63281680-3af6-438e-a8a6-09b2c0dca4cf.tmp
Size 18KB
SHA256 a6bbf7fb246d7a93bfd11bf3546d0dea233a7ea06686a829ac993bcc8ed504c5
MD5 ba7149142d1f289a1616199f421839f0
SHA1 4512d1b936dcde21c92dfeeadbc4a8602a42d8a0
SHA512 cf1064941d1fc801778179338ba4eb8489c54b77b27d32fbedb3193fe438db4919c5eb753df56a86612d4cfc6669c5db8274db6d502ecb1116250710132caed8
SSDEEP 384:VZcIhsN+YwiOhq2bE7OjTVYudkG8+5uVZh6DKhHTos:thqOcqnhl5ufYGHTf
TLSH
T1B0826D326C382CB658EBF541E48735035FF891A7EAC97B9495ED6B0D01EA5A82307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

314ce8f0-e3ce-4d1b-a20c-fa8c5c5f354d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\314ce8f0-e3ce-4d1b-a20c-fa8c5c5f354d.tmp
Size 9KB
SHA256 197ffa79788259c4b121946072446e4d5fe8e50a7072b4eaca2f99fdef6faf58
MD5 82f9ee1df47e79788a418cdfad88e0d5
SHA1 8b387ee08a4a36a829812d9f3977463723f262c2
SHA512 eb9e6b8809be6e96554c63d32027d79bf191a157bef6275fd2c26017117ec4fac867088aabb4f41cf654d0c43c9e13738cf11adf749cd7075bef5fa86b8668ce
SSDEEP 192:sxZXRWWQ/fKsHuIdpdBHW6+WNGYRPRc5Ig5HJ:sxZX3Q/fKsH/vHbGmi/
TLSH
T17522B8526E38A57B8CCBD20DBA157F53E6F95032A1D41E48EAFC961C05E6ACD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4211d6b9-cbab-4a9c-94f8-320c3d127f93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4211d6b9-cbab-4a9c-94f8-320c3d127f93.tmp
Size 27KB
SHA256 03f5f6c8eff075c484f36d95ae94ba257282e64d1ebd99b1c2d9e8ce35a4f0a2
MD5 70b3f0408fbcb5e98a595aea99836e9a
SHA1 3133e5107ac7a48bb0fe511b959e4be2121790be
SHA512 c50370eee37a5befd27c588624a517c580a69629ca6d23db99ea0687dec0250515c50b03ba77be5cf4dde7bc74692b7edde5e58cb28cff427a3a6b0dcfb476bc
SSDEEP 768:l9K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Sro++z6:l9K9uzYWvcQWsu1ja0HL7Q3J++z6
TLSH
T1D6C2F93F640DCB7E4FC01A9DDC5A6F962E9802D7A6588D4047FA984C02C77EE522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dd102a3-705a-4af5-a0d2-052586d0cb1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5dd102a3-705a-4af5-a0d2-052586d0cb1e.tmp
Size 10KB
SHA256 de6a4ec0b549fcad19b3b9c904ffd32779ff68418ee8611e8fae79c557467046
MD5 7235533a1298214b5cdf207668d8f6d6
SHA1 642d713f62d9b5b23514b59e210528bfa8f8c370
SHA512 be3130255c735c3f1977b19cc451148f637dd0f711ad34eef6ce02904cd6dac649f27da4e7138698afd7e0c0d1d5ea0925b0a5be3f318dbd7f4fa71a75381e35
SSDEEP 192:sxZXRWWQ/fKsJuIdpdBHW6+WNGYRP+Qc5Ig5VJ:sxZX3Q/fKsJ/vHbGmGrB
TLSH
T18F22C9526E3865BB8CCBE20DBA157F53E6F9503291D41E48AAFCC61C05E6ACD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

