ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-phqdssv1fs
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{F1416547-55AA-4187-89C0-BBD774958CCB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2808	540	msedge.exe	84
PID 540 wrote to memory of 1860	540	msedge.exe	85
PID 540 wrote to memory of 4028	540	msedge.exe	86
PID 540 wrote to memory of 4028	540	msedge.exe	86
PID 540 wrote to memory of 4028	540	msedge.exe	86
PID 540 wrote to memory of 3880	540	msedge.exe	87
PID 540 wrote to memory of 3880	540	msedge.exe	87
PID 540 wrote to memory of 2832	540	msedge.exe	88
PID 540 wrote to memory of 2060	540	msedge.exe	89
PID 540 wrote to memory of 2832	540	msedge.exe	88
PID 540 wrote to memory of 2832	540	msedge.exe	88
PID 540 wrote to memory of 2060	540	msedge.exe	89
PID 540 wrote to memory of 2060	540	msedge.exe	89
PID 540 wrote to memory of 2372	540	msedge.exe	91
PID 540 wrote to memory of 2372	540	msedge.exe	91
PID 540 wrote to memory of 2372	540	msedge.exe	91
PID 540 wrote to memory of 3008	540	msedge.exe	92
PID 540 wrote to memory of 3008	540	msedge.exe	92
PID 540 wrote to memory of 3008	540	msedge.exe	92
PID 540 wrote to memory of 1152	540	msedge.exe	98
PID 540 wrote to memory of 3184	540	msedge.exe	99
PID 540 wrote to memory of 1152	540	msedge.exe	98
PID 540 wrote to memory of 3184	540	msedge.exe	99
PID 540 wrote to memory of 4732	540	msedge.exe	101
PID 540 wrote to memory of 1796	540	msedge.exe	112
PID 540 wrote to memory of 3920	540	msedge.exe	113
PID 540 wrote to memory of 512	540	msedge.exe	114
PID 540 wrote to memory of 1524	540	msedge.exe	123
PID 540 wrote to memory of 1524	540	msedge.exe	123
PID 540 wrote to memory of 4732	540	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd07c8c188,0x7ffd07c8c194,0x7ffd07c8c1a0
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,13544305787836876232,9387238370300465211,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2304815117048858122,5966094132715572568,262144 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,12751283321549250820,12188836349797436553,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,8317129408424402595,1770120481284459321,2097152 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,17012553780750058367,1562403555038584057,2097152 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,16927817303117867220,11734696872498987109,2097152 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,7102319700317374871,12040779206406654335,2097152 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,5023416823171382648,1403826543209382971,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,17034894555767820160,1926271785862911201,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,17657412577350875449,6969941259285266738,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,17657412577350875449,6969941259285266738,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,2472974487590246403,16722741942437876883,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,1261171969772536023,8704426633803891619,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,1157591527278717160,8835142561631415510,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16810710717700191278,14235662157253092989,524288 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6068,i,9694606784479149166,15212105818707288184,262144 --field-trial-handle=2272,i,14992398421057586313,16889337684315102093,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

