ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-l2qbcswt7q
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{74EB9EB3-8F00-4BF7-9C3D-D6C39021C392}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 5092	1800	msedge.exe	87
PID 1800 wrote to memory of 1464	1800	msedge.exe	88
PID 1800 wrote to memory of 1208	1800	msedge.exe	89
PID 1800 wrote to memory of 1208	1800	msedge.exe	89
PID 1800 wrote to memory of 1208	1800	msedge.exe	89
PID 1800 wrote to memory of 3500	1800	msedge.exe	90
PID 1800 wrote to memory of 3500	1800	msedge.exe	90
PID 1800 wrote to memory of 3132	1800	msedge.exe	91
PID 1800 wrote to memory of 3132	1800	msedge.exe	91
PID 1800 wrote to memory of 3132	1800	msedge.exe	91
PID 1800 wrote to memory of 4236	1800	msedge.exe	92
PID 1800 wrote to memory of 4236	1800	msedge.exe	92
PID 1800 wrote to memory of 4236	1800	msedge.exe	92
PID 1800 wrote to memory of 872	1800	msedge.exe	94
PID 1800 wrote to memory of 872	1800	msedge.exe	94
PID 1800 wrote to memory of 872	1800	msedge.exe	94
PID 1800 wrote to memory of 5108	1800	msedge.exe	95
PID 1800 wrote to memory of 5108	1800	msedge.exe	95
PID 1800 wrote to memory of 5108	1800	msedge.exe	95
PID 1800 wrote to memory of 4152	1800	msedge.exe	102
PID 1800 wrote to memory of 4152	1800	msedge.exe	102
PID 1800 wrote to memory of 3232	1800	msedge.exe	103
PID 1800 wrote to memory of 3232	1800	msedge.exe	103
PID 1800 wrote to memory of 4980	1800	msedge.exe	106
PID 1800 wrote to memory of 3900	1800	msedge.exe	116
PID 1800 wrote to memory of 2628	1800	msedge.exe	117
PID 1800 wrote to memory of 1960	1800	msedge.exe	118
PID 1800 wrote to memory of 4712	1800	msedge.exe	121
PID 1800 wrote to memory of 4712	1800	msedge.exe	121
PID 1800 wrote to memory of 4560	1800	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x290,0x7ffea3f1c188,0x7ffea3f1c194,0x7ffea3f1c1a0
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,6459254442402933653,18311485864492322299,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,15557208267395985403,17275087354757570090,262144 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8603183648908214479,5459855724704132172,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9840877910752220201,11664463123523797385,2097152 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,14064583062402733264,7221020789953408770,2097152 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17267546676561422562,13413523708218660240,2097152 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11837316531881178402,12643387564417642905,2097152 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,7668216268454931062,10963664403324638418,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,13025459116589819882,16677925382879710367,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12952211552147527638,2325743459266901128,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12952211552147527638,2325743459266901128,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,4856640190929131204,7707376572896160458,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,2582142275207100872,15077497344849820877,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,2744026893747264998,18182360669013290490,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,9911131862467231619,15909320638291070013,524288 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5824,i,12540682367104968793,7606759299659147821,262144 --field-trial-handle=2232,i,13203105376465168660,14845620924700271680,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05630ce7-7bae-4a14-9338-6cad00c20f81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05630ce7-7bae-4a14-9338-6cad00c20f81.tmp
