ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261002-sgpyessfla
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{E69C73F6-690D-442C-A634-1108E01E77DB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1404	2792	msedge.exe	86
PID 2792 wrote to memory of 4856	2792	msedge.exe	87
PID 2792 wrote to memory of 956	2792	msedge.exe	88
PID 2792 wrote to memory of 956	2792	msedge.exe	88
PID 2792 wrote to memory of 956	2792	msedge.exe	88
PID 2792 wrote to memory of 4272	2792	msedge.exe	90
PID 2792 wrote to memory of 4272	2792	msedge.exe	90
PID 2792 wrote to memory of 2464	2792	msedge.exe	91
PID 2792 wrote to memory of 2464	2792	msedge.exe	91
PID 2792 wrote to memory of 2464	2792	msedge.exe	91
PID 2792 wrote to memory of 464	2792	msedge.exe	92
PID 2792 wrote to memory of 464	2792	msedge.exe	92
PID 2792 wrote to memory of 464	2792	msedge.exe	92
PID 2792 wrote to memory of 1840	2792	msedge.exe	93
PID 2792 wrote to memory of 1840	2792	msedge.exe	93
PID 2792 wrote to memory of 1840	2792	msedge.exe	93
PID 2792 wrote to memory of 3056	2792	msedge.exe	94
PID 2792 wrote to memory of 3056	2792	msedge.exe	94
PID 2792 wrote to memory of 3056	2792	msedge.exe	94
PID 2792 wrote to memory of 4972	2792	msedge.exe	99
PID 2792 wrote to memory of 4972	2792	msedge.exe	99
PID 2792 wrote to memory of 1140	2792	msedge.exe	100
PID 2792 wrote to memory of 1140	2792	msedge.exe	100
PID 2792 wrote to memory of 3220	2792	msedge.exe	102
PID 2792 wrote to memory of 2268	2792	msedge.exe	112
PID 2792 wrote to memory of 3612	2792	msedge.exe	113
PID 2792 wrote to memory of 368	2792	msedge.exe	114
PID 2792 wrote to memory of 4200	2792	msedge.exe	122
PID 2792 wrote to memory of 4200	2792	msedge.exe	122
PID 2792 wrote to memory of 4584	2792	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff8b66fc188,0x7ff8b66fc194,0x7ff8b66fc1a0
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,7360157433220545739,11077671014641795816,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15537997191167080268,644672517411723051,262144 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,18067434042260650529,7463574798352435202,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,4129098072777435671,2396905146941171966,2097152 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,6161355495303918589,16908461398751048674,2097152 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,5234231775142430061,3470443687275745496,2097152 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,4313881472192007569,1001278136168576856,2097152 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,6170654248411835374,4786255379374997465,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,17429484177787390732,3453319354001542829,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,5213047754726223338,14223746794446340204,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,5213047754726223338,14223746794446340204,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,9129688064719595066,2887885718766086959,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,13165618950343307011,15201938712952300988,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,1280156262603931456,14772112234455222474,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,3036093261718260756,17638297843435595210,524288 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1008,i,15306726223827990788,1720616363268259311,262144 --field-trial-handle=2196,i,11850111328315341475,7650544684423419383,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e36c51b-3ab6-4afb-9984-c66e2da72e2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e36c51b-3ab6-4afb-9984-c66e2da72e2e.tmp
Size 18KB
SHA256 2fe35871355cd865d931e490b4008e993dc890b3056b8e45d923b8f41df9b8a0
MD5 3ebabcf0ce77cc386ddad2d3454a8ae2
SHA1 fe42d9981511254d7afdef8744045a48376e593d
SHA512 f0acf0011c0b5d0095c91e979c07b76d5b683ac2063027d4365eaca332221d6a9c970ef935df4002078a70f23b31f3bb1e1c0245187e16dc6d7ec158683517c0
SSDEEP 384:CZcIhsNPQVNZ53Uf4HX58EvOeJB3JryjtgOIwZOyLkoVos:whBgfWa8OY3hyjXsIVf
TLSH
T14A828D32A9786D7B69FBD145F58736039FB88027E2C56F80C5ED6B1D01DA6AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

