ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-phqdssv1fs
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4508	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{A7A92618-9AF0-42E0-8113-3A6A236C1F5E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 4540	5868	msedge.exe	89
PID 5868 wrote to memory of 4508	5868	msedge.exe	90
PID 5868 wrote to memory of 5060	5868	msedge.exe	91
PID 5868 wrote to memory of 5060	5868	msedge.exe	91
PID 5868 wrote to memory of 1868	5868	msedge.exe	92
PID 5868 wrote to memory of 1868	5868	msedge.exe	92
PID 5868 wrote to memory of 1868	5868	msedge.exe	92
PID 5868 wrote to memory of 5428	5868	msedge.exe	94
PID 5868 wrote to memory of 4056	5868	msedge.exe	95
PID 5868 wrote to memory of 5428	5868	msedge.exe	94
PID 5868 wrote to memory of 5428	5868	msedge.exe	94
PID 5868 wrote to memory of 4056	5868	msedge.exe	95
PID 5868 wrote to memory of 4056	5868	msedge.exe	95
PID 5868 wrote to memory of 4204	5868	msedge.exe	96
PID 5868 wrote to memory of 4204	5868	msedge.exe	96
PID 5868 wrote to memory of 4204	5868	msedge.exe	96
PID 5868 wrote to memory of 4788	5868	msedge.exe	97
PID 5868 wrote to memory of 4788	5868	msedge.exe	97
PID 5868 wrote to memory of 4788	5868	msedge.exe	97
PID 5868 wrote to memory of 1532	5868	msedge.exe	99
PID 5868 wrote to memory of 2444	5868	msedge.exe	100
PID 5868 wrote to memory of 1532	5868	msedge.exe	99
PID 5868 wrote to memory of 2444	5868	msedge.exe	100
PID 5868 wrote to memory of 3080	5868	msedge.exe	102
PID 5868 wrote to memory of 460	5868	msedge.exe	106
PID 5868 wrote to memory of 3512	5868	msedge.exe	107
PID 5868 wrote to memory of 1468	5868	msedge.exe	108
PID 5868 wrote to memory of 4220	5868	msedge.exe	109
PID 5868 wrote to memory of 4220	5868	msedge.exe	109
PID 5868 wrote to memory of 3080	5868	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff95fdcc188,0x7ff95fdcc194,0x7ff95fdcc1a0
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3065996705175139323,14955954725220438756,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,11920769632450367692,2371292374922326350,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:13
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,10947607570486529453,5062310544322079120,262144 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,13681478843147763768,11073806422953697171,2097152 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,12210260062411619769,6834687709087496638,2097152 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,3199662241799239245,2105283750331630269,2097152 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,13016442967383900235,9405685400414411162,2097152 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:9
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,15228042442502421578,4815900440177469050,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,894023944891827842,11824495182948085634,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,3318871770912641594,2726716949451087427,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,3318871770912641594,2726716949451087427,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,10160680665202364032,17580418919021057390,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,8744193292414221991,7698353423132183610,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,17307692701730172563,17281522479548348537,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,8839174843214384840,1308179110904902807,524288 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5672,i,427966844865807157,2357504799855056901,262144 --field-trial-handle=2872,i,7261937831396875243,8261393764361396453,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04c1d4f5-f004-47d9-9c6d-abd49c91fd6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04c1d4f5-f004-47d9-9c6d-abd49c91fd6a.tmp
Size 36KB
SHA256 335f7acfcae64edda8fbb6600d8566e9f4f6b6a292539be328a91f00fdefc65b
MD5 4f069b3e2e95ead87da1924ea94b74dc
SHA1 2796bbd550fc32c7cb7ff9d4be71a7a2443a8d9f
SHA512 69ef49029880c7ea72fec657356dbe689e6823234ffcc14d390abb04ffbc36706acb1a2b94a2fdcba619e21b8a27b6faf54a806d3dc6be411a47e99c172b0db7
SSDEEP 768:AFQO3RwgDUrSO5pgYKIMIYNa8S5oYklnA+B4YGH2KD:zO3T4gCTWRdA64YU/D
TLSH
T1A703BF3399D4D9B79CFE97C5F6067603AEF44263D184A9E4DADC2A0D118B2EE2303C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cd1ce25-cbee-4cfe-b30c-fb0e6eeb74b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3cd1ce25-cbee-4cfe-b30c-fb0e6eeb74b0.tmp
Size 34KB
SHA256 975dada735111371c92cdde0222c224ab1b7e9ee91645d80403abbf86dd77bab
MD5 c3da9b6f511cd540a5a850533fe0457d
SHA1 2efb14496982dbae17c5ea357135500d65534ac8
SHA512 a2c797671e639e9d3f22ab4a57489cb2428cd5f0e9a6e5267f712a3f8741e97525b15df8780224b4f094c2a98887d1e6dea81fb229346d2fdf681cde9e56f893
SSDEEP 768:l03hUrSO5pgYKEMIYNa8S5oYklnA+B4YGH2KD:l03h4suTWRdA64YU/D
TLSH
T108F2BF36A9A4ADB39CE993C5F20676437EF45223D1885DD488DD2B4E15CB7BF2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f8e31f4-5caa-4b38-9d1f-e2158ec956ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f8e31f4-5caa-4b38-9d1f-e2158ec956ef.tmp
Size 40KB
SHA256 2a1856b3f8e36e4fd9b213a9bb3833461b0b7176c47d9a893723939f106c7429
MD5 f119985e078c3f90f622b85e50656145
SHA1 a7bba5358a6845170d902b7754977f10ef135aae
SHA512 3cb08ecc96e0e380314f8d655072a9a6eccd9aaac603e3a6b58e0118672c96c7391273a34046a7c0b61d13d543a851f698f6c553d404fe70b0ad0d312002d196
SSDEEP 768:5H/UxvxjgC+d3iorSO5pgYKEMIYNa8S5oYklnA+B4YGH2yA:IZj3+d3iksuTWRdA64YU3A
TLSH
T12713C036A8A47D739CFAA3C4B20A6783BEE45263D1855DE849DD1F0D06CB3AE6303855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99b6f47a-60ba-47ae-be7e-b6f1bb581260.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\99b6f47a-60ba-47ae-be7e-b6f1bb581260.tmp
Size 38KB
SHA256 d4044dd71c9f6f4f1b38dbb1f0703f30c770d5af39c1bb251eb2d62fabfd1dbe
MD5 1576d02f84282f3e03775ebf5a97d88e
SHA1 90d712a44078993d43b4053f9638154ec4c3dece
SHA512 b5a14f43d7b44c81bd862d39a57d1fa3179aeee3eae4f0636c8a85b8990e0fbe914929cbb86d7c64618c263e1f1ac23562378ea8f2736d33ea90bf333c6e6d74
SSDEEP 768:do/UxvxjgC+23MfISO5pgCJMIYNa8S5oYklnAa6SH8L4:nZj3+23OQTHTWRdAVS04
TLSH
T15F03C03AAD946D738CF663C4760AA747AEF55263D0C169F88AEC1F0E16C73AD5303852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

