ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-rmh7dsszaz
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{6A6F5E44-85B1-4FE3-99CF-9DB15BE576A0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4384	4584	msedge.exe	89
PID 4584 wrote to memory of 2076	4584	msedge.exe	90
PID 4584 wrote to memory of 3164	4584	msedge.exe	91
PID 4584 wrote to memory of 3164	4584	msedge.exe	91
PID 4584 wrote to memory of 5208	4584	msedge.exe	92
PID 4584 wrote to memory of 5208	4584	msedge.exe	92
PID 4584 wrote to memory of 5208	4584	msedge.exe	92
PID 4584 wrote to memory of 272	4584	msedge.exe	94
PID 4584 wrote to memory of 240	4584	msedge.exe	95
PID 4584 wrote to memory of 272	4584	msedge.exe	94
PID 4584 wrote to memory of 272	4584	msedge.exe	94
PID 4584 wrote to memory of 240	4584	msedge.exe	95
PID 4584 wrote to memory of 240	4584	msedge.exe	95
PID 4584 wrote to memory of 4808	4584	msedge.exe	96
PID 4584 wrote to memory of 4808	4584	msedge.exe	96
PID 4584 wrote to memory of 4808	4584	msedge.exe	96
PID 4584 wrote to memory of 2624	4584	msedge.exe	97
PID 4584 wrote to memory of 2624	4584	msedge.exe	97
PID 4584 wrote to memory of 2624	4584	msedge.exe	97
PID 4584 wrote to memory of 1708	4584	msedge.exe	99
PID 4584 wrote to memory of 4728	4584	msedge.exe	100
PID 4584 wrote to memory of 1708	4584	msedge.exe	99
PID 4584 wrote to memory of 4728	4584	msedge.exe	100
PID 4584 wrote to memory of 4632	4584	msedge.exe	102
PID 4584 wrote to memory of 3760	4584	msedge.exe	106
PID 4584 wrote to memory of 4664	4584	msedge.exe	107
PID 4584 wrote to memory of 3564	4584	msedge.exe	108
PID 4584 wrote to memory of 1784	4584	msedge.exe	109
PID 4584 wrote to memory of 1784	4584	msedge.exe	109
PID 4584 wrote to memory of 5032	4584	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb1265c188,0x7ffb1265c194,0x7ffb1265c1a0
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,4531990402321028894,10247285215033789173,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,1356337457137429904,9755840449635649692,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,9359654157255011937,5205941281851195314,262144 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,5311710149384867840,11240248884566490617,2097152 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,15798880247998852712,2968537142554338352,2097152 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,2678695894357428770,16190697842763444650,2097152 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,3890743729314346229,8113111040614755320,2097152 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,7502132823829816819,11809716613621844954,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,11483348996732476809,3411750100358166208,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15441484079074066948,13350556885146291645,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15441484079074066948,13350556885146291645,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,18225203359412311877,13184238203980011271,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,12175076269010755898,9010863252488095329,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8908296628627816650,7609128191910819386,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,17663592667224560715,17446653163294188837,524288 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,12180084905335821041,1228980386294936240,262144 --field-trial-handle=2212,i,18291075833366013670,6989273309662237381,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

34b3bf34-93b2-4ee7-8778-124210c3fd4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34b3bf34-93b2-4ee7-8778-124210c3fd4d.tmp
Size 36KB
SHA256 c63a0852df76db167cc85f927977657f43e73c388a08147130c900941278c04b
MD5 1730d1357638b5687b8a24d981c70998
SHA1 c107e78d09b5576dbfe55fb6492a7feb73876532
SHA512 f9e154ad2550b8c7236c8ae35a7483955e45ef01482507a0171710aa6300ba8898ccd05980d0ab1046e6e78596ad8b23ee115dd40a9ff3eee526b74f3c48f10d
SSDEEP 768:hFQW3ewgCgISO5ytrb7MIYNa8S5oYklnA+A2s4t:wW31rWvVTWRdA32s4t
TLSH
T18F03BE3399E4D9B7ACBE87C5F60A7342AEF50263C085AAE8D9DC1A5D02C71EE1307C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e78ea5e-00c8-4894-8147-f2b9b10d4ed2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e78ea5e-00c8-4894-8147-f2b9b10d4ed2.tmp
Size 38KB
SHA256 833886609d1a7add8dcb965e2c9c249e97ecca3ea44ac43fc93441618ac42af8
MD5 e5e4d45ce91e710c25f3e4d8823a2bfa
SHA1 fc3ea0f803eb511a1a3ad723343da79d5c23cbe0
SHA512 f1354276b7467378aa7b641b33760a215c3868463575fe4a2664c6985ebf2c5cd9f4ff1e2e993d01b9475739a8aff624915ce62ba77dfdc2dbeeba6f1fc07a0f
SSDEEP 768:do/UxvxjgC+23SfBSO5ytfJMIYNa8S5oYklnAaTSH8L4:nZj3+23E1WfHTWRdAwS04
TLSH
T1DB03C03AAD94A9738CF663C4B60AA357AEE55263D0C16AF889EC1F0E17C73BD5303451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