477a7966-7c43-43ea-baaf-9be5ffbeebd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\477a7966-7c43-43ea-baaf-9be5ffbeebd8.tmp
Size 8KB
SHA256 af9ecd36e2ec440c3fe9469240c7d1e25939f63d481b64a576742a5de0fb8a21
MD5 7755e22d535a8bab55fa6fda4eba4f50
SHA1 9279e94e0b2bbd975c59d6fcea355041daca9849
SHA512 bc54cb13931cd459061ef17fc77c5110245d01c141f71c2033c0086529518cd191f7c2810f852e2d7c0678776993f7140bb8ae5933097d602d2056b8041e49b4
SSDEEP 192:1ONgV6wlDgQmiUyQQW4X58gZvOKNJ7Dl39U6:1ONu6kgoW4X58EvOeJdtU6
TLSH
T11302F938F9687C7B8EF2AE09F58737139FE5116BE5552F84DAE81A1D00D729C1306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75c85e18-581c-4a6d-a994-ed25572cbcdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75c85e18-581c-4a6d-a994-ed25572cbcdb.tmp
Size 18KB
SHA256 0900f4b63f01f7d5d70fe0b3941e31578c3dfce53feaed8534aa237db62e86de
MD5 7ebda92844c7f074273a7af119cccab1
SHA1 775c70ce920bff3c01f258a03066f216edd97c28
SHA512 a14694ef2875f82df514eae9c5b5c05626c8645426e70cd37d3f411394ba4e3be02997106418f6a737304c1e3889ecca9ebcbcdec3e5659ce13fe01f06659e2d
SSDEEP 384:PZcIhsNPFVNZ53Uf4HX58EvOeJB3JryjtgOIwZOyLkoVos:HhWgfWa8OY3hyjXsIVf
TLSH
T114828D32A9786D7B6DFAD145F58736039FB88027E2C56F80C5ED6B1D01DA6AC130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9840f44b-3253-46fc-bd4f-1f670119bf8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9840f44b-3253-46fc-bd4f-1f670119bf8e.tmp
Size 21KB
SHA256 bd0648948b25fca8e20b116d14299e412ff328524cda2823cb7574c3ecbe262f
MD5 a4e3d5a6d67c7e0ea280bacf9731ca3f
SHA1 b82abf51eaf2b1c54b72034e30786a65edf44712
SHA512 a064d69b5313e2ecb736331baa47dc32429dc9ba8e2200bdc0246d38ff36ee7dd1abba00eb41745a38e2fde0144dc819be65dc2d4fba29e7af7e1c863c340400
SSDEEP 384:ViFiZcIozsNx8TUNTUlIlQVNZ53Uf4HX58EvOeJB3JrrjtgOIwZOyLkoVos:cFQUwwgmgfWa8OY3hrjXsIVf
TLSH
T10DA28C3399A89D7FADFA9A45F68B3203CFB48067D585AB90D6DC6A1D01DB1EC030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

07b63251-2646-4cdb-ac83-49344f181c4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07b63251-2646-4cdb-ac83-49344f181c4b.tmp
Size 27KB
SHA256 9f3fddca2f7fc18ec5540ac701e7f0e05ac374910891ee5e5be2ad0f53a6bea8
MD5 1c1e2ed81538546c2fdabfc59009a4ac
SHA1 117eca5ba3577c17323e1dd71b479b2171af43db
SHA512 31ee85b1a6c4f13df9213c386a550e54ee1512f101c9cd3a82e01aa215ab18861901367f76f14718825c13c0b90c1c0cc60ce4bb52d4eb789a9d3510e47e71a1
SSDEEP 768:qny4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TblroR0r:qny4J/DWvbtBhu1jajiLm0beKr
TLSH
T1C6C2FB3B644CCB7E4FC00A9DED5E6F973E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1de565c6-85e6-44bf-b3bc-35b3128c05d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1de565c6-85e6-44bf-b3bc-35b3128c05d8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