725a0de8-2e63-41b3-bd0e-6dc1379b5a27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\725a0de8-2e63-41b3-bd0e-6dc1379b5a27.tmp
Size 9KB
SHA256 0f0ebeb951b0f5241b49555fd0260f45e77fb2e8a4becddd2b034a920709a00c
MD5 c473f2431c6b151ef4da468c371728a1
SHA1 39e093a9b7b080f2891c4e35e985edf937dc931b
SHA512 65e3cf520085120d204d16c7c87038d61b46f4173755a6dc7e39aa4ce5177e78c639d58e0c53df6e0484b112682441e88e0e8ae1de8912fcbfcc76be58c8c4b3
SSDEEP 192:sxZXRWWQ/fKsUuIdpdBHW6+WNGYRPRc5IgrJ:sxZX3Q/fKsU/vHbGmi9
TLSH
T18722C9526E38A57B4CCBD20DBA257F53E6F95032A1D41E48EAFC961C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3bd245b4193bc212424e5321a0873d2f64f1c0a5eeeaab6173ac3e00f24445ea
MD5 a837f4c7e0f6c33d2a6655645374af02
SHA1 38c78aebe181a8c9d501629ef343c4dbec1a47c0
SHA512 2cf381490f287370f6206e18d48aa7c9268dc12544d83dc17195c4fa74975a85ebdf07c278cd04ff85a2fed28671b3c7c08bfae6759b249e00c528f0f16ec198
TLSH
T109E020F40DC8C32DF314688701B5534CA3D1B75B93C4A94D6B58C5C87549574A6D1D60
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 85403884d25f4844ef1b2af62807acc66748650957e12bb34804eaf6d323665d
MD5 7f6e9e4848d214b1791f04af5257272a
SHA1 1c04a324c4ec1c2e5d2f5200e0204eaa9db6d394
SHA512 f53c94ffaa34ba704bbe7f4b3c5aac2427d3dced5b7ea320a1e82522bf6bbfce4dda5a7bb664414b36acc4a003adf72c285af89314aa09d1d27d69cb18f18683
TLSH
T1A35194429B5343ADF7BB603281D519CF3A31054A584B5F2AC1E4C278B49F718A71C06F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0ca0c10dca3fe5cdcd6db78a66dfd069376c01b63d5a3cb2279a5dc55a9042b2
MD5 af4c1bf9a5521af8fcbb4612b9c20623
SHA1 1aca510b6780c861f4c670760cf9409d2fa7e6c5
SHA512 349b7889d295ddcc3822bb30f9a1b7332e64d6b29220af1591733ab95a0b2da6ad623221200e948ba79edb0513f18018487fa38814652eb9d1662d8b4e83b879
TLSH
T1385194429B1343ADF7BB703281D519CF3E31054A494B5F2AC1E8C278B89F714A71806F
MD5 SHA1 SHA512 TLSH

Submit Download

9c82085f-bfbe-4ae1-bd1d-60939bc15daa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9c82085f-bfbe-4ae1-bd1d-60939bc15daa.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2c5ae2ad-a1e7-467d-ad8d-3d473de244b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2c5ae2ad-a1e7-467d-ad8d-3d473de244b9.tmp
Size 949B
SHA256 1d7b41bf475b8eb21d076233dbd32815bbda73a98ac15aa61264d621ed7efa1d
MD5 46bdd1eead24a3e0a318f8606da882d5
SHA1 f1b96cba8e0023bd4e154a076b1feb596552e07f
SHA512 ecffdae4b21907145fcf2f6f6bb4aea3281fb6e070dc7b8434aad76d461a2f6dafd6372a02fc00c5295a34d5d1e8c36c5d5a21e509be64fe6a2a883ebe67e1c4
TLSH
T126117DB3C3D595AE890516F05A24AE2BCE1D0605421C7C1989D4EF6B93E3075E00159F
MD5 SHA1 SHA512 TLSH

