ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-qqjfwsbb38
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4928	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{D3B888EB-D05B-42BE-98EC-57F39CC71FA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 5096	2580	msedge.exe	86
PID 2580 wrote to memory of 4928	2580	msedge.exe	87
PID 2580 wrote to memory of 564	2580	msedge.exe	88
PID 2580 wrote to memory of 564	2580	msedge.exe	88
PID 2580 wrote to memory of 564	2580	msedge.exe	88
PID 2580 wrote to memory of 4936	2580	msedge.exe	89
PID 2580 wrote to memory of 4936	2580	msedge.exe	89
PID 2580 wrote to memory of 3824	2580	msedge.exe	91
PID 2580 wrote to memory of 4348	2580	msedge.exe	90
PID 2580 wrote to memory of 3824	2580	msedge.exe	91
PID 2580 wrote to memory of 3824	2580	msedge.exe	91
PID 2580 wrote to memory of 4348	2580	msedge.exe	90
PID 2580 wrote to memory of 4348	2580	msedge.exe	90
PID 2580 wrote to memory of 4468	2580	msedge.exe	92
PID 2580 wrote to memory of 3456	2580	msedge.exe	93
PID 2580 wrote to memory of 4468	2580	msedge.exe	92
PID 2580 wrote to memory of 4468	2580	msedge.exe	92
PID 2580 wrote to memory of 3456	2580	msedge.exe	93
PID 2580 wrote to memory of 3456	2580	msedge.exe	93
PID 2580 wrote to memory of 2396	2580	msedge.exe	99
PID 2580 wrote to memory of 3872	2580	msedge.exe	100
PID 2580 wrote to memory of 2396	2580	msedge.exe	99
PID 2580 wrote to memory of 3872	2580	msedge.exe	100
PID 2580 wrote to memory of 1528	2580	msedge.exe	104
PID 2580 wrote to memory of 3076	2580	msedge.exe	114
PID 2580 wrote to memory of 4400	2580	msedge.exe	115
PID 2580 wrote to memory of 4456	2580	msedge.exe	116
PID 2580 wrote to memory of 3712	2580	msedge.exe	124
PID 2580 wrote to memory of 3712	2580	msedge.exe	124
PID 2580 wrote to memory of 3492	2580	msedge.exe	127
PID 2580 wrote to memory of 3492	2580	msedge.exe	127
PID 2580 wrote to memory of 2700	2580	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ff84de3c188,0x7ff84de3c194,0x7ff84de3c1a0
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,12111359716223373770,11599909467702325750,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4680797358603537352,7025673258177336252,262144 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,4232125251770241627,700550921190620569,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17939523424174326940,8332025318688141369,2097152 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,13429770067477544729,14527100725388899351,2097152 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,13791472279763978393,892355094721846883,2097152 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,8350208750684050461,7441579514072243003,2097152 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,6605194771771879514,7532191406839685368,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,15975006489512068627,5078548457868089031,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,13009244385131623595,13809304390888740937,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,13009244385131623595,13809304390888740937,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,4034532441157645530,16961742564453615135,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,2998091892430595502,4655391832076167339,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16638871205287643970,10361863064716457667,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,15267300916764578667,14831580719717911460,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,5342893626578999077,9546037273179911823,524288 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,15982180256034783028,14598829750428313188,262144 --field-trial-handle=2208,i,11486677402279493956,9152723270204697906,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c4d6b89-88f3-4b68-9241-837c9192abfb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c4d6b89-88f3-4b68-9241-837c9192abfb.tmp
Size 18KB
SHA256 b75f064882a6424642fd97ce72ac9d57d25cd187dfdb10932f8c5da063a41031
MD5 9ce9f531655c3631f6135f547c7145a7
SHA1 11b3757a76f689e621d790be2d87820d480447fd
SHA512 a3b373f49eaec3f264957279055f0d53f1921a6d0d0fc45a82e6ceee8bfb0776b41d474c6880e701cfbfd70628c89b4b992ae23efcbbbd70ec665bd5a807edfd
SSDEEP 384:wgZcIhsNXmQ5eF9BGYX5EaV84YXT9AtgOIwZOyloho0:bhCwfGYua7YRAXsPh7
TLSH
T104828D325C78BCBB1DEBA185F14B36039FB89027A7D4AB50D5ED572C01DA698130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bdfe90e-049d-4963-bbb5-bc30118ef1f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3bdfe90e-049d-4963-bbb5-bc30118ef1f1.tmp
Size 8KB
SHA256 9d4065b0cd7087a1e4499fc00c9b6f72b02cbad17a353857ad7797e8444e0610
MD5 244dcb8e2f2a5d969b9c1e0df3d2a545
SHA1 1bb35f8be2d2fc387666c1eca10e5b68f91588e2
SHA512 05ab9809a2c305b7328f8290d0284bd87e31a007dd7fe53e01d5808e1d15e47a11762da0a646dff8f13e5209bd99566b109faa8a8f91cd4db748773b006001fa
SSDEEP 192:LJON76DphmqQmiUy2Vq8wGYX59ezTC5jzor3mL9kk73FU6:lON7619/RwGYX5EaV8C1U6
TLSH
T12102D935AC787CAB4EE6AE45B44B37139FE8212BAB542F44D6E81B1C01D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