563871ef-aefa-47a5-8c50-6c5d58649eac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\563871ef-aefa-47a5-8c50-6c5d58649eac.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58be838a-b749-42f7-a83f-f66fb2040368.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58be838a-b749-42f7-a83f-f66fb2040368.tmp
Size 9KB
SHA256 5366a9489db9b522467a102f196abd7bbf58e8334538714561461063540aa973
MD5 86347b5b60b43f9f2654dc0ea4040ec7
SHA1 8e3baa3be531b1ce7b7bff67b8816131e16ad241
SHA512 431bbf2749910acefb1070da80f9c16401f386eb096c6f6c6587b095d564cc7fcbe2ded1021ab0730dfadb6648fe551336c46f2dcb15eeb59b1d878f838527bd
SSDEEP 192:sxZYRtWR/fYsu6IdpdqHW6+WNGYrbR9IgrJ:sxZY6R/fYsuTAHbGO9
TLSH
T19E22B8526E28B97B8CCBD20DBB197F53D6F9503251941E48FAFC961C09E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

672a2956-9c0a-4d79-9217-9a486f6324cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\672a2956-9c0a-4d79-9217-9a486f6324cf.tmp
Size 10KB
SHA256 b97a28781d8982064de4d819d29c0094f27b46e6028043427b63fb1d57384b6c
MD5 4fb45ec69da6020aadaca9a4c7f99c77
SHA1 40aabe9c82b0cc9720eb40900521eb6f7c0a5378
SHA512 eb3bb83c20c7dbc1b31f8501ba9b17889145836a2cb8eb59dd636d4d4a9dab598785b1f69f219dcd04a9f4ceada403d5a8028142867b0bfdfd9c07fd391ee884
SSDEEP 192:sxZYRtWR/fYs26IdpdqHW6+WNGYrvR9Ig5xJ:sxZY6R/fYs2TAHbG4J
TLSH
T11222A8526E28B97B8CCBD20DBB197F53E6F9513251941E48EAFC961C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 b99629b5ceb165bdee0dc5180001f4de2fabc429b4caabeca4087f69ca49c93a
MD5 9610c577137ebd798ffd2846aec884e5
SHA1 4d42189e7daed6476d200e85a73e3320e3f4eaae
SHA512 fd6eca2b59739a9fec07ff98c64e4c72d4cbefa96e6c7331e016b195971cc74b87f6f4dff7ac42699567c956baddf897452c575357e3955c3628139d69bc4668
TLSH
T17151F948A5F046B7F7E84535D1F316CB36308F6154833E520496F7BABA4A358CF05856
MD5 SHA1 SHA512 TLSH

Submit Download

d6443158-0179-4d12-a947-c396f6ffbcc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d6443158-0179-4d12-a947-c396f6ffbcc5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

16aafdae-4d8f-41ae-ab1e-cd8141a58244.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\16aafdae-4d8f-41ae-ab1e-cd8141a58244.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

382d74c9-aca1-45bf-9fb2-953b31e7d140.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\382d74c9-aca1-45bf-9fb2-953b31e7d140.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