Size 18KB
SHA256 610081c88ac2c150761546de34f37fb8e5e12af9da00118947484f6778251b32
MD5 bec3309b122cc0e806faee7d6e0f6ce3
SHA1 572b18a23e5c4d30f117d27f43194950186294cc
SHA512 54189c3d9657f5ad90f4eadec55e95f56d1571d74ef5085b6a91d890ea83eb2888787e781e70e1a1f71e59680402625aae2457b33fb732d4d23f54436a9095c2
SSDEEP 384:hZcIhsNtTv7cuijYbQX5+DtN8zX3+2gNjgVZh6DKhH0o+:phC7cuxMkD03lg1gfYGH0V
TLSH
T1A3828D3298685C774DFBA286F04732135EF49113E7C96F80D6EC6F2D019A698230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ad4b136-d4b4-498d-8e32-01e21baff29d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ad4b136-d4b4-498d-8e32-01e21baff29d.tmp
Size 8KB
SHA256 224ef688bc7ec9ff27ca131f7087e07d1ed67cbe00cae96677c97badd71d4d3b
MD5 02308c8bbd21bb4ed429c8f7c656116d
SHA1 b16910a92da8acce9eff6296429561f4147b1638
SHA512 724277edc2e2fac805ac5ae1f2afb0b4812a80d1ab93c55ac1c306ba6ca3d6b047e18078b8e8e1dc64f03d95df0ded6a0a88132ab84b0677a06d140d8fa599b1
SSDEEP 192:EONY6nnHDQmiUyfw5YcX5hQDP1xjzor9RzX1x+24g3NYq5gU6:EONY6nVN5NX5+DtN8zX3+2jNjgU6
TLSH
T1F9121C31E8A8AC6B4EE3A595B08731136FE51127EA85AFC0D6EC1E2C01DE65C634DC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72c61116-717e-4867-9bb8-a04da78833a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72c61116-717e-4867-9bb8-a04da78833a3.tmp
Size 8KB
SHA256 d77e554f28cf745cee2851e7d7682bcdbd3ed4802ec8c1653494bede62e0f7ec
MD5 f9bfea108b87cd847d1b13220b6a1362
SHA1 92fb087ff8dafd9e57e7bd78dff235899f250b2f
SHA512 7cdfac680d6ef558fde1c5a740f20415bfa019c3e36d03e09daf860a0bac7215483847bdf53502dd846b685d55835f37b0f43d51edee5d0da3869bae0ab965b1
SSDEEP 192:EONh6nnHGQmiUyOwQYcX5hQDP1xjzor9RfMcN6wU6:EONh6nCyQNX5+DtN8DNvU6
TLSH
T1F402DD35A8A86C7B9EF3AD45B4873313AFD4217BA5956B80DAE81E1C00D765C2306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a7dced0-a638-41db-88fb-83160c763abc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a7dced0-a638-41db-88fb-83160c763abc.tmp
Size 21KB
SHA256 c26bbd7c4c4d2e237d13a09d0f4faae1db0adfc99db09141162b54cb544eca67
MD5 e9bb04be46cc6034bd892124feaafc31
SHA1 d61bce08675885a1c3dabe11f14d983d2a3a263f
SHA512 cb711e409557377faf60ff21bff0fb49cb6f9d7bab840840e45140156d68701e9eb12c282656cd8c26c06b206eb8d9b9e69cd35498e9383a7c61af92be0d4629
SSDEEP 384:vPiFiZcIgzsN38TUNTUlIlTv7cuijYbQX5+DtN8zX3+2aNjgVZh6DKhH0o+:SFQ8KwgB7cuxMkD03la1gfYGH0V
TLSH
T120A28D338898DC7B9DFBAB86F54732039EF45163D6C5AA80E7DC5E2D019A198130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97ceb017-778c-4dfa-91a5-88ba815aad8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\97ceb017-778c-4dfa-91a5-88ba815aad8d.tmp
Size 18KB
SHA256 548f6761c4099f4406ec8240f2bdb56ca38ea30ea8445362c2287da7be4e7c54
MD5 115d9388a124b3f4a58dd80382cd6316
SHA1 caa78f7d577a81d52a877d14897e65dbd71ae281
SHA512 71b7b0703eb57e316143b85b49645df8980ccf161fae810185327b5aec29f4dd436749daa7d926d19f97f1b794f9b8fb28fb177b2d7994292ba6bf3ee3dea55a
SSDEEP 384:/ZcIhsNtSv7cuijYbQX5+DtN8zX3+2gNjgVZh6DKhH0o+:Xhf7cuxMkD03lg1gfYGH0V