429df99a-86a9-4454-a6e3-d0622691cb5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\429df99a-86a9-4454-a6e3-d0622691cb5a.tmp
Size 18KB
SHA256 c3bb1b450cdd14367cf9fa8b018400f620be3491d229c5c106b41284258cf30d
MD5 3765bcf3f793a26a62e7398d8f031b06
SHA1 fe87447fe32c5846cc054c44cf610fc89e325853
SHA512 1ad27355ac3e935ce4414baa1695345a0f232661381becdddfd8e24e572ea94d0c5592cd0f81f35074e8058d893f43bf9b7e388ddff5b8a2a4f4eb65a7200c87
SSDEEP 384:lZcIhsNXtQ5eF9BGYX5EaV84YXT9AtgOIwZOyloho0:dhDwfGYua7YRAXsPh7
TLSH
T1C8828D325C78BCBB1DEBA185F44B36039FB89427A7D4AB50D5ED172C01DA698130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20bd55c7-9dfa-4189-b420-fd7825e975f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\20bd55c7-9dfa-4189-b420-fd7825e975f7.tmp
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 24c133ed61416156a3d0b4fa00bfca479eb7ecb5184955e998fbedcca605f8b1
MD5 b90ecf74a561822627982f1b8d4c4873
SHA1 3340a2b49ee7948da3345fd34ecb2ab68420b586
SHA512 eb4373bf9ed3d7960d90950f6ae991a5e15a049a12d096bc176bd999a7c117e37d44210634cdfb6f388be8a9ac75d4920be8d0f0c23e0873f2a14b925d350604
TLSH
T1BBD08025C9F46FD5E037103D012241447ECC95665B023116E169156E19955D71E61891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

12300eb9-831d-489b-a175-220c8537d484.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12300eb9-831d-489b-a175-220c8537d484.tmp
Size 10KB
SHA256 4f41aa82684e2c539167bdcc26ad13f782c2b3720c158da0abeacd3fe90800f6
MD5 8c4a8e53f8d9bbd361d64e8d33cb4bc8
SHA1 6bc3209ad6b7626dffcc5d4ccf3de96a1df24c87
SHA512 fa18f7d431bd6b9f18eeca1c0d2303fdf21e90a83f0ff62bdb82e20e535eca963214898714b01b9493e3a64960bc153fe80106539c19ffaf88e2e5349b8f66b2
SSDEEP 192:sxZhRFW8/f5XsKBvIdpd0HW6+WNGYg0AeIg5FJ:sxZhu8/fJsKBAGHbGUN
TLSH
T16322A6116E28A97B8CCBE20DBB15BF53E6F9513251951E48AAFC871C05E6ACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0e369ea062b1ae7586c859887da739519640b57e3dc5f0d7eb6d05162c92eb83
MD5 67f1e49a07ad5f1fcc9c78ec3a589288
SHA1 c00b56a2c18ce73d20d0bd21e02e39440c7204aa
SHA512 f8c531146789b07478f323ad449d9784bbeeb818e8ef09e3ed32f855a85c08584d8e87b847474afa1068840bd48af3bd3753d3857c44c387c06ca0b045e46621
TLSH
T1F6E07DE415CAC22EA20EA44B016CD70C8388761FD2C0AD8E5700CE88FC07840B7C36B0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 22c549fcc272cc3350b9f9a55de445bda8b2a33cabdbeb2b62b05aa1bca6d098
MD5 cb297defae07993ea70c01309ea052d4
SHA1 2a9e39d52d10ff03f95114c5f024a4fde1e264c3
SHA512 0332a5f86f87d73a71470dc2d6acea4f3cb6d7e02571759a3deef3b7dd290e2027e87a6499dbd51f66640a255199836ea4429de2edafcac30d95ccfca9988588
TLSH
T1EA61A241C0C0846ADFD44230A1F6A1A7F23172B4C4A7BDB9814CDCBE8B07F3D226B880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 826b543bd3c928395773d0dc8559d1f66cf9fb439440cb1dcae45e3133df5b4d
MD5 8b386cf7fbf6b69da751b0112a934d97
SHA1 80374408f77df80a485ac30bd295668be7725419
SHA512 51f0cdbb36cb8cc05b76feb2455e501e5754a14153db5e78f7814e1001bba37ef6ffb3db98fd92fe343a329124d503ded9a345cf307f63d3c652ec5d77df12ea
TLSH
T18D618141D0C0846ADFD44230A5F5A1A7F231B6B4C5A7BCBA814CDCBE9B07F3D226B990
MD5 SHA1 SHA512 TLSH