582575ee-afe1-42f7-a766-b4b6c190b221.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\582575ee-afe1-42f7-a766-b4b6c190b221.tmp
Size 733B
SHA256 81573298ea86cd733d99a8d0447af9b6fa782682405b14fe1b1110edbf25801f
MD5 4e9b26774afc8b784ce54ca27b806d0a
SHA1 8a3b27acab1886059ea40a21925432f2c7e9b4a6
SHA512 ae5ce43c4a18c357d03dd9c6490e0a89874f4216c4fac300012763dc5f257f881e78662174c3d04ec94c632dac03e87ae3c0447c7afca22326103c05045ba418
TLSH
T1980190F3C3E4956E8E0052F06614AF17CE2C0506431C7C1AD5D4AE2B93F3475E00199B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 096e62f09b9e3ccfd60814b22f32e1e753394269bfa65dca9f6b66915bbadd6b
MD5 39231b80d5433e4d8f3f1a4669b23cb6
SHA1 8c1475bbd9d3c2a4ad4c83ed73d2bf88452ebb20
SHA512 c0a6536fc83bcc45636cd9e240c02de7a0ebc0dc9a3fc4c37bf0270c2d90ba58ecc163fc58bf6d87a93dace637f8700b2e86299215daf3595b463c005808fcaf
SSDEEP 48:KIDI1Ks04jyLEzy+suCLbyB6ISWLK9y1ALxEbYJqC4yLpBpQp9pxpbpfpjp8bpPz:KIDCKs0+uzeKEIOSc4KR20xAdRbJ
TLSH
T146912E5170FB131538BD29888574D76A028236B33168EE6F7FBC44A58E6BE044DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b85639d6-72e8-4551-936b-09b897238b70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b85639d6-72e8-4551-936b-09b897238b70.tmp
Size 10KB
SHA256 63216aad599e86f0fea6e066d38af72730e4ec01f7ffd45434fe247899846957
MD5 8a1a4bd962b290624eb750f33d742e8e
SHA1 9834eed122d8494e4262f12903f5dc474ed4f309
SHA512 81420cdb44be438dccfc541af44ba8d1b5a213c2e8444cfba77db48a667826a6bc6909fbc4fb9d053aef506eb1f140510ab300f0600e1fdf9bbc163639416e74
SSDEEP 192:sxZYRtWR/fYs26IdpHqHW6+WNGYrQR9Ig5xJ:sxZY6R/fYs2TKHbGfJ
TLSH
T1B822B8526E28B97B8CCBD20DBB197F53E6F9503251941E48EAFC961C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c25d5384-4029-42cf-b159-67ef5a8ae46f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c25d5384-4029-42cf-b159-67ef5a8ae46f.tmp
Size 9KB
SHA256 71d46dba0656b5d604619067dfa1fe71c0efff49257687697f672ba36a10e897
MD5 2c86f162950bd12195207029fd304278
SHA1 09e0b5b1b0e64d4afe75abf05405c6e655f7eb14
SHA512 075e134fb27f81baa5bf072d7cbcc861990d4b6c543730de8cefd970974e4e5b5a15ac7376fe5b8666c055cd5df2e38baabafb8d60a6cc79179ec830355f6416
SSDEEP 192:sxZYRtWR/fYsh6IdpdqHW6+WNGYrbR9Ig5jJ:sxZY6R/fYshTAHbGOX
TLSH
T14122A8526E28B97B8CCBD20DBB197F53D6F9513251941E48FAFC961C09E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26477e55-318a-46d2-a78f-1b28ab46f6d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\26477e55-318a-46d2-a78f-1b28ab46f6d2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b9ff2b6-3fc9-40f7-9d5b-21710866c48a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9b9ff2b6-3fc9-40f7-9d5b-21710866c48a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f9b84221-4387-40f3-9946-3c851f068add.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9b84221-4387-40f3-9946-3c851f068add.tmp
Size 8KB
SHA256 184154ca57f7aa68348a967aa36944024647119f056bf93d691658abd6b31abe
MD5 b970400a1c96fde136a68f3acc523156
SHA1 63aaf812c5f0c9edd0d1ca5da92b26cd38fdc0a6
SHA512 ab2716b73fc463bed58d69f9ef236dc08459d72066cfc60d1ed44b368bf02df04a91f8d0e80c34299c7d5973ed3bb4b2751f8bc3bce227d94f26712925f95554
SSDEEP 192:1ONa6wlDtQmiUyHvQA4X58gZvOKNJyqwSJrQvetqOU6:1ONa6krk4A4X58EvOeJB3JrrjU6
TLSH
T1AE122B36F568AC375DE2A545F48736139FB54127E6856F84C2EC2E2C01DF2AC230EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 199d87642339087ba2cffac9a395d976960ed6873cdf110c626c4871f4ed24fd
MD5 719c3970a578581ff122eb9825276c57
SHA1 563ff382b4f399de71d3202a9e397725a0c52540
SHA512 99b27355b958d2e03b443af8cd6a44b6f10fd71f2fb9765450717711a8c2122e912c0342c88255c0599f218704f2bdf04736cf7b89977699ce432dbf7b08c3ff
TLSH
T1FA414858A6FA1148B3B76F5AABF6A86D447BBD771E0AD45E00110D4E0962B00C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3220-181-0x000001E2B2200000-0x000001E2B2349000-memory.dmp

Download