ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-prjydasbme
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{4B2DE33D-30E2-40F6-8459-53E630FA149C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4996	1412	msedge.exe	86
PID 1412 wrote to memory of 464	1412	msedge.exe	87
PID 1412 wrote to memory of 4432	1412	msedge.exe	89
PID 1412 wrote to memory of 4432	1412	msedge.exe	89
PID 1412 wrote to memory of 4656	1412	msedge.exe	88
PID 1412 wrote to memory of 4656	1412	msedge.exe	88
PID 1412 wrote to memory of 4656	1412	msedge.exe	88
PID 1412 wrote to memory of 1108	1412	msedge.exe	91
PID 1412 wrote to memory of 1108	1412	msedge.exe	91
PID 1412 wrote to memory of 1108	1412	msedge.exe	91
PID 1412 wrote to memory of 4084	1412	msedge.exe	90
PID 1412 wrote to memory of 4084	1412	msedge.exe	90
PID 1412 wrote to memory of 4084	1412	msedge.exe	90
PID 1412 wrote to memory of 4480	1412	msedge.exe	92
PID 1412 wrote to memory of 4340	1412	msedge.exe	93
PID 1412 wrote to memory of 4480	1412	msedge.exe	92
PID 1412 wrote to memory of 4480	1412	msedge.exe	92
PID 1412 wrote to memory of 4340	1412	msedge.exe	93
PID 1412 wrote to memory of 4340	1412	msedge.exe	93
PID 1412 wrote to memory of 2268	1412	msedge.exe	98
PID 1412 wrote to memory of 4172	1412	msedge.exe	99
PID 1412 wrote to memory of 2268	1412	msedge.exe	98
PID 1412 wrote to memory of 4172	1412	msedge.exe	99
PID 1412 wrote to memory of 1348	1412	msedge.exe	102
PID 1412 wrote to memory of 3992	1412	msedge.exe	113
PID 1412 wrote to memory of 3308	1412	msedge.exe	114
PID 1412 wrote to memory of 2060	1412	msedge.exe	115
PID 1412 wrote to memory of 4220	1412	msedge.exe	122
PID 1412 wrote to memory of 4220	1412	msedge.exe	122
PID 1412 wrote to memory of 3120	1412	msedge.exe	123
PID 1412 wrote to memory of 3120	1412	msedge.exe	123
PID 1412 wrote to memory of 3584	1412	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff2a94c188,0x7fff2a94c194,0x7fff2a94c1a0
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,14106935647089117264,1936262095893430013,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16758706427004384831,2662311629122240709,262144 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,12508850259099238479,2672620150486643106,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17614588441984738470,4135923233752422778,2097152 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6627916278126416717,13463618813120690083,2097152 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,2328690338878825989,15943743279747308697,2097152 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,11437259576267038116,4067928844580155351,2097152 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13447117717518243373,11381570704132195705,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,7456766099462137344,8696283607211550894,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13239439582198535459,14682525020334800380,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13239439582198535459,14682525020334800380,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,6789722145807705373,100399238691190251,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,17003480320915454841,18410448150488406758,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,11877261336831841748,5948113221551414037,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,11230159681462474937,17922870498962193713,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10999641954900381593,13593549644874667846,524288 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6068,i,15403865138729345660,8205100448848672254,262144 --field-trial-handle=2256,i,13966267695749761648,8577126626254567084,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02a82f5b-7695-484a-9701-dea4044601f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02a82f5b-7695-484a-9701-dea4044601f8.tmp