Submit Download

8edf4933-5fed-4159-8488-be62b3f0c607.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8edf4933-5fed-4159-8488-be62b3f0c607.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5f2e8a63-f368-4056-ac9d-5113bf2ab874.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f2e8a63-f368-4056-ac9d-5113bf2ab874.tmp
Size 949B
SHA256 6be394cb799694c5fd6d1302b95502cdc77636664a9d2d01c0cc85d3fd548577
MD5 4c4fef2cc3f96969ea726482b666b790
SHA1 fdb20403068874b4572209aaf6d58f0d5358d8a7
SHA512 68b88c348df6c7399842d328075d39e33af2891dbc1b1e906babadb3b2a131c4cdd582ef080eac927b0c6399c31de0971f2665ab4546926ccf60f45f5c3395a8
TLSH
T1E2117DF3C3D595AE890516F05A24EE2BDE2D0506831C7C1AC5D4EF2797F3476E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

aedd10a7-bad8-4a25-b4df-9f7009911706.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aedd10a7-bad8-4a25-b4df-9f7009911706.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

faf8ead6-05d9-48bc-b125-34b5b7240ac9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\faf8ead6-05d9-48bc-b125-34b5b7240ac9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d4965f8442e0eb45e68be1319c16012a1a923709ee3ff8febedcee38f83bd486
MD5 f02379f8fc4c5da86cd14983d5f12d80
SHA1 17f5ae0d1978d3a1fa7576be413dfd6603c64e9c
SHA512 37a3cb4eb1f0dcf0471e66b797d16ae5f774cf4787febe7cf1ef218bbcb43ce48f4448618e5f4336763969cc3d9f316dd5a411aef11610440261dd4945bd35a2
SSDEEP 48:K0cLq2EGqTba5iISuTK9K1oTxMDYBSqwyLWRsQO00tbYvAISotK9M1OtxG9Yn4U9:KAzmKo0ye5WKyoCOduKu8F
TLSH
T1B8911E0134B7125078FE7DA985B4871B02813577351AF62ABFBC50668AAEE584CFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af71454e-7f92-46e8-aaa6-af2a2aeb0790.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af71454e-7f92-46e8-aaa6-af2a2aeb0790.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

affc263e-6d16-43e9-a93b-0f937b6c0aea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\affc263e-6d16-43e9-a93b-0f937b6c0aea.tmp
Size 27KB
SHA256 d7b6c274f6f72aa1a7f932490d2ef7e982b4c71f72fdb9c6bbba9723a4e016f3
MD5 c92c4d05b866474ade03e93770d9734a
SHA1 aa8030d088b070ee4b7728f28bfdb3c7e7d10cad
SHA512 d3818ba72ab305401e7526a3e761ded48d28a3b4096f52085a7432e47f7442d90203b52809e098ff696e1b79c075cb1d63e267037b4aec3c8f226983b670879b
SSDEEP 768:WPichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzBroKC2O:WPichfPWvPZplu1jan+LKgz6uO
TLSH
T15EC2FA3B640CCB7E4FC01E9DDD5A6F967EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0ff187b-c89c-479b-a2fb-65df153d7c3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0ff187b-c89c-479b-a2fb-65df153d7c3d.tmp
Size 9KB
SHA256 9d9b3e6026d86c8a417cc3e904274c327638dbca187826f8b511a90d106f3d2a
MD5 9cc7f197b7b9dbb0c62091a8d962734f
SHA1 20f0cff56f0d0092bf3d55d07be3747d605379b3
SHA512 ecd438728152dee57b90b349f8886e8ec9b3981d4b3c9260e6cd5170ab88076d78fbbef626ad1a8d5f69b91ff8381839447facf00f0ca7d476c704ecd65fd1ba
SSDEEP 192:sxZhRFW8/f5XsRbvIdpd0HW6+WNGYgUAeIgrJ:sxZhu8/fJsRbAGHbGs9
TLSH
T19512B8116E28A97B8CCBD20DBB15BF13E6F9513261D41E58EAFCC61C08E6ADD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6d24652-25bb-4ff2-92d1-0e049f0c47ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6d24652-25bb-4ff2-92d1-0e049f0c47ac.tmp
Size 9KB
SHA256 6f4e8ecbe754b310e861c9ed018188862bf6688af35e180500ba62465b31eef4
MD5 1d1db4b6e7234151a5b00946aa9d06fa
SHA1 44d26bb6cc78f6e0c7533553197468f96b5ec322
SHA512 e5e1874bfd92287e06bb4ab388d41d85b2fdaf839d81569792786519d7081e8c54547716e92b1355c3c70e9b3174ba5071929197aee26179b0ce845124827ad3
SSDEEP 192:sxZhRFW8/f5XsKbvIdpd0HW6+WNGYgUAeIg53J:sxZhu8/fJsKbAGHbGsL
TLSH
T17322B7116E28B97B8CCBD20DBB15BF53E6F9513251D41E48AAFC861C08E67DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccc11d72-be6f-482d-9d09-a041f3751c6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ccc11d72-be6f-482d-9d09-a041f3751c6e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de5f97f5-a937-4ef8-9057-386e88dbca12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de5f97f5-a937-4ef8-9057-386e88dbca12.tmp
Size 10KB
SHA256 da6670034852a61694519afcdd18a00cf4f66343715090751c2902b96d932d1e
MD5 24e84c7e0269fca58bc722adbbed396c
SHA1 58c6fd199297f62b81551a9be99615b698ea6c84
SHA512 29f5927643ffe9fc41051752a223b49a230259cc8823af83f39a24e5d3bb833ab7ecde82ac69f26c72cd3e2fe44f9853a6ad50782937917493386a644a61f658
SSDEEP 192:sxZhRFW8/f5XsKBvIdpH0HW6+WNGYg+AeIg5FJ:sxZhu8/fJsKBAUHbGqN
TLSH
T1C222B7126E28A97B8CCBD20DBB15BF53E6F9513251941E48AAFC871C09E7ADD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d894a66-9738-4c5e-bde8-3fd9159401f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8d894a66-9738-4c5e-bde8-3fd9159401f9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