48f734f0-e5cc-4355-8ba7-b32d91e28747.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\48f734f0-e5cc-4355-8ba7-b32d91e28747.tmp
Size 8KB
SHA256 5cee0315646ce724b15575e0f282fa1aea67efc7be2146785243bee61f451ad0
MD5 9f2beac75506e32483c13b08f98176e5
SHA1 50b44845a672b97594edd4eb546d4746466e79eb
SHA512 7bd239f48db27b002d2a7296476da9fd5f8d165bbefd76aa8d364158778682fbb3cff60f9a6e63e553f81c7969dc5a5560021779553833b4b5be1c07f2a75577
SSDEEP 192:SONc6iDqQmiUyOUuq5u88PGquh63QuZgqUgU6:SONc6D6uq5u8iGlsXigU6
TLSH
T15012093178687C7B6DD3A961F54736239EA4423BEB886F84D5DC262C02EB59C170B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75c60fe5-8bb9-4901-b0f1-402a0542ca98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75c60fe5-8bb9-4901-b0f1-402a0542ca98.tmp
Size 8KB
SHA256 9568bc5cbe93e3e5991e59562ccbd84330874ffde39dc783019bca8e1689729f
MD5 80471885a5c737f4cfcb2532cb510122
SHA1 352063124e6ca171b58a2f07c95b24563b56d6dc
SHA512 246bd00ff60d34325cf0f9d383ab1f6c7a741fbcef3450081d2324de0be73aa953f7447a62558bd0698f3f60de94ffd7b775eca02b23064f6963557cce523c27
SSDEEP 192:SONs6iDCQmiUypUHq5u88PGquhMSqyVmU6:SONs6/HHq5u8iGlCTU6
TLSH
T1F902E8386C387CBB9DE3AE55B58777239FA4013BE6941F84DAE8162C01E769C1703936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5d2e3a54f03904bbe55eebd2e15796e5b26d6e7120a6693c971408f22102794
MD5 4656163abf32e5ab1a0774c2d3ffd3c0
SHA1 7bb2730f110962fe6a55dcf63196da9d74635fdd
SHA512 2096bbc1475260d24baaa9e51217bd19dd5edfd500aa9c96f8c9ec0510a31f436be7ca6a34af3ec2478245bbace0f09d84f152f56ad9a37ae2441e8f22301bc7
TLSH
T1C9D08094D4B47AF8F035313D5136450177CCDF96F603235A91454956C8501C309F1DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

0d51e465-991b-4505-8fe5-1ba6b361359f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d51e465-991b-4505-8fe5-1ba6b361359f.tmp
Size 27KB
SHA256 b867ddd32705047a78d1a17e37b603773114e9de290f1f4829f4b120e1df63a6
MD5 754cbfb2398f3d244b502b0dd234e603
SHA1 a1eea2d9d82aa3cf3ace8bbd63b66713fc617cca
SHA512 bceb09f2f2afa0d20010a9f128a62f2dec46eef56369b06dfc91a0e860276c0a010a6be9204a8f24e47c523f8a86ddceafe1386562d3ab6d8650d9f00ef6c6c5
SSDEEP 768:DoyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH38rolZRv:DoyQRbrWvvlpZu1jaXKLf33nlZRv
TLSH
T1EFC2F93B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79a3acc9-fcb4-445b-9ef2-e6b2e3f57627.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79a3acc9-fcb4-445b-9ef2-e6b2e3f57627.tmp
Size 9KB
SHA256 7e002c0180e28e7e8dcfa1bd4601199973a50273dd94ca761810a24604365e50
MD5 9a6766710e4e0128c8341d4a53754c98
SHA1 d56219f8ac8377d9d4e0b58e67924fae8f4772b3
SHA512 c209effd3cf7964bf2b2c27a87bb0b3a6531aaed191505fabc85811d1f5c405d71880a129db671e86d94a4223055b869b82f569c0cd4af046d0e9142a52e67c8
SSDEEP 192:sxZJeqRCWMU/fsBswFlu7Idpd+HW6+WNGYaQtIIg5GJ:sxZJeq7MU/fsBsSlukoHbGfw
TLSH
T10222C7556E28B97B8CCBE21DBB55BF43E6F9503291901E58AAFC861C09E76CD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c4628f5-d5ee-4afd-9e69-0abab92baec8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c4628f5-d5ee-4afd-9e69-0abab92baec8.tmp
Size 9KB
SHA256 e0280938302a76bd424298e011f13d63c2279c216ff5756a3f7352357da060f0
MD5 695b5d3f385b2debf12c1989e8c55c54
SHA1 f2d8679ab802dccf2a0aa494d4784d4c64d931dd
SHA512 35ef260d8e550d7a9fbe4efee1576de1d49e3422efc6dfef2991a99c91b7d82f52f157bc4cab6e7779f0a1bc100e21b1963e2c16073127d36b1c53101a78cf05
