ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-pm674sty4j
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{BC36749D-5D41-41FB-9CF6-1FB68EA9E664}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2324	2016	msedge.exe	86
PID 2016 wrote to memory of 816	2016	msedge.exe	87
PID 2016 wrote to memory of 1764	2016	msedge.exe	88
PID 2016 wrote to memory of 4980	2016	msedge.exe	89
PID 2016 wrote to memory of 1764	2016	msedge.exe	88
PID 2016 wrote to memory of 1764	2016	msedge.exe	88
PID 2016 wrote to memory of 4980	2016	msedge.exe	89
PID 2016 wrote to memory of 3984	2016	msedge.exe	90
PID 2016 wrote to memory of 2644	2016	msedge.exe	91
PID 2016 wrote to memory of 3984	2016	msedge.exe	90
PID 2016 wrote to memory of 3984	2016	msedge.exe	90
PID 2016 wrote to memory of 2644	2016	msedge.exe	91
PID 2016 wrote to memory of 2644	2016	msedge.exe	91
PID 2016 wrote to memory of 3284	2016	msedge.exe	93
PID 2016 wrote to memory of 3256	2016	msedge.exe	94
PID 2016 wrote to memory of 3284	2016	msedge.exe	93
PID 2016 wrote to memory of 3284	2016	msedge.exe	93
PID 2016 wrote to memory of 3256	2016	msedge.exe	94
PID 2016 wrote to memory of 3256	2016	msedge.exe	94
PID 2016 wrote to memory of 3828	2016	msedge.exe	102
PID 2016 wrote to memory of 3828	2016	msedge.exe	102
PID 2016 wrote to memory of 3576	2016	msedge.exe	103
PID 2016 wrote to memory of 3576	2016	msedge.exe	103
PID 2016 wrote to memory of 2648	2016	msedge.exe	105
PID 2016 wrote to memory of 1248	2016	msedge.exe	112
PID 2016 wrote to memory of 2216	2016	msedge.exe	113
PID 2016 wrote to memory of 2028	2016	msedge.exe	114
PID 2016 wrote to memory of 516	2016	msedge.exe	123
PID 2016 wrote to memory of 516	2016	msedge.exe	123
PID 2016 wrote to memory of 3952	2016	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd0022c188,0x7ffd0022c194,0x7ffd0022c1a0
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,6134639572357346358,5806118995526679924,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:3
  2⤵
  - System Time Discovery
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,7614699055223314977,10641743735842286232,262144 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,2595987151913508022,16809518081081957612,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16436686548008095203,13433308293058203995,2097152 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8504196836554402211,16006079932610815455,2097152 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,10159936252846003587,8816453720028018926,2097152 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,11447017958560766202,3429408284647450024,2097152 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,11892283428922271425,7152171356413260656,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6246687723985937365,9201683898114208626,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,14879461339742805651,8764996788881585128,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,14879461339742805651,8764996788881585128,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,13296914988479631363,13474171283832199880,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,9746487543003074600,7879017055937375581,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,10595837731837677745,11006419307162197685,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,7329574636220368232,8775123695740097234,524288 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5912,i,14316993143331421511,9335328766428590078,262144 --field-trial-handle=2900,i,10813353652986604806,3178937689943755897,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6bedc002-8985-41b9-9e59-01701221b108.