Size 8KB
SHA256 d1b5f18325cdb450583d79662e6ffc2d091f567d1e9b3cf6a878af4301bf4fd9
MD5 fa7a772d266984665bd86519efc07f4c
SHA1 a633af2da5d7c1561ffa9d09ac8d1ca05a9b756b
SHA512 bd521cb09d4d697482e43060f69d1fbc429e00e8eccb962d46061c6cc01ec7904453a3542b788372d15a95175eb5af23bcd080e5cbc9e4cfc39cffd23b276c94
SSDEEP 192:LJOND6DphbqQmiUyaJlwGYX59ezbCMmI9TDrLkIIfq5DU6:lOND61Q1lwGYX5ECm9TDoiU6
TLSH
T17712F935E8B8BC6B5DD36591F48735034FE8522BEB847F8495DD1A1C01DB69C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e39da38-95fe-425a-a419-c2846865a331.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e39da38-95fe-425a-a419-c2846865a331.tmp
Size 8KB
SHA256 c44bd2a5794b036cdcedf74bccf7433cabe308111d3b5d257c705813e721323c
MD5 2643b8072dd6e7a94341f26c4f1e78de
SHA1 013ba8556b99330d59c0d58d6662398127b1ef54
SHA512 a24e2884ada673c2faed3aef3e7bff7130f476b1bceeb8b618572b6dde23c67b766234420bbceab7799c936fdb60ea04536cca9e6c4b887920447ec25f81020c
SSDEEP 192:LJONk6DphmqQmiUyyJq8wGYX59ezbCMmIXkk76UU6:lONk619rRwGYX5ECm/PU6
TLSH
T12302E935EC787C7B8DE3AE45F4872B175FD8112BAA906F84D6E81A1D00C769C2307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87fa2aa9-ff2f-4413-ac1f-5d2201344d5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87fa2aa9-ff2f-4413-ac1f-5d2201344d5c.tmp
Size 21KB
SHA256 690ceaa68c8fc6eaf92415665665afa0379ac42b04b970312379ba890bdb6deb
MD5 84c4f11158ee6768bfcb43bd06d6b77a
SHA1 b4a5ec56482183335506b0639cc0ade5dd43b7ac
SHA512 19b58a7daef553eae6565f1e7bc674a238ebdd0f9f93861c1d8cf1ec8794f677430f4f17b6b421d625d948a3c2bd6204af80f5c12d29d26f4cd039598319457e
SSDEEP 384:diFiZcI9zsNq8TUNTUlIlRWTy5RyXBGYX5ECm9TDiitgOIwZOyBoooD:UFQFnwgWTyexGYuCwHiiXsToU
TLSH
T1A1A26D738CB89D7F6DFB9A41F54A36038FB89127D684FB94A6DE5A1C00D61D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

02514605-465c-427f-9d71-a889350bd6d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02514605-465c-427f-9d71-a889350bd6d7.tmp
Size 27KB
SHA256 08641a4e1ebcac60052bfab1690b2ed19acaee8efdfce4dc3e05db888c176e36
MD5 57ea4e3f685321936944d5a90e0512e9
SHA1 e925831cd3c5263e1f7a4d8bf39baa798043684f
SHA512 9bbcbb5b673ffcdf4c88f38db8ad5e6aab25448cc3caec0293717f2c741ea51ef2ab83f6a9c2b206daaa37c08d04c89ab62987bf9b6aa5a8342783e3af1556a8
SSDEEP 768:+HichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzZroGc0:+HichfPWvPZplu1jan+LKgzSj0
TLSH
T154C2EA3B640CCB7E4FC01A9DDD1A6F977EA802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

579008f0-6ccc-43a3-bc06-f9b538b3aed5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\579008f0-6ccc-43a3-bc06-f9b538b3aed5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5db94a12-5fa6-46ff-83ae-fc9d14fd7eb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5db94a12-5fa6-46ff-83ae-fc9d14fd7eb4.tmp
Size 9KB
SHA256 c5b259fc2021025fa177eb3d9272c74e7a7f1da53a5fa6250a0eb259bc622a3f
MD5 c7b3ae6a4fdeb21b742e957c222e67f3
SHA1 0efdb7462005e385d7ed7946565a74d39ce0ebc5
SHA512 0ddc17b3c83972c2bd56a9ead66eebb7a6e37c862c09861e20d53a4232f3a9a09e163b357d6d7320a6187f7ce354b2b6474e54fa3f75b27192ab526cd71ce3d2