3efa1ba6-370b-41f2-a335-25971f17e662.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3efa1ba6-370b-41f2-a335-25971f17e662.tmp
Size 23KB
SHA256 cb116854e1c726651813b6d47196875b0e21fb09edaee7bb39333648f9f710be
MD5 692c28c023ec1d9ce6ac497b600372f7
SHA1 1f8ac3f41cf105e1af1c95bfa6bd59c5ecf040ed
SHA512 ca6bf3dc8732c892cfb75f2307dc1f2f0010f1daa6eee81313ea672c4dfab7b741425a983a555d8d722aa35b0546018ad27022110f4cbfa1c25662ac92d0081d
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6nrocbs:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0VY
TLSH
T1A3B2DA2B644CCB7F9FC00AADDC196F976D9802C796A88D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e06ca30-f148-4631-9725-4e6ab451dd0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e06ca30-f148-4631-9725-4e6ab451dd0d.tmp
Size 10KB
SHA256 d5edc9bd436bcf94a6c0b804a1afe319f8c196cb7b00344e92aa1092fc692ab2
MD5 debfdcde80c6cf54b7a0603818bb6014
SHA1 938851a6727b800a7ef872f132f8b3516426a022
SHA512 6362e2415c55de91edd50b26e6187d87df621cb04efd5167027e68b91212df4b7f883a1398c33f2fe28d5718d95d1773ceaf1b6b198293de3757c84bf90e2ab1
SSDEEP 192:sxRcRkfb51/fPst3KzoA8p4V/g6+WNIYuwiYGbIgDjJ:sxRcSD//fPst3o/5Inh
TLSH
T16932A715AE28A97B8CCBD20DBB55BF53D2FD513261911E48B6FC962C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72c55fcf-3925-4502-abf1-58822378a874.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72c55fcf-3925-4502-abf1-58822378a874.tmp
Size 10KB
SHA256 1ca432038502089d8a4e3a7a62303413a0dcac80aa355eb82e802dcb9c035822
MD5 6364d790418125c57afcdfbc6e46a556
SHA1 b83880cd73a259c36c6c63138ccfd0c6e4777217
SHA512 f65ec312f6a6bf54449fead1527c1eab7606491b437681204813bdc3f0b413224ab9dc2f01a9b895adedbc6b41e6ce56922df7ec1c9c756c515ae708754f4e73
SSDEEP 192:sxRcRkfb51/fPsx3KzoA8p4V/g6+WNIYueiYGbIgDNJ:sxRcSD//fPsx3o/5Idj
TLSH
T19D329615AE28A97B8CCBD20DBB55BF53D2FD1132A1D11E48B6FC962C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 f934e3bfa4b6272e8277103c1b617a6e515c67b87c4fa7689e823a5df30f6143
MD5 0eecf5a390285bca059fbd8d1318ac21
SHA1 ee8cd343b03a07cbb244eaec3272a0eb316e487e
SHA512 1facf8d989f6588b0b39785751bd462aa3cf54eaf54475c52a1bbad03f0615ec1f9439b7fb5b22a9c220608f8a4082b1d245a47ca0e0805e1b97af78215e4f61
TLSH
T19D512A2006AC4DD6F759C07B82C60EC73A33F6D2F5830F811E9AE9B8AA2672C61CD104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 09dc5ac06f3afb58eead799b3a4d34813f48cbea35b7de81ba626fd0bb7427de
MD5 39ddad552fe4b36e088f7867817aecbf
SHA1 547a8e87fdc404001177a0f0c49f3206bbbbf763
SHA512 88a8aed11c4d09221d0b82a50b42fe8bcf1eb7f79849dc2ad22c1ec8a15cce81a91582ef535a92efe0734288deffd7b07f58faaeb8cf9d175d54bdbb78f0ec8e
TLSH
T1E4511A2006AC8DD6F759C07B82C61EC73A33F6D2F5935F811E9AD9B8AB6672C61CD104
MD5 SHA1 SHA512 TLSH