1d45efd5-4306-4ea0-a1f0-7dab34a7ff5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d45efd5-4306-4ea0-a1f0-7dab34a7ff5e.tmp
Size 11KB
SHA256 86f4d575687ee5893cd38053ba549cf8f8275524c1b08b198bd374888fcd4963
MD5 869c4ba84cdee1c9282020872ec202e0
SHA1 92ae8fcc910fafeaf7c87ec54c6adb2d7144a917
SHA512 dcd0e4fca781680f980abcb6a16a6a2e0b32c2c6f396799c25a9bf5f5b43a1ff983b0667dd42a4286001be3e3eca1fb2bbaf8de12f361df02a9a2b315b24c068
SSDEEP 192:sxRyRxbb/fXsYCJzoA8p4i/g6+WNIYuRGtGDkIgDCJ:sxRy7b/fXsdUT/5I8C
TLSH
T12232B7156D28BD7B8CDBE20DBB55BF53E2F95132A0911E48BAFC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25f405f2-2ec3-4ac0-98b1-ade30990da10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25f405f2-2ec3-4ac0-98b1-ade30990da10.tmp
Size 10KB
SHA256 bf68c9e24a0df0e6a217d2c19ae38aefb610782a447d8b526cbae470db57b60b
MD5 c6f41b00242cf3e986aacc55a81e6cce
SHA1 8711b9d4d25788f8f0cfc46268f983cfba7caa5f
SHA512 dd7f7fa0511405e4e42fd350a9405059f3297874aa1f23aa8cf1e3d063a44d0a0a54fe05e8915b19fdfeff3b4df78a0727f2b332b2e41b60c0ae2f84c4831ec5
SSDEEP 192:sxR9Rxbb/fXsbCJzoA8p4i/g6+WNIYueGtGDkIgIJ:sxR97b/fXsOUT/5Ivs
TLSH
T11F32A8156D28B97B8CDBD20DBB65BF53D2F91132A0911E48FAFC951C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

294b6a9f-9f77-4d96-8393-06f291eb1cb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\294b6a9f-9f77-4d96-8393-06f291eb1cb9.tmp
Size 10KB
SHA256 d3827b60007063e40d09cc4ff1a63b0eb66f9df3c78187f78d3d0d1b830556eb
MD5 b620c2744236de1f73e95f0e590c1930
SHA1 b9ca9b7be637e5d3351d388cf613583416862ebd
SHA512 2c7ab8fef64673d0017cbc16be0469a9f2ec4a519b4cbeffa20e9bcbe658a57e00279c88701b6d6ce4754b9d77fcfb560556e8b850741ea9455c82ca923aae96
SSDEEP 192:sxRyRxbb/fXs5CJzoA8p4i/g6+WNIYueGtGDkIgDgJ:sxRy7b/fXsIUT/5IvI
TLSH
T1E132B8156D28B97B8CDBD20DFB55BF53E2F91132A1911E48BAFC9A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