SSDEEP 192:sxZJeqRCWMU/fsBspFlu7Idpd+HW6+WNGYaQtIIgrJ:sxZJeq7MU/fsBsXlukoHbGf9
TLSH
T10512B7516E28B97B8CCBE21DBB65BF43D6F9503251901E58EAFC861C09E6ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91307bad-4f50-4203-8bce-5bd9a52676bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91307bad-4f50-4203-8bce-5bd9a52676bc.tmp
Size 10KB
SHA256 5b3fc7b9e75c8ca60ce8d5cc448c962c0d7f2d18151b2cc39815a0c34c804177
MD5 73dbc5967853aca5c81378754ba6175b
SHA1 bdf77a0f915746fd019d4ea3bc7af67658aa2c4a
SHA512 44ba8661e91d42cb8a595722d195f73d2e9d8a2d7f42903de91162bfafd393029d36ba23ef49bf0cb75963def576bb0dd8f45090c8ea9b1b2cd4d75ec631fc59
SSDEEP 192:sxZJeqRCWMU/fsBsw2lu7Idpd+HW6+WNGYaitIIg5sJ:sxZJeq7MU/fsBsFlukoHbGVK
TLSH
T17422C7516E28B97B8CCBE21DBB55BF43E6F9513291901E48AAFC861C05E7ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 943b5ce30bfe79f78b70da2926bd0cf727d645190c6dc24779657cc4f4fd5943
MD5 8721d06ae1ecd10121728727657186f3
SHA1 4a8bbcc1f36ec7c146723350d9daf6d483c916a4
SHA512 47ba984b1de3e8c662d88c57c7c962794a05c7a114c9ef8a0516055bd61321868cf957871624fabfcfc334afa8493b88f3e90ad5164c38179c1900bc4fdda0dc
TLSH
T187619182A74343ADFBAB603181D928CF3E35554A418B2F2AC5E4D234B8CF344AB1C06F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6da034d2a934bc570c9fe16722bcf32945763d78fb0d07d6387a21388c6ee343
MD5 ae56e0e52ec130225933babf0f31d0c1
SHA1 951205092651a034c63c9cf40cee1b61eaf74ea6
SHA512 1d16a613cffbf8680a682affbd52c2a157b271bcb14e8b0ddf589924686b417552dd763982640d6fd83d7322998714dfb48c2c609da0a204a30b79c53c5d90fc
TLSH
T105619282A74343ADFB6B603181D528CF3D31554A418B2F2AC5E4D234B8CF344AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

8431c102-5e25-4446-9cb0-ecebbcaf6130.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8431c102-5e25-4446-9cb0-ecebbcaf6130.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3394bc88-cd5e-40f3-b79b-22aa44105de0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3394bc88-cd5e-40f3-b79b-22aa44105de0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e805cd2b-b8cf-4ee1-908a-5c2c42bbb2ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e805cd2b-b8cf-4ee1-908a-5c2c42bbb2ba.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ffadbdb8-1063-4d11-9d45-b630fc7bccc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ffadbdb8-1063-4d11-9d45-b630fc7bccc3.tmp
Size 949B
SHA256 6f8409304578b4a89cdaadef49f98f529d6be0bb91144fd14bc1a884197b68e4
MD5 366b98ff460238220181eaf587f35810
SHA1 5463a2b1681d562f71266091a70185982e878838
SHA512 18a1ba0931b2f4185e945ce97ae3d3f72b583ca7dc33f088c8bb7be932d36867a2784194fb4b9241f9cbb433e1eaf2e74ad059a3446e30b0468d7d3ef5cd8408
TLSH
T18D117DB3C3D585AE8A0116F05A24EE2BCE2D0606421C7C19C5D4EF2BD7E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e400ad60f17da2e8cf0ef6b0b2902c1933ff56ccd2aa9c55b9e683d9edefeb2e
MD5 e4b5e24fda81dcb9119db71e63fd77cf
SHA1 4e5d3faccd0d5853c3858f5e798840c4444c7506
SHA512 c68ddb3939fad88a5e72a99ec2ff53c88777e5de6a63a6e5e3454e3e0690cac128672559f54a99d69893131c9d28a884c940f3874e6bc26a15090df83fda17cb
SSDEEP 48:K0b7b+b/bbblbdbdb+bbNbgblISb7b+K9bL1bJb+xbTbuYbIbZbrbfyLNsh9P7/S:KsAAK9aCK+wKva8cAKNSGF
TLSH
T1C091F45676771320387D3A5C44A48A6B958172B33418EF6BBBFC41628E6FE049CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1badffc-0ea8-40f2-9429-5e454ce52569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1badffc-0ea8-40f2-9429-5e454ce52569.tmp