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6bedc002-8985-41b9-9e59-01701221b108.tmp
Size 8KB
SHA256 ec8be36b4353736073069d34f8a481192d176db596eebe53cb8cbbb25d7dc7d9
MD5 81192ee1482874a9666cb56ce94c6776
SHA1 3e54144c86994531d86f9b4a8bebe3017275b8a2
SHA512 9d59e10ec2bb82a9f9f88ce32565b8d321100498bc5c532015597390fd25969d1d33ad253a2266fe943b3f71af887014926b23d771205101c27ed9559d3db17e
SSDEEP 192:1ONf6wlDgQmiUyMUW4X58gZMOKoAaDlZqnU6:1ONf6kgYW4X58EMOzAqMU6
TLSH
T1B702FA35B9687C7B8EF2AE09F58B37139FE5102BE5552F84CAEC1A2D00D765C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9da839f4-36ea-4e49-99e5-f7aceaa24dc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9da839f4-36ea-4e49-99e5-f7aceaa24dc7.tmp
Size 8KB
SHA256 2a05e612844de2f0063929b5214a11cdc9b01765ae88b16a10d1e654f7fac239
MD5 ce6a6866aba980b3de380f4891e39a89
SHA1 ba1154d80cd69650806fb952209cc4b5ede1fb3f
SHA512 ad4e44d9329e4ca0b39e3ce1cc18c8f86e29bd524bf4da256368d4e68a87f89e3b67331f500622caed392052223b149b8b68aef7eb62d1e9a59a6be7d13a7aff
SSDEEP 192:1ONc6wlDxQmiUyjUp4X58gZMOKoAAOverqoU6:1ONc6kPxp4X58EMOzAAhXU6
TLSH
T1BA120732B8A8BC3B1EE2A545F58735039FA95127E7457F90C6DC2A2C01DB6AC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

51282189-9e4a-47a1-be8a-3b04b3df6670.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51282189-9e4a-47a1-be8a-3b04b3df6670.tmp
Size 27KB
SHA256 66f90c6ded19e954c73752b068dc610dda812c35a405bbb87fe74333b1b0d4aa
MD5 f90f5240393765afa53141bdb5fe39e4
SHA1 4933b007613bec050321ff04d8477d8b3a7fcade
SHA512 55d7bc565e4c5e420194fe37af9be8f1d9370fee6c5388c1eabcec3f07e725f1a05736d928fafe45697d8e93ca9d41b41594892b473a54ee901b22a0dccef88b
SSDEEP 768:ROy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb7roRY9:ROy4J/DWvbtBhu1jajiLm0bIm9
TLSH
T1ABC20B3B744CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69e21b9f-7ae3-48c3-9ace-ff2bfefdca6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69e21b9f-7ae3-48c3-9ace-ff2bfefdca6d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ec28aca-a639-40a1-864e-d4002b7b7949.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ec28aca-a639-40a1-864e-d4002b7b7949.tmp
Size 10KB
SHA256 e64b52367f0da32f7ff7e75cca996b45d97e653732148f4f59cfde597118522a
MD5 9f65524d55f527f6c1d368614ac79301
SHA1 e441443c5aa239e6ab94a35c3a44888e5c60aafe
SHA512 cc47389d76e383bb97d09c6b03091bc7ac215d9b79eb08b66c982943e195288e47ebd7bc8f5ad7a30bcacbf0a3573dd379433799fec5fa2d1f4c45db5ac4b189
SSDEEP 192:sxZRRuW1/fasrDngIdpd/HW6+WNGYrIEZIg5RJ:sxZRv1/fasXhhHbG4t
TLSH
T1E922A8526E28B97B8CCBE20DBB15BF13D6F9503291951E58EAFC861C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3166fb6925f35ca6910f68882142a6ab116ab4d0a3d1b24c2a22255782b14041
MD5 ca7c3027c9c7b291167e2d1069b6e63d
SHA1 d19855aca6d2e8087354f4c5e757b1d81b3b5442