cf7d27a3-89fa-4356-a9d1-03356c88d3d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf7d27a3-89fa-4356-a9d1-03356c88d3d7.tmp
Size 8KB
SHA256 26fcb6e451c3794f0890ef7ab4f0ea2bc52e9666b29c142c4a587dd5845cfcba
MD5 16d27569a90650a9f5e480ecdd77f99e
SHA1 521ba7c9d983722de58cba4211b1fd5bec9ab3ce
SHA512 edfdf8776eb285e2e69d0af9cc14c3d6a7e9889a50d23612423695a1cf73b3cf10aec1e99ea2de651f3d9c3dd4ccbd97ae0a1d3613723bfb0940a3eee7631e0a
SSDEEP 192:LJON66Dph5qQmiUy5VfwGYX59ezTC5jzor3mLrYXT+mkII4q5AU6:lON661KWfwGYX5EaV84YXT+AU6
TLSH
T1F712FB36A878BC6B1DD2A595F04B36139FB85127EB847F54D6DC1B2C01DE65C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea58a5d9-1cb9-41da-bc91-0948355004a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea58a5d9-1cb9-41da-bc91-0948355004a6.tmp
Size 21KB
SHA256 616c0b0976c59c26ad243471acd9173033c4e4c8458f2ca94f26b4a9b943c2c7
MD5 2fb8df5250841ac39b2867336344858d
SHA1 1d136a0dbf93553ac0e5b273759df76f3c7f56a2
SHA512 9de7480e04ca085775b2bb60c57674cd8f9a45ac7c00f47923a0cfed310fbd35477c481e15bd52c22e5d35c5344aa52aafc2f085f75d63738ea5040a3e86ca71
SSDEEP 384:oDiFiZcIWzsNp8TUNTUlIlmQ5eF9BGYX5EaV84YXTZAtgOIwZOyloho0:9FQm4wgbwfGYua7YVAXsPh7
TLSH
T194A26C334C78ED7F6DFA9A85F54A32038FB85067DA94EB60E6DD5B1C01DA198130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b03c7ec5-30b3-4a3e-86da-0484380334cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b03c7ec5-30b3-4a3e-86da-0484380334cb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6473e4039880655a4ba906ae081dc545b859d2bfcfa06e44ecd3345be27773c7
MD5 5e516df764126b69473debc6a727284a
SHA1 61a0730156179f597d18ccf1a6268b48e2386d79
SHA512 259e57f950cadb8e98b0aa245a9ea6c3d5208c3a8277f0ebbc132dc67947d9e660d98d8a74ec5ad8f2440c759e72239b905b24efbf90ef7f207feab3f917d759
TLSH
T149412A58A6FD1148B3B76F5AABF6686D447EBD372F0AD09E10110E4F0A26B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download