Submit Download

328df66a-bce0-4505-b13d-1a53b0de906d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\328df66a-bce0-4505-b13d-1a53b0de906d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1a18abbe-70d8-436d-ac52-e191869d52bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a18abbe-70d8-436d-ac52-e191869d52bc.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

1e177996-0f92-4b3b-9130-f0057c90277e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e177996-0f92-4b3b-9130-f0057c90277e.tmp
Size 2KB
SHA256 ac35753da3a9e18f0b4b42172a8a1c1ebd1fd254242c9a206c005e9b3013144a
MD5 9a38fefbdb27b978cfd7fd8c02c246e7
SHA1 e3c684a3eb079a139164183ef15a2692307516a7
SHA512 22d0fde8d4bace3af424f3ae4f4fda8ae7202492cb7fa5614e338c2038251db59b2ae797100ddf3eb58fa89f62b9416cc9f42ed6257b100cf50019c6e642d046
TLSH
T10E41A2F3C3E8867E8A0156F4AB146E1BCE1D0915432C3D5AC9D4AE2B97F34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

8aed0536-c3c9-4362-9e0e-d2a8183f2e51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8aed0536-c3c9-4362-9e0e-d2a8183f2e51.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d877cb5f-97cb-4243-9b30-fb4d7c11865b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d877cb5f-97cb-4243-9b30-fb4d7c11865b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8edf198-0c2b-46f0-b2e3-b367700f1f75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8edf198-0c2b-46f0-b2e3-b367700f1f75.tmp
Size 10KB
SHA256 ae03dbcd7179fb84a6990bdbdde4967bfd097350b3f154520166ff012e79b8cc
MD5 aee8a0baab0b19940d95453db53c7c50
SHA1 f5d3ed2d71c930e7833c4f089631863c48b79f5f
SHA512 7787306cd47d51d20d1a6b64f410e5dd80cb0e4714026a4dea5f27b176fa99fa134c79ce823962e14182ceccce1f775b4788cff77575db44eaa104c736e5af7e
SSDEEP 192:sxRjRkfb51/fPsP3KzoA8p4V/g6+WNIYueiYGbIgIJ:sxRjSD//fPsP3o/5Ids
TLSH
T16A2296156E28A97B8CCBD20DBB55BF53D2FD1132A1D15E48B6FC962C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15fe0f76-dcb7-4769-ae93-a9f5bf0ba2e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\15fe0f76-dcb7-4769-ae93-a9f5bf0ba2e9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad634c9b-ebf7-4797-b21b-e91d92330fba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ad634c9b-ebf7-4797-b21b-e91d92330fba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f43da5d4-d15f-4ff6-8a5a-268155ca5f57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f43da5d4-d15f-4ff6-8a5a-268155ca5f57.tmp
Size 34KB
SHA256 b075bced6fa6268b29e8ce18e8053508a9e53192af18274000f8bfad9f438e1a
MD5 3c37cee79964b7d33163f0e47416333b
SHA1 038d5b2b5c1128e782983ce6134b8758617ea76f
SHA512 ac095fa0ca2ceda991fca47d624c729ff86b60691140289d158b0d378a415fa5ba553912428706d16b26bd03d952e81a7f01a6d05fb1c9e7ceb734e8f636771a
SSDEEP 768:5Lg3mG0ISO5ytrbAMIYNa8S5oYklnA+A2s4t:dg3mG/Wv6TWRdA32s4t
TLSH
T144F2BF36A9A4E9B35CFA93C5B607B3436EE50223D1C55BD888EC1B5E06C76BF1303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff620ec0-d54c-4941-b8e7-437087b722b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff620ec0-d54c-4941-b8e7-437087b722b5.tmp
Size 34KB
SHA256 765ae45519dc1533fc7aeba657d962a6bd0cd0800a6b3a7353e0e66308798457
MD5 175eb7af8291daac09acc0f86603faff
SHA1 17b77e955d32bf2ce601437a89ea30f51f7fc687
SHA512 ffbd62da679e688f2d322865e4f3b43c7f90cee27c35f86938439a618c1dd9a555d12c21a81d218cd6ba4a98fd51392341b1ad4e96279a11a58dfb12869702d8
SSDEEP 768:/g3PgISO5ytrbCMIYNa8S5oYklnA+A2s4t:/g3PrWvYTWRdA32s4t
TLSH
T1A2F2BF36A9A4DDB35CFA93C5B20773436EE50223D1855BD888EC1B5D06C76BF1303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download