SHA512 6074727ead4cc164c3d0a6d0cd59d530a8532460616d6a7286e6016ca70cf614fb442be8f492b7dc6db43565c768c53cd14a8c33f3fd153ded9cd917d40c763c
TLSH
T1EF611C88DBA0407BFB8AA07092ED108736FD408E57AFDF5A12F8ECF95F4A3617044114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2f58942b9d1fa13bfafc2d432378322ed26ef90d841dde65f0679c0ed30680d3
MD5 2fae86ef9e7c4d287ad7d0fa42fe8330
SHA1 887f3cde1d0819b9caafa06bf3d312577ffe4f3e
SHA512 a3b24d34124aeb2dbe7c5b036033c6189526b28b51545e60132826a5f8e8925d0e0e057894380723ad1aae2b7a12e9182dd52f94117beb3f550f0b77265efd6a
TLSH
T1F6611C88DBA0447BFB8AA07196EC108B36FD408E57AFDF5A12F8ECF95F0A3617044114
MD5 SHA1 SHA512 TLSH

Submit Download

885ca554-b5f4-49e2-992e-04b2dd6222ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\885ca554-b5f4-49e2-992e-04b2dd6222ae.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3a473be9-9507-4204-8555-a21771ed69ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a473be9-9507-4204-8555-a21771ed69ae.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

5812d986-7dad-4f3f-a753-39a9407bcb71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5812d986-7dad-4f3f-a753-39a9407bcb71.tmp
Size 949B
SHA256 2fa8b7e1bc0bcd2419e15a2f43fee460fab9c47053e49377c2e8126e8ed38750
MD5 866ffa65d337110b71b176955ee514e9
SHA1 be9349716efe7dc03b23bc6466cb375189004fdb
SHA512 5d276fbde12e575b0531798149d647b20196d9d5b7fa4e9df4c7420a6464b64f76ea79fbb987700df8aba834a2a3872d8bf13e8ed4ad168a0c85cf27710bc6b4
TLSH
T147117DB3C3D585AE890116F05A24EE2BCE1D0A05431C7C198AD4EF6B97F3476E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

ad3b207f-d1ac-4a6e-bd55-e01cbe1318ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad3b207f-d1ac-4a6e-bd55-e01cbe1318ee.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 456923f8cada5e3ece2c7a2afe1de505a6e2f7be37f2f9da91bfbf7d0a7c83b3
MD5 a5d54607f22ae9521f59c6fbe237b6ac
SHA1 521578846bbb27d57b3a2208660fb1e4fca8b098
SHA512 42c6dc322727bb01ab29582234ede4f00d0b75e7cdb7b27dce908f0d8046956bdd4213f6093281ae82af6394d0ac1a15c54d2cbdfb2956f277e6092fa359b4c9
SSDEEP 192:sxZRRuW1/fas51gIdpd/HW6+WNGYrbEZIgrJ:sxZRv1/fasLhhHbG79
TLSH
T1181287526E28A57B8CC7E30DBB19BF53D6F95032A1951E58EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 279c0bd906416d9d7ea0841e30bdbf51975bbe01f35e944792ae55eec8df469d
MD5 83771125614ae83527107746c5178e67
SHA1 77c14ae5c5c59c88631e660ed76c7b4ce2a3a32d
SHA512 523f6a91e9b8e2ebb04c058cfbff602e2040d4d86ac0caeff3b24d0388d10ac654d9094d5cac594b11695892c790b4f9192cde6321e191622755f583080afacb
SSDEEP 48:KIDI1Ks04jyL2xMwuUUNb4PgISINK9s1uNxmdYHY02yLdcRtfLPwbD2jISlwK9ld:KIDCKs0+WheKiwKaq0Kzibs
TLSH
T10491214435BF021539BE2A8881768B5E124136B7315CE67B7FBD40A29E2FE045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c179018a-a7c7-4308-ae1a-b72e1c408bd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c179018a-a7c7-4308-ae1a-b72e1c408bd6.tmp
Size 9KB
SHA256 883ef103cfd0d1e96633e77ea801a6fa00434cb72cb81f466adf1d15e6bd24bd
MD5 7c2a7d1f75246d1574a598537738d0ba
SHA1 a29412bb9362975a33ab3d33e779a6d3533e20d0
SHA512 bf58297ebddc657f4b7085ba269a35ce1e618663e9b4c0687cbc3c17e21ea536b9760e6613e044f1477115026b4d580522b7d5d3d8534baa041964e817710b78
SSDEEP 192:sxZRRuW1/fasr1gIdpd/HW6+WNGYrbEZIg5DJ:sxZRv1/fasxhhHbG7r