SSDEEP 192:sxZOR9WZ/fesFy+7Idpd5yHW6+WNGYgUJyIgrJ:sxZOuZ/fesFy+kryHbG39
TLSH
T1F212A7526E28A97B8CC7E21DBB15BF53D6F9503261941E48EAFD861C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f5bad35-5053-4cf2-9aba-68e749ddd0bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f5bad35-5053-4cf2-9aba-68e749ddd0bd.tmp
Size 10KB
SHA256 19eca29c7f9a1244021447f1686cb6bfddf328f1346ebe5fb621e07d67630d7e
MD5 b961c022beb242454859f438f5f4ecf9
SHA1 581f32c3bbe512b9991ae2854516e6f9bbc9a9e9
SHA512 7c38b930812de2d4def125d5eb94d00fbf59631a489aed34eb52afa04f8402f41119d37b44329679a71ec05e79958f919e614e6b1e31d6455a325343cd7340b8
SSDEEP 192:sxZOR9WZ/fesmx+7Idpd5yHW6+WNGYg8JyIg5bJ:sxZOuZ/fesmx+kryHbGTD
TLSH
T15322A752AE28797B8CCBE21DBB15BF53D6F9503251911E48A6FDC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93c1ffec-5d1f-4510-9380-08588999e4aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93c1ffec-5d1f-4510-9380-08588999e4aa.tmp
Size 10KB
SHA256 73cb595a4fc184ac7c9c7078953c14f9cbdb56ed7ef26504ab98642df73a10a4
MD5 5f9051f3f56f60501b9c465e26003bd9
SHA1 f54901172cc31da4487da58d92bbc5b4ca2a1756
SHA512 2796cc20bdbb3c692f712f998fe96d186477fa72a52146ac99b8b082ff05208c859357b66b0c8200913fc3a8e51619e534d4f09635deb6b2a8074ed224edb3c7
SSDEEP 192:sxZOR9WZ/fesmx+7IdpH5yHW6+WNGYgJJyIg5bJ:sxZOuZ/fesmx+kZyHbG8D
TLSH
T15622A752AE28797B8CCBE21DBB15BF53D6F9503291911E48A6FDC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0d6ea56c783d65131b6cac681ffefbcacbd022dda99836cb96b48a6ca24d3157
MD5 d987d218261558ebaf5f72926ae75aa9
SHA1 7bc74fc0a39d1873c79790bc2abbf47f0cee9ada
SHA512 a2ef073c3dfb13965a481b323f89136ae53d037533a9aceabc0048b0e1a495abc03f362bfa01f6a89c6df55846a89ff49dd00217886db9ba228690f13964840b
TLSH
T195E026E954C8C22EE2187A6F227C930C8B80372B92C0A91E2704CE857406890B3A2AA4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d37dece3bb7b0ea11d61e68fee0730141d84ca57f6149d827e12359ed07020a3
MD5 4e47359df87cd4a7cf8b02e99a799727
SHA1 69f0aca51e55f52cb79c68d4784249072d621695
SHA512 ee6e230815a89dacbac01629c4c86b46c23366e283ac1dbaceaa840c3f56ab65f34997b42f1770cd8941a718cc3f6af0eb8c5964b5a2c069cff3cbcb7abfc803
TLSH
T13061B5CC454180AFFF9480789DDD70CB37365D86BA4B0DF38198D4B6A886BD4C28A890
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fed8dc973aaaf3dd4856f508f8ff256c49265b800f875de8b208411dcdcf2002
MD5 4af85daf9f48e7cc9507552ffbdd536b
SHA1 85e9f7fc2d355d740f1c5b5c618894b8161916de
SHA512 5eda3e1d87ad37c52b1c8d3ebb2cd2510615b99875a3810059bc1f4b65bd2e06a652cded5dda666819d93629b201a6e282719ae04c436b4fa4cd0834adbff182
TLSH
T13F61B5CC454184AFFF9480789DDD70CB37365D86BA4F1DF38098D4B6A886BD4C2C9890
MD5 SHA1 SHA512 TLSH

Submit Download

86da3e17-8219-4798-aeac-5f5af2d92d0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\86da3e17-8219-4798-aeac-5f5af2d92d0b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a83b227e-5770-4571-bc2e-461cb4a1df2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a83b227e-5770-4571-bc2e-461cb4a1df2f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d4ad8db0-0ff8-4da2-b9ba-d6b71620a509.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4ad8db0-0ff8-4da2-b9ba-d6b71620a509.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d7859980-22af-4c83-9035-eb88b140d5ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7859980-22af-4c83-9035-eb88b140d5ca.tmp
Size 949B
SHA256 b0b9dedffb49e31a45e5203fb32643f5b0b368fadce52a8aa7040eb194b3a429
