ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-lsmtwaxycs
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{050E4D1A-012E-4411-B392-DD0C6FCB4192}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3272	2752	msedge.exe	87
PID 2752 wrote to memory of 3040	2752	msedge.exe	88
PID 2752 wrote to memory of 1636	2752	msedge.exe	89
PID 2752 wrote to memory of 4068	2752	msedge.exe	90
PID 2752 wrote to memory of 1636	2752	msedge.exe	89
PID 2752 wrote to memory of 1636	2752	msedge.exe	89
PID 2752 wrote to memory of 4068	2752	msedge.exe	90
PID 2752 wrote to memory of 2264	2752	msedge.exe	91
PID 2752 wrote to memory of 4560	2752	msedge.exe	92
PID 2752 wrote to memory of 2264	2752	msedge.exe	91
PID 2752 wrote to memory of 2264	2752	msedge.exe	91
PID 2752 wrote to memory of 4560	2752	msedge.exe	92
PID 2752 wrote to memory of 4560	2752	msedge.exe	92
PID 2752 wrote to memory of 3792	2752	msedge.exe	94
PID 2752 wrote to memory of 3792	2752	msedge.exe	94
PID 2752 wrote to memory of 3792	2752	msedge.exe	94
PID 2752 wrote to memory of 732	2752	msedge.exe	95
PID 2752 wrote to memory of 732	2752	msedge.exe	95
PID 2752 wrote to memory of 732	2752	msedge.exe	95
PID 2752 wrote to memory of 540	2752	msedge.exe	101
PID 2752 wrote to memory of 5108	2752	msedge.exe	102
PID 2752 wrote to memory of 540	2752	msedge.exe	101
PID 2752 wrote to memory of 5108	2752	msedge.exe	102
PID 2752 wrote to memory of 4160	2752	msedge.exe	104
PID 2752 wrote to memory of 5064	2752	msedge.exe	113
PID 2752 wrote to memory of 960	2752	msedge.exe	114
PID 2752 wrote to memory of 4256	2752	msedge.exe	115
PID 2752 wrote to memory of 2304	2752	msedge.exe	124
PID 2752 wrote to memory of 2304	2752	msedge.exe	124
PID 2752 wrote to memory of 4016	2752	msedge.exe	125
PID 2752 wrote to memory of 4016	2752	msedge.exe	125
PID 2752 wrote to memory of 3676	2752	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffe4499c188,0x7ffe4499c194,0x7ffe4499c1a0
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,14778200675013910081,5371607790690478708,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,12217320901380012701,3017209524904686464,262144 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1805643505253358486,6088711028208141255,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17141724037081180317,3541188933133067733,2097152 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17735325910043800911,17488436571344424803,2097152 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,3925638701811642953,16150540874733617593,2097152 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,737453917842758377,4830203934187301855,2097152 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,3963008433918809502,12258558841399325964,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,16538512345651647455,6328517691965009975,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,4153772275401939180,2813205071594075025,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,4153772275401939180,2813205071594075025,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,11939067034332972034,3160694967309570858,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,836328393747846947,12556244228557179917,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,3238245007266541794,380839880121130362,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,18151250789710697805,5519049325268035168,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12836929136815201938,10513114163664510269,524288 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,16857865570498776069,13023443787642743314,262144 --field-trial-handle=2608,i,2039337182561343597,10494071644495418605,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

026cf3b0-f604-470d-999b-a674a7c6e5a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\026cf3b0-f604-470d-999b-a674a7c6e5a2.tmp
Size 21KB
SHA256 648fd7bacd8930696705247e8593af864938bd7f19280895045c235d670a6da2
MD5 67356689510229d31847b8e37e8bd591
SHA1 43d9ddfd14c2b39ff816a451312cf3938560d86b
SHA512 627108b25cb9f2e42d57ea2552e17d5a6aba270f3c68cc5a9899e2d99a9291bcf874245747f64221b50b9fe0bce56330b7968f990a54598897b80bb35c8e22fa
SSDEEP 384:piFiZcIUkzsNo8TUNTUlIlxRSVCiiUcyQX5+DtD8PXq+2tbztgOIwZOyxo0oN:AFQlVwgIXwxkDSqltbzXsP0C
TLSH
T17CA28D328CA89D7BADFB9785F68A32039FB45167D6C5ABD0E6DC5B1D01865D8030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9df68a6e-7393-44cf-a074-389cd03fe47f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9df68a6e-7393-44cf-a074-389cd03fe47f.tmp
Size 8KB
SHA256 a8495bf46ac5e4553c2c0b80f6286dc3bf25e40cd532dd431a8d5f63ec4ea4db
MD5 e37e8df86a2c74b5ee366a4f2a74a83e
SHA1 0e0a5ca7296c022b6531a2e0e8d05eb5da2c174d
SHA512 caf2446b1e7d6fda76914224f2cd441c0d7e81759d0cb9840ac6a2832c146586ea4bfdbf8c0a12ed7dc8c6ec702ff7901e902ef1bd9682ee398d7b671167d271
SSDEEP 192:EONR6nnH4QmiUyIVuYcX5hQDP1Tjzor6s1mkXIx+2Gg3Aq5zU6:EONR6n4DuNX5+DtD8PXq+2hbzU6
TLSH
T160120B31E868AC675DE3A585B48732135FE56227DA896FC0D6EC2F1C01DFA5C634AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