TLSH
T1852297526E28B57B8CCBE20DBB15BF53D6F95032A1951E58EAFC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7c0b8ec-9fc7-4988-9700-a740b4e659a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e7c0b8ec-9fc7-4988-9700-a740b4e659a1.tmp
Size 10KB
SHA256 b7e067c18602f4e579b38de6e587c5582164b587ed85986051076a0baad54631
MD5 3a90d459517b6e79c81f2485acd99b38
SHA1 38c4fb0d6c4bcc05836773ee239d737b58e3a0a7
SHA512 e8cc9f62d28822f6cad073fc514f31536602fc258fb8ed0444be6007acb7fe7d9d9cdc99502cd700cd37319d9c4d166b1966da703a660665db55462f64a88b9a
SSDEEP 192:sxZRRuW1/fasrDngIdpH/HW6+WNGYrcEZIg5RJ:sxZRv1/fasXhfHbG4t
TLSH
T10722A8526E28B97B8CCBE20DBB15BF53D6F9503291951E48EAFC861C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a222356d-e4a4-412e-91bc-d7eb9e29df05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a222356d-e4a4-412e-91bc-d7eb9e29df05.tmp
Size 18KB
SHA256 062a35f6ea54350e78c743af612f9c757d33a4b0a5f1cdd49b2449719ddf1212
MD5 49dfe30e3e3404323d0b6b7fd180ba26
SHA1 e3d4fa9610afbf879e33723e40597ccb93c6fc11
SHA512 3c62e2f8f8070207c27e4802718d3ee7fac2ebd63ae6bc015fda13bd26373d9ef550fcc218ee0130761e70f6978d7aec0d6a14e6c4da48a87175e9f0db661b0b
SSDEEP 384:eZcIhsN5Y4ZM/rHX58EMOzAAdXtgOIwZOy1odoZ:chC4zaHOZdXXsXd+
TLSH
T15D828D329978AD7B1DFBA245F64735035FB88067E385AF80C5EE672D00DA6AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afb9beb4-2f54-4a81-8f3a-f99f68a48da9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\afb9beb4-2f54-4a81-8f3a-f99f68a48da9.tmp
Size 18KB
SHA256 a12debb35b68fc91689e68724f67b5bd8731746cf0e3be576352e571a8ed8d7f
MD5 28c59cd1472d25897058c8cb415c4937
SHA1 4ae34cd0db0dc6612a6c6052af56d05e39666308
SHA512 b65a7377b15d33e8f20effe436c1748889594aeec4a6e786770d154cae72d5574b125690fc42c8b5d0b5219cfda352a69af8a0dd20eda3a5c9f13c9f31a4d519
SSDEEP 384:IZcIhsN5t4ZM/rHX58EMOzAAdXtgOIwZOy1odoZ:2hF4zaHOZdXXsXd+
TLSH
T145829E329978AD7B1DFBA245F64735035FB88067E385AF80C5EE672D00DA6AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0acd4a20-75c7-499c-b7b3-9f4e1f4be1e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0acd4a20-75c7-499c-b7b3-9f4e1f4be1e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f5698f09-fb5b-4856-85bd-727caec76e38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f5698f09-fb5b-4856-85bd-727caec76e38.tmp
Size 21KB
SHA256 86fea8403c19db82d95c70c36db5fa1723406b3a75496792b7aa301bad33d66a
MD5 aaf2cb1361cba6113e38aae5d90b04e0
SHA1 e1185ff03ff80841a813b305a9198f3d30454a01
SHA512 daf70789ba96327710b053cc3fd07d7f357995bfedb538e6a088eafb49889eb4f24a813fde32a41685e8f81070d905878e457017d1eb71f709ec0ce65b2f7cd8
SSDEEP 384:ZiFiZcIFzsNb8TUNTUlIlt4ZM/rHX58EMOzAAeXtgOIwZOy1odoZ:wFQ9WwgY4zaHOZeXXsXd+
TLSH
T160A27D339DA8ED7B6DFB9785F64A32038FB94077D685EA90D2DD5A2D00961EC130BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e9380d8674b296034d3bd6d3a0afb6db659026c80756bf4593455abf3513e08d
MD5 dbc18cbb08237f4e286ee46585a00e67
SHA1 95bd9c2785e06f8440b47c656bfbb8f28ea481fb
SHA512 5c3a56cc78fa036dabda0efbaf02b85f923eb74c17886e34229a82024c2c5fba6dc71972f3e3916bfc6539f7b0f7422cdecba62852678f64b2622ac47074f51d
TLSH
T196411C59A7E91108B3B72E5AABF6696E847F78332F07C46E10110E8F0762B44C861B37
MD5 SHA1 SHA512 TLSH

Submit Download