TLSH
T128828D3298789C774DFBA286F04732135EF49113E7896B80D6EC6F2D019A698230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

3730b2f3-f994-438f-aea7-faa94b58df8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3730b2f3-f994-438f-aea7-faa94b58df8f.tmp
Size 10KB
SHA256 fe47c5ae56604109097ea4282e283a16a089029f11cc0a366908f0a56d9e0527
MD5 763b4e6c3d889d7c1c23f3a716cdea53
SHA1 dc8dde6fc77d1c9e9c19de33bd5708252f6f3ef7
SHA512 8dadfc063dd2e5fb2130835cc0d24b2ba2741bf6d82cf059966a64f06a4a36b2327686eedfeff8b7cc7d1f42c00f78fb6cd245948c41eaff2f16f4506352ccfd
SSDEEP 192:sxZ2RfW8/fjsrsvUIdpHDHW6+WNGYYBwhp5Ig5lJ:sxZ2c8/fjsUNjHbGfwBx
TLSH
T19E22B851AE38697B8CCBE21DBB55BF53E6F9503251911E48AAFCC61C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66586cc2-fe37-40f7-a94f-f1de5ef47733.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66586cc2-fe37-40f7-a94f-f1de5ef47733.tmp
Size 9KB
SHA256 c2a898de334e62616e53a90de5f156c1b0a274c10d1bd7acb3ed8aec662557ed
MD5 c1fe93db4b1ea334eae3dd8903db49a3
SHA1 08d0cc31da2392e687f852adbe39cadf006a98da
SHA512 f16ea2cec49aa5961c6980f9aef28fdababaaa811c3988b6e79f4dbded61cca77696e6c71673da75349744bd72f6c1bf3e1cce62cd3cba67e57923af29ff04e5
SSDEEP 192:sxZ2RfW8/fjsrsJUIdpdDHW6+WNGYYBap5Ig5XJ:sxZ2c8/fjsmNdHbGfsv
TLSH
T17622B511AE38A57B8CCBE20DBB15BF53E6F9503251D51E48AAFC861C05E6ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8147a4bb-748c-478f-baf8-dd71d6526230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8147a4bb-748c-478f-baf8-dd71d6526230.tmp
Size 27KB
SHA256 0bc7760bfa3693077006ae1571253777fa59f9af1f44679e931f90b07dc0f2b7
MD5 26b10bfcd0c689f47a42ecad6a878266
SHA1 8fca9692a82f211b76801519a55fdde78f3bf7f6
SHA512 3f291594f926fc3e86cd2987e244449b0c553d1458cb4c908d3a8f7a705fd1d90b0b630767db767f8cf82372e5fec040645d1a05197ab96dc1c13d900b2c5dfa
SSDEEP 768:TgyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXsropUpr:TgyYR7jWv3NpBu1ja/CL8OX3K
TLSH
T151C2E93F644DCB7E4FC01A9DDC5A6F9B3E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97074470-95b8-4ec0-bf32-33e01882c405.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97074470-95b8-4ec0-bf32-33e01882c405.tmp
Size 9KB
SHA256 2d84ab545b9c4717ed55400c0988beaf9b555aa9739e10cc48680766fbc0d9e8
MD5 50d55f035d57e1e0e9858261a968918e
SHA1 bb381c87fffb410b34f136d9d24811d142fe6390
SHA512 803d24823327eff6a6c373ed3f6aaf1d15715d87e7cc8d9e024414df3900e43f4d0fd142a36a8aa2c074d64eb0bd94aa5c2b6a98c3a259a073885e79dc521a67
SSDEEP 192:sxZ2RfW8/fjspsJUIdpdDHW6+WNGYYBap5IgrJ:sxZ2c8/fjs0NdHbGfs9
TLSH
T1E212A711AE38A57B8CCBE20DBB15BF53E6F9513251D51E58EAFC861C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

987a6ca2-7cf5-4cda-9753-312c304506b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\987a6ca2-7cf5-4cda-9753-312c304506b0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 89c186c3aa42bbed60525060ac1bbcbc58f8da2826b11bb7eced2eee16553fb3
MD5 5fa944f1dac828a2ecb19aaa8209ef4d
SHA1 fa106adfc3105665c17745314f7bb7a04a5e2006
SHA512 0631cf01a3d5bec2f8be1ce7c6cfec428262cecaf8f2e2d00d8ec8ac3f24d8834ed04db0efaa4b50c99866d6524b2e77af564680f49b6d6376437537a2531f5a
TLSH
T1BA6192B490434157FB9840F0E9D8118B3EF0A5BD98838E16A5A6D277A86EF3BBC40CC0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e5777735039a3d755327ca285b58806cbf64e6d9299f798424502937d1743387