Size 10KB
SHA256 5de54293f40677d313bd382d9500e91fe502fdb8e9851ebf6ff1d1cdc82232e0
MD5 c955b77234cd401dc8dca22e901e8ff8
SHA1 d01666eb71782975ab66e36b116c456f5a699e71
SHA512 56353d28dc0114f5368d46a6a755a03473d914a4d50d9f94ef4f9093450202c6e61169b835d2d51a7a643f19495e9e372beb332ffc7a91caed10b891a76f0772
SSDEEP 192:sxZJeqRCWMU/fsBsw2lu7IdpH+HW6+WNGYaGtIIg5sJ:sxZJeq7MU/fsBsFlukeHbGJK
TLSH
T1B522C7556E28B97B8CCBE21DBB55BF53E6F9503291901E48AAFC861C05E7ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db0ac5ec-b586-4222-93ad-056d2bec2f24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db0ac5ec-b586-4222-93ad-056d2bec2f24.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

eb1d0ac7-a321-49e0-bd42-699a713271ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb1d0ac7-a321-49e0-bd42-699a713271ba.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b73d021a-c775-4d84-8777-2ce1c289b9ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b73d021a-c775-4d84-8777-2ce1c289b9ae.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 45aeb298483e2375af7dce8e3bf034e5b1982e73050c8f6536b6324786128b32
MD5 42dd90b5fc9ce1c861776dcc6a83d9e4
SHA1 57f1cb8c2a42381332af2dd9886b24ab73a40230
SHA512 5dd4e06c90da0d4a9308ad97f0b3094ded22508016c8648b98a929bf0366123e45b4e88aaf8440808706d5e2b531b8fb28e3aa250fabee3ca4ba4a2865853480
SSDEEP 384:MZcIhsNpjoJvP4yp5u8iGlsfigtgOIwZOymLEXoN:ahrNQwkGlolXs5aK
TLSH
T1CD827C3258787CBB6CEBA551F58737034FB8816BE7C8AF84C8ED671D01EA598130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7ed6c87-10fa-4b11-9f90-561b294e5f24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a7ed6c87-10fa-4b11-9f90-561b294e5f24.tmp
Size 18KB
SHA256 15e3f4406328f6bacea62254a401ec051885b1802822926f2f4285d525ef4d25
MD5 3fd4491fec76db4161489c36c85089f6
SHA1 2c0dfc67ae088859e95fcbacf2ec2ae11fe7bda3
SHA512 76601b4fc8bc2b03e7b0661a3d9d01baaf72aee0e76bec358509b78dcec74aaf909127fbde9ac6371ce16ba961d6fec8ef98a79cac78778d41d0c5a3042fe668
SSDEEP 384:gZcIhsNpWoJvP4yp5u8iGlsfigtgOIwZOymLEXoN:eh+NQwkGlolXs5aK
TLSH
T10E827C3258787CBB6CEBE551F58737034FB8816BA3C8AF8488ED671D01EA598130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8ab68e2-bf60-4ec5-90de-52dbf665e6e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8ab68e2-bf60-4ec5-90de-52dbf665e6e5.tmp
Size 21KB
SHA256 b69c9bffb9e1a87f0ed6c9b185251c70d0145b6a39612cb76423f220dc18129b
MD5 10b1faa1eb00ab895e24d04860265d66
SHA1 c7f85cf666d045b51b9114aa4464e0ec3434bb6f
SHA512 f45ddaf49bdf5cd6be8e9c60520eea0178ac0692363ea5c1efda97e7fa920d9ee900516a5574881c84bb44a1abb6850e03fea7d119f21ed8d6d9963c4094e69f
SSDEEP 384:ziFiZcI9zsNL8TUNTUlIlWoJvP4yp5u8iGlsOigtgOIwZOymLEXoN:eFQFmwgZNQwkGlXlXs5aK
TLSH
T1BEA26B334868ACBFADEA9A51F68A32038EB48177D684EF94E6DD561D01E71D8130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

650ceb21-c071-44b2-bbd6-00d70186ebd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\650ceb21-c071-44b2-bbd6-00d70186ebd0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c4cf0cea69ac37223cb4ba4a3a92746a2a91ef50cbfffb7da0f3a7b87497e8ad
MD5 e4ffdee94ec53f573a8220bfb599d252
SHA1 b23a7e44379b35ec91b53b85a588e7fd96be7e8e
SHA512 b310027994a1191bcd60c273d6e835524bbc5d953efcf62af8b1339b27f813760973dfa05db0c98969fa0e8e81c840121c77005c0047d5716a859fdf7d90ee34
TLSH
T11741F65CA6F91158B3B7AE5A9FF6A8AD487EBD372E07C49D00110E4E0663A40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download