07e9afcf-f43a-4b21-9801-0fd4824e1964.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07e9afcf-f43a-4b21-9801-0fd4824e1964.tmp
Size 10KB
SHA256 a0b7c1cc463e87f5b2b47027154dacfa50a43a0ec2eef00a897ad26c6527c20a
MD5 7544d5ebc02c1f44c7e18ae2318c1ff4
SHA1 edd2ac8b6dc7125df98d2fdfa7fe7fd3fdd91340
SHA512 c37dc55924af2f0b03ccbffece9a0ecfaee96ceda7441775d6be42598c4a81c32eeeb228b6194f1766666941833f2fd772849515d11b51f1ef536335b26c77fa
SSDEEP 192:sxZWRtW4/fVsZRIdpdtHW6+WNGYYB0Y7HhIg5oJ:sxZWu4/fVsZafHbGfxq
TLSH
T1F422C8116E28697B8CCBE20DBB557F53E6F9503255911E58EAFCC62C05E7ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e1bbe2d-c526-46f6-b1e9-afada4482953.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e1bbe2d-c526-46f6-b1e9-afada4482953.tmp
Size 27KB
SHA256 045843cacfe6dc80dd7357b2f416b2f0df254cabc7dff825db9932fb4c9da0b6
MD5 79c4e7e9fb289cd3f8ce13e8c89dca12
SHA1 1f447bd5c7378e0f11483e88499d08f07d209171
SHA512 e5bf137c97d28735633086e553302aacdae009662ca2357b3d94716e719de5d40fe3a88438d1f0cde7f2ba97d6ed0876941da819b469c7631e437199af57bd49
SSDEEP 768:TgyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXsropqHi:TgyYR7jWv3NpBu1ja/CL8OX3f
TLSH
T113C2F93B640DCB7E4FC01E9DDC5A6F9B7E9802C796548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7403108b-ff6b-46a2-85cd-ccfa9671f287.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7403108b-ff6b-46a2-85cd-ccfa9671f287.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88f97e4a-f9de-4560-a017-9ce20884275a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88f97e4a-f9de-4560-a017-9ce20884275a.tmp
Size 10KB
SHA256 062f478cac4b94c97f3ec67788f83260605699275980d701bce7aeb3ce8996b6
MD5 33bc0ccf2cd3144484904d58b62b3cd1
SHA1 f82db3ea91a7e2a739f859f4116380c0c455f4b4
SHA512 6824e9ac4b9725dfda2a02296958ff3079eefc2b019d1df74ab9ad595dcebe6f6a4d98c456945da675e3c778623f970922d85d0f44d2ea74b7a8f3edd5152c7a
SSDEEP 192:sxZWRtW4/fVsZRIdpHtHW6+WNGYYBeY7HhIg5oJ:sxZWu4/fVsZaNHbGfbq
TLSH
T1D122C9116E28697B8CCBE20DBB557F53E6F9503255911E58EAFCC62C05E7ACE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fdbfbd517bc00a818fe6d41129b186e200a1793f7ed03beb123bf6afdd118353
MD5 06f65808538e895c4ddd32f7685f3e79
SHA1 0c42f81099b318ba74a47f7b4976cfae5567ff1a
SHA512 590999990fdb8e99900eab954e6f521501a60b6c3dd5be19e18edb5016c0c6c0558683edf79efc3700711247990bcc2d4ad73c20c1254b8b21e8b8b999a66123
TLSH
T17AE026E40ACAC22EB20864A70378A3DCCB80361BD3C0794E1748C988B48645CAAA77F5
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c6a31f8dfed19db1642f59142b7fcb3bd364c9755674c14acb2ef27656cc44fb
MD5 676de0a0127ad028108f04d4296c58fe
SHA1 70d8fbb64f9fc6ac5e905c57eefa3aec94a1fa8e
SHA512 5381c536fc575178331119990615491171378f6ef1b906bf0a5dc9b3ef3c81c4086565254abb10dbf70025a85307b62e4dcf1e6ec064badc50f6f4ee8bb566aa
TLSH
T1D461A4C055A3B448FBA8427881E9389F3E38258F55AF5DC29DB7E8759CCAB5C60F3244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c9555aeff669ea087961689fa876c7aee21488ed5165f8e93609e0c94235d695
MD5 96d99dbb891276e79d179ac7c6b5d5d0
SHA1 584f56d1b0f400a2f2a84d976a8f370d4c1c489b
SHA512 5e30fa98a521320927f63b18c055958cdab85352dd2a2971d1458ebe2f52745711f291891a71a632a7fb487d9e4a30dc446bc079c142f625eeca4211f14e3e44
TLSH
T13B61A4C059A3B448FBA8427481E9399F3E38258F55AF1DC29DB7E8759CCAB5C60F3244
MD5 SHA1 SHA512 TLSH