MD5 85d1ca4f78de8c7f9e7bc216c4a484e6
SHA1 3b5570880eb02c3b179ea8e6eb08e036a5318dc1
SHA512 ea43dc10cae43b351d9f01fdca267c4c3cc9b1ab85428488c6527e1a03e5a78717221d9cf9baf5951b1b6d83fa9f65c813a4a5bf0bc4992b665f80c462f6aa45
TLSH
T1BD6195B495434157FB9840F0E9D811CB3EF0A5BD98935E16A5A6D277986EF3BBC40CC0
MD5 SHA1 SHA512 TLSH

Submit Download

79eeb3bb-a479-44ad-8458-dd04567d3d00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\79eeb3bb-a479-44ad-8458-dd04567d3d00.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

046c99f2-cb85-4e44-b555-787f7a9dea98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\046c99f2-cb85-4e44-b555-787f7a9dea98.tmp
Size 949B
SHA256 4e08566a8aa6943429618f9d01cb8fa79c9b1009b7acab02bf25b29e76c0d990
MD5 94905c12e8cff7c8ae290672ae2d4cb6
SHA1 16dc70c22893f6edec29b590d524369657a3d482
SHA512 f285b896c0c9ea470099a568a350215a102f17a5dde8ef917042a9c42e290a87dfaaea0b21db9961c912f4c9a25b5f1e99a1a1250b5f55dff21290b5432b6eb3
TLSH
T166117DF3C3E585AE890156F0AA24AE1BCE2D0655422C7C1999D4EF6BD3E3075E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

cda07439-e683-426c-a176-df27e45ccd41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cda07439-e683-426c-a176-df27e45ccd41.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d1ecbc07-fb60-401e-8ede-37ea13e7ff13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1ecbc07-fb60-401e-8ede-37ea13e7ff13.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e64c507d376fd4f73c8fbece339f123b1c2c85b20e037f23c427bedbba9ed26e
MD5 17c7ee73bbdc2397beca05eaca1f2f89
SHA1 4e13829260606e16c588baaa0ceaf2fc56fd04bb
SHA512 c3990b54c304e01260df0c4a44cc43e007dfa6962a487ddbd724d218a5d281a634b6a3e089020eeb13df45f5fe9059e6a5d79ea214427ada9ea78c0b773852fa
SSDEEP 96:K40xCGMWyb5CXqjubK7ijIb30cPqSoqWP0geM8l5odYjIlK7UjyjeKMAGWn2:otl9d1
TLSH
T187914F40357E0A5038BD3A5842F8961B168230F33179E56F7BEC86E15E6EE009EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8d08093-6794-444e-8afb-43ccd5c00488.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8d08093-6794-444e-8afb-43ccd5c00488.tmp
Size 10KB
SHA256 7c545fa224613d7a4f753ba9516246600fe4f5534099043e7abd4bb62240c05d
MD5 611494ef26f307a1da1116078c990dc4
SHA1 12e757381ec9820be1a1582caa6868d0a016e01e
SHA512 4faee5052fbd5afbb7fa1a40bebe86d6bf57fa17f5a5de98aac6f7a21d16d3c38f474468bd2558d59a95ea01907d50dbc57f14dbb54e5f7859d36023132a20e4
SSDEEP 192:sxZ2RfW8/fjsrsvUIdpdDHW6+WNGYYBTip5Ig5lJ:sxZ2c8/fjsUNdHbGfTUx
TLSH
T11422B751AE38697B8CCBE20DBB15BF53E6F9513251D51E48AAFCC61C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6650b0e9-537b-4b98-aa6a-f11aec0a3bb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6650b0e9-537b-4b98-aa6a-f11aec0a3bb1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d63f5299-3047-4ac1-90fc-a3b4cf1a7d44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d63f5299-3047-4ac1-90fc-a3b4cf1a7d44.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 959d3d995b01ec711b0a0b8faf15738e2d5e4bada8cfa5adcc08331933283440
MD5 835793eafdce9db5c0ed09cafbae3f12
SHA1 e138507299a7fd2a5154a1f822fbf548a0c863b8
SHA512 f5fa2b01db35568cd409f013463e1ae1b6ddd2c087c515ab85b9a752550159912cccfaefe5b5d8ee5dd222d6997bad0b5e1fa50ee8c06d0cae35372393b13233
TLSH
T1D541075CA7F91148B3B76E5AAFF7A86E587FB9731F46946D00010E4E0662B40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download