MD5 14a0acef263d29dae44eb9c7a184ad48
SHA1 57ccb4b2507d1a6c3a4a43b36086aa67a1202e51
SHA512 d74a47d3a39bd123e9bc51ac45188847cae22b2aa525fa938bb605e37457bd09cf6cb400491c7b23e357b2de1b3b24d037c0a5bc7303af0d69f89e5d0814a0c0
TLSH
T139115BB3C3D585AE890116F05A24AE2BDE2D0606821C7C5985D4EF6B97F3076E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 d1f42d0b1439266531dda65e04c248d80e62ee7769423ae768bf30500fdd314d
MD5 a52bf997daf9af961fdf888437f1f99b
SHA1 06c09ab6e572ad6919856c81e32156d18aecfc9b
SHA512 30e2dc8b64ca819c6f94394f87c2a44910779227e1f0ab964c59af1edf20a42c2f85a224231f1e8c4e562b25b4b3a419022de02befb3916ab1ba39dc17d799a0
TLSH
T1E021B056A49692F12CBE360C0078C8178A5531B57224E96E36D851571F3BD848EBCCD9
MD5 SHA1 SHA512 TLSH

Submit Download

f2d1868f-ec8f-48c8-abdb-1c5fee85dd64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f2d1868f-ec8f-48c8-abdb-1c5fee85dd64.tmp
Size 9KB
SHA256 dda864e5f44b7d070b5f81f236a8f8966e82f17b407fe626b47eeb6890a59f71
MD5 9009b8817477db0c15ff8e1553f99ac3
SHA1 8a37cc44c010297bc497243a97d0cc14f81ea42a
SHA512 92451401a8aadf7e6f27074ae68b55f274783d8351ae4e52b645891d6e5690924c1319c4eb0ebbc86b9dae9888db8c6b816b4773aba41462aaa4c470d22b914e
SSDEEP 192:sxZOR9WZ/fesmy+7Idpd5yHW6+WNGYgUJyIg5hJ:sxZOuZ/fesmy+kryHbG3N
TLSH
T17D22A852AE28797B8CCBE21DBB15BF53D6F9503291D41E48E6FD861C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8c221f0-aa1a-4161-a2ea-8f19c67a12d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d8c221f0-aa1a-4161-a2ea-8f19c67a12d8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1fb9150-1162-48be-81bd-fc0ce4453a47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b1fb9150-1162-48be-81bd-fc0ce4453a47.tmp
Size 18KB
SHA256 49f9c7affeb10c38200eb06bb14c694e4d5cc396d49263ab624a3b5a3e3c286c
MD5 8d0e995df7a3ce47b49df505a0d6d48d
SHA1 2495227395c2e194289cc448d210041922947a46
SHA512 407d36093c1c5801d3dbac164e2380f47982c70fcc3f07d0b400eccad7f0723145743381bd7ab4859bdc680eee90c1ac3b105f620cb8e957fb0ab6857abd0eaa
SSDEEP 384:XZcIhsNS6WTy5RyXBGYX5ECm9TDyitgOIwZOyBoooD:fhJTyexGYuCwHyiXsToU
TLSH
T1A4827D769CB86C7B1DE7A141F58A3A038FB89127A7C4BB5494EE571D00DA6E8230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccdf5d9b-e462-4a7e-81c5-576e8fd09dd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccdf5d9b-e462-4a7e-81c5-576e8fd09dd9.tmp
Size 18KB
SHA256 2fbec16648f4fcd016c8ae20f5bf6f0d7c2d053797a0894b380afba159950bcc
MD5 ce2c1e4031799a7ffb044daa97c7f699
SHA1 b5e7aeee848b5e166837921bf6606e34785b95ab
SHA512 f16410e051cd6e6518f1b4d258629a0dd7b375429639ca096fbeea1c2601db8ea136eb5c95a2f72a650a00c909995dc53bdb82cb659d2eedf2dbab03c6d86f41
SSDEEP 384:5ZcIhsNSRWTy5RyXBGYX5ECm9TDyitgOIwZOyBoooD:RhuTyexGYuCwHyiXsToU
TLSH
T1E5827D769CB86C7B1CE7A141F58A3A038FB89127E7C4BF5494EE571D00DA6E8230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efe0c719-6380-4027-8e9d-1360ef66f63c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\efe0c719-6380-4027-8e9d-1360ef66f63c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 42212061615a631b280226c937797840b118ba1a5136210671822bd0d0d4dd6e
MD5 00b6d0f8d0f9178b8a22b2dce7622f6a
SHA1 2a71a2c9014699473fef049fce6e8aa9a49ec752
SHA512 94e612ec38021db39835424ed2c763f863ba9bdfeede05d84a405d1be860afaac6974ff5194267087c657269e05da09eb8771e2852f12b887ff9cccf72c28ab1
TLSH
T19441485CA6FD1148B3B66F5AABF6A87D487BBD772E06D05D00210D4F0627A00D8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download