Submit Download

1fcce0f1-7a8f-4f0a-be74-a57ded1f8818.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1fcce0f1-7a8f-4f0a-be74-a57ded1f8818.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

958b27e8-7008-45ed-af22-9eaf13cb988c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\958b27e8-7008-45ed-af22-9eaf13cb988c.tmp
Size 949B
SHA256 e7f181c798e723ed57ce5a21b6750f248125df1e29dafb3fd6d76e7b49068c15
MD5 ffce74b3a7e34c71d922930a56853153
SHA1 f4f0217be6f914a0e40cc6feb1530429f1434164
SHA512 ec51398d438e872f92ca70fbc8ed55071a72d39f049ea45dccf2a7b55109d3f7e63a855960689eb6bf1675a609d821322745e6a93ee05a211f509a3710d2f636
TLSH
T15E11BDB3C3D5C5AECD1556F05A24AE2BCE1D0606421C3C1989E4EF2B83E3475D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

be37210c-51b2-45ae-8231-359c975acea3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\be37210c-51b2-45ae-8231-359c975acea3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

daa87004-1189-4584-9ebc-e69ed1e2c014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\daa87004-1189-4584-9ebc-e69ed1e2c014.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2b3caa2fc45150a812af9d860a62b2b7d38419aa8d8ad10aedb63c3f14906f7c
MD5 1b2ce36c6b20ae6ce487d8b1edcb0b20
SHA1 be7c8ef8ea6d78553bc7840b98c30a7ba8cce2ce
SHA512 79d47e7023c72caaf7db20713c06467d8d88c09df2b76232dbee1285ebdd98927c4275e455e85d91ca973b51d456247cd637326451affbda877b1d794b737bdf
SSDEEP 192:sxZWRtW4/fVs4RIdpdtHW6+WNGYYBaY7HhIg5CJ:sxZWu4/fVs4afHbGfnQ
TLSH
T13E22C7116E28757B8CCBD20DBB55BF53E6F9503251911E58EAFC862C05E7ACE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fb3861aa814f964f2004ae5ef1b37c626422b9dd202fa5cc40449b79a1e4335e
MD5 fb8fefaec26c7fe4b30a783591360f8e
SHA1 b58b3bbdc52c1d78656387486884be1a076ba03c
SHA512 660159d390a8683712ab5b2588ed0fcdfcf74ba79d709ea33be9c92fe79470a113c8b24cef5a8e914b785af7e9f33bf08ad41866225e8d8947a050dd01f265a1
SSDEEP 48:KgRAthrvzMb/KXIS5MK9Z1zMxxcYKbRVyLeZ04WcMFbwX4ISQFK901GFx+VYvws4:KAWEKXKKWdSK2gKScgKBuCP
TLSH
T1A5917250767F021539BE254D52A9A71B024231B3B02CF57BBBBD41A59E2EE044CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd98f668-a5e6-4687-b99a-9c8c6d6208ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd98f668-a5e6-4687-b99a-9c8c6d6208ed.tmp
Size 9KB
SHA256 9807ecee688b94796c18a093b8905b090c388809144a81ed3bd3c60999c2eef5
MD5 719e007144a84bfd29edef46ee73f14c
SHA1 27e0d5bc3f1599aebef02e25d1e8686201d20648
SHA512 0354d33f8b68a548a9e18be6020220fa7fd2a58cc09f10cbd985b800ea69b305227b6d98f85a481626d2aa370f025f76a47f60c2dce5a9d9fd62b4110d54a7e3
SSDEEP 192:sxZWRtW4/fVsTRIdpdtHW6+WNGYYBaY7HhIgrJ:sxZWu4/fVsTafHbGfn9
TLSH