Submit Download

2e8dc34b-867c-4e8c-99aa-4fda7b713f3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2e8dc34b-867c-4e8c-99aa-4fda7b713f3e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d24067be-4c60-49d8-b6f0-c6c06ac49833.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d24067be-4c60-49d8-b6f0-c6c06ac49833.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e6efcb040a8c549af3cc62b98fded9440936da41b8404f981e6b47202d4dc94d
MD5 ad8277b2a78b496cf16d5b7de74c7ec2
SHA1 6fc622f79bcf1d488dedbcfd99af8c78ef47b010
SHA512 922a1c0606a39584c6c9f6c84332b6a54cffd151115090cffb2ae7b4eb5aa62231ba04872efb0f6d6478dadd08105e1553be46dd8f672243ca28c85e9125b82b
SSDEEP 48:K0mIm10JF3jXYbLuLISdYK991vYxdIY+vF1yLmBcAeEE9bI/wISY9K981+9xWtYd:K0mpukKLCm2JiKSMVF+KuMl
TLSH
T13291F56131F70360787E255D40A5965B128172B33059EF2BBFBC44A18E6FE448DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5447949-0dfc-4856-88ca-65253b14bc40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5447949-0dfc-4856-88ca-65253b14bc40.tmp
Size 10KB
SHA256 cce57c32e4662becd29a4a7e33b813a602701269280e5d8b4832670a2f761a6b
MD5 60ab9daff1cfd405357677664c58d237
SHA1 a5d93abada15a48d5dda2338738dd5f9e732c2f1
SHA512 19880f4a81ab87a5138053f0ae0cb69e7a8d0ec8bfb1c4cfaa3e7ad19b0650ae0fa1ffb3a53effe2a632555328d463e69126134873de487555886d72d3aaf6ba
SSDEEP 192:sxZXRWWQ/fKsJuIdpHBHW6+WNGYRPjfc5Ig5VJ:sxZX3Q/fKsJ/hHbGmLAB
TLSH
T19322DA526E38657B8CCBE24DBA157F53E6F9503291D41E48AAFCC61C05E7ACD224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d37cb29e-d64e-4941-ba1b-49f1edabf6ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d37cb29e-d64e-4941-ba1b-49f1edabf6ff.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f0129484-07a7-4778-9633-3ae47e44f51f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0129484-07a7-4778-9633-3ae47e44f51f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b55fb661-7266-4a2c-84e6-460448b83f1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b55fb661-7266-4a2c-84e6-460448b83f1c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afcae8f7-77dc-4240-93cb-49ab9c5506a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\afcae8f7-77dc-4240-93cb-49ab9c5506a0.tmp
Size 8KB
SHA256 f1f9d0c35f2858c4c9eaaab5ebc1a56524b6ef1380042f948f87271a413f58c5
MD5 c0d9e0c21a379f407b83cce1414f0a12
SHA1 55c59eba380e469196967042ebbcc3c55e51a576
SHA512 77525e3b4e4eb59c84954e2904f8b52009b6f3523289446935807c6ccc703abf6e651f8a6821aebdee457e897f03c6b6bcf12fcbadbee1952356345f43d77c4c
SSDEEP 192:SON/6y9QmiUyDDZOCTVgvR+FdV6R08dMI3USq+U6:SON/6wQZOCTVYudkG8+tuU6
TLSH
T10712F831A8382CBB5D92B541E48731039FE49267DE853F94E5EC1B1C01DFAAC634AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00b4fa7f-770a-4786-a598-416833032e19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\00b4fa7f-770a-4786-a598-416833032e19.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ffaaa2ee-491e-4b53-90e5-80fec280912d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ffaaa2ee-491e-4b53-90e5-80fec280912d.tmp
Size 18KB
SHA256 b2fbd8679ee25639130d4c456368c78654454d5f3d239ae35ae3e0098692e5ca
MD5 577e9c17d0765b647e624ec34df34627
SHA1 8f5f490e5fd1ea6469a6b6e590392519e71ec008
SHA512 66cabf5b33e6352b8a662966092e79f5be319a6c4f27c69d2b4281699aef462dfa32e96b91fe6fa3696b17bb678aa7ef6f744602e3661a8e86ec1d4110df1890
SSDEEP 384:fZcIhsN+5wiOhq2bE7OjTVYudkG8+5uVZh6DKhHTos:3hnOcqnhl5ufYGHTf
TLSH
T16A827D326C382CB758EBF541E44735035FF8D1A7EAC96B9495ED6B0D01DA5682307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8666e64f318ae2ba1ce14311e42d45282f38661f65de5b5a9098ac12f4100a9
MD5 1b5325b58ce3fc74fc3cd799293fa3c0
SHA1 bc2ce4662f71fa41ae25c4b35ae96054819d2663
SHA512 0ed034f6837dd83702c6460c3aa89502bacf02382bc651cdb95c4afefc239a61a5673fb8d7640b7145392d9b5cf67b53d07b9f723be029c2ad11ca02c7c68e4f
TLSH
T144412C58A6F91148B3777E5AABF7646E487F78372F06C49E10110E4F0A62B00C8B2B33
MD5 SHA1 SHA512 TLSH

Submit Download