611529e4-cbd7-4c04-84e7-3fab5ab336b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\611529e4-cbd7-4c04-84e7-3fab5ab336b4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6244d4b7-1970-49de-a00f-e667c3d6924f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6244d4b7-1970-49de-a00f-e667c3d6924f.tmp
Size 23KB
SHA256 b6e7475472ca89499f03d28bea7eee83fbb9e0a55bcdfdf7a758588af54247cc
MD5 2e8788d7acbe74398b1ff623789447cf
SHA1 5e067b86aab12029175464e1542aa1518bd3adaa
SHA512 370cb52c84820da2ff09baa4660ba4815802ab3abe0bef34417bfa82fd1f1a67af3fee0ef105ab55c8705b54076b3b3984d3916e0a6866be220b0f0613a27000
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6rrocbe:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0Vu
TLSH
T1B1B2EA2B644CCB7E9FC00AADDC196F976D9C02C796A88D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 37db2d4199c4f4690654409ad174d980b502cdf4977623d208eb908e8b22301e
MD5 4ba5bf10b77b8a1cf28177e8b218cc87
SHA1 fbc021052e5c494da62fd2b6c55bdce29e264300
SHA512 001d151cfc208d6591420a7f09088a80be342ee629e8d2d33eaf89269876dba1a582619bef35f94a21b51f3640c1a762c0f9fc321c5620f62ef41afdb5fc1d21
TLSH
T12841E7486B60819FF798F1F3B6D00E87F6B4CA8259CF1E1105B4C1BC5A0D3D601B6034
MD5 SHA1 SHA512 TLSH

Submit Download

5ae56ca7-107a-46d9-9d1f-41596297b6a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5ae56ca7-107a-46d9-9d1f-41596297b6a7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

41627814-dcda-44a0-8c97-d32ba8fcc975.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\41627814-dcda-44a0-8c97-d32ba8fcc975.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b3a1d08b-790b-4ea5-ab88-50a2d34688ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3a1d08b-790b-4ea5-ab88-50a2d34688ae.tmp
Size 2KB
SHA256 fc3a5cfed6d2d9383ba268dc2af4ae684e1bf65d18e5fa1004cda077bba8b39d
MD5 037e11d19dcfcf23394f74184bb649dc
SHA1 563fc333e8c4714b31d9156eccdddb25ea4d27d7
SHA512 6cada25ab74dd1f5106eafd6ad006c794c6cc9bf89fe2e102709c261d08ba426305c1470734037daccb7001e47d8c3d6e94f153694ffa9d0d40d6431cc8705bb
TLSH
T19D419FF3C3E8867E890156F4AB146E1BCE2D0915432C7D5AC5E4AE2B93F34B1E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

d330df7b-c1e5-4359-9e69-fcc4669c5e56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d330df7b-c1e5-4359-9e69-fcc4669c5e56.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d0acc9544f9fa68d6a2e4b7d16a99b144cb20b98615b7091f8baf6b0b648dacd
MD5 a97ef33cdf7f9440ea61221ca971b8a0
SHA1 746602b5c81b21909cbe366cfbc9b85ca51afbdb
SHA512 bbe70b17868d57793f6e005d87f8334f2881d9acc5fc8f4411e9ff5d5edd642b7a940e32dc6c625251928503334b4e28fe16ce5e1ee310833ec434c9b550e8f2
SSDEEP 48:KTs5IMCKK+Ma3lIFs+KqLy++WUu/Pu8fyFhIRKyMM2KInKDmgOaw7tgCtyUqf2aC:KQXSKAce2hiKyMJKMKDj65qf2acH
TLSH
T1AA914469743A2254383D360C90EBA65A464171A734ACEAAF3FEFC0518E7BD045DBC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bdc80bac-8e88-4028-ab7f-447901993ac9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdc80bac-8e88-4028-ab7f-447901993ac9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c04e269c-8aee-4c55-aa8f-482201949de5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c04e269c-8aee-4c55-aa8f-482201949de5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af3c4d37-3f47-4a76-9af0-92432253d281.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af3c4d37-3f47-4a76-9af0-92432253d281.tmp
Size 34KB
SHA256 7d9d99b245a028ca7b44cc293cfbc1483d12b5d6a255b0d09ee5ef25585f4537
MD5 16b5530408b9f9a4bc1c1ca89d39e75a
SHA1 cfce7a66a7d8ba0554b5d5490aac38b73aeffece
SHA512 0e312a4cca78bec2084e7ca78b7bc74ce216f6e0d42ab16ac35ebd2d18599a4e48ce488b37cc07d4f4761a00639d47faf4c35fa9000ed7e4a8445a1c998344f6
SSDEEP 768:5b03aUrSO5pgYKEMIYNa8S5oYklnA+B4YGH2KD:Z03a4suTWRdA64YU/D
TLSH
T1E4F2AF36A9A4ADB39CE993C5F20677437EE45223D1885DD488DD2B4E15CB7BF2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fc33160-fa90-4915-90ca-a5d5351772de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7fc33160-fa90-4915-90ca-a5d5351772de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download