T1BF12C7116E28B57B8CCBE20DBB557F53E6F9503255911E48EAFC861C05E7ACE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d5c5e850-c883-43b2-90c8-092537874881.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d5c5e850-c883-43b2-90c8-092537874881.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1d23945-b513-404a-bdec-38d4b1654e62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b1d23945-b513-404a-bdec-38d4b1654e62.tmp
Size 8KB
SHA256 d947c6359a6ec9e56794f272862c26ccdf04a3d5a8c1db9ec62e5291b9a14678
MD5 a1e27a248a51cc05e32e44c2d48698e7
SHA1 ae0c201510809cc426015dcef60a5630fcb03068
SHA512 6d6979e18d6bd0fac091c586c5fdb4338762219f206e553a071000e96ee1be111528f9bf0990734c1db72223be3c84d4fdee28274af21a326ae5dae46af98a74
SSDEEP 192:EON56nnHGQmiUyJVQYcX5hQDP1Tjzor6s1mmMcOlMU6:EON56nCkQNX5+DtD8ZkMU6
TLSH
T10002EC34ACA87CB78AF7AD49B58737135FA5216B95942FC4DAE81B1C00D765C2306D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1feb5cc-50ca-474b-8c4b-9fc37d100d52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1feb5cc-50ca-474b-8c4b-9fc37d100d52.tmp
Size 18KB
SHA256 f93fe3d36a94b9da0b8a3f5099f404a9abf11780811a20a525639b2261c4f992
MD5 d13f14ca3ae769161ed5c625a6fedd73
SHA1 449363f8574e9868d35b315e75ed5d73bf9a27bf
SHA512 ac69fadc298c9c183bce83285d2dc313efa640b0869f73f07d108ef7096b9b70612c823cf1ddee8024197efe023777b011c5f27eece841e74bf0d43e8489b601
SSDEEP 384:iZcIhsN4xRSVCiiUcyQX5+DtD8PXq+2nbztgOIwZOyxo0oN:QhSXwxkDSqlnbzXsP0C
TLSH
T13B828E319C786C775DFBA185B58632039FB8A127A7C56FC0D5ED6B1D01CAAA9130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8fa3d47-548a-4061-a54c-66e0ba6f8de5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e8fa3d47-548a-4061-a54c-66e0ba6f8de5.tmp
Size 18KB
SHA256 ce1f67b1d1821796927c9b66983e1570b6b905b8f57dca7259cf0c9b7303ae91
MD5 a12990c3f557a4ed00ecbfcf978a15bf
SHA1 63929a8675f8b4b45848e8b7d2951fb6db4ebcdc
SHA512 234a72663040ba1ea7465951c864792c3a5b906e23be2a9063719b95a63baaba4936e18846f5d724bba4138249a37fbe4657e661d15547229c48cc0ea89187ff
SSDEEP 384:LZcIhsN4IRSVCiiUcyQX5+DtD8PXq+2nbztgOIwZOyxo0oN:Th3XwxkDSqlnbzXsP0C
TLSH
T10F828F319C786C775DFBA185B58632035FB8A127A7C56FC0D5ED6B1D01CAAA9130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14ea0882-782e-4fad-8bd0-e6ecff458ed0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\14ea0882-782e-4fad-8bd0-e6ecff458ed0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3185bb430ad081bf71d4064100fb5c06011f97bbf75805cf43912f8e3968a2a0
MD5 2a8e7ea5d4ef663cc96868e27567e8f5
SHA1 fcfe95eda1f082c79ed8b67f41a533e73edf01dd
SHA512 3e1fa3d7cfba66a35e202c3be57724f6e53c578dc346cbaff88fd9cd46488c76a57eadaac668c725138648b18f481f1eb1bf33e1381ec721b03a68f865a324d4
TLSH
T102412958B6F91108B3B3AE4AABF6A96E447B78732E16D55D10110E4F0A22F44C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download