hxxps://blackhopchwarz[.]top/

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://blackhopchwarz.top/
Sample261027-rv2npsew8p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2252	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{6F6E394A-E96A-457F-8E7F-E01E66329BCA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 5320	4628	msedge.exe	84
PID 4628 wrote to memory of 2252	4628	msedge.exe	86
PID 4628 wrote to memory of 5852	4628	msedge.exe	87
PID 4628 wrote to memory of 5852	4628	msedge.exe	87
PID 4628 wrote to memory of 5852	4628	msedge.exe	87
PID 4628 wrote to memory of 2776	4628	msedge.exe	88
PID 4628 wrote to memory of 2776	4628	msedge.exe	88
PID 4628 wrote to memory of 2648	4628	msedge.exe	89
PID 4628 wrote to memory of 2648	4628	msedge.exe	89
PID 4628 wrote to memory of 2648	4628	msedge.exe	89
PID 4628 wrote to memory of 3664	4628	msedge.exe	90
PID 4628 wrote to memory of 3664	4628	msedge.exe	90
PID 4628 wrote to memory of 3664	4628	msedge.exe	90
PID 4628 wrote to memory of 5648	4628	msedge.exe	93
PID 4628 wrote to memory of 5648	4628	msedge.exe	93
PID 4628 wrote to memory of 5648	4628	msedge.exe	93
PID 4628 wrote to memory of 4248	4628	msedge.exe	96
PID 4628 wrote to memory of 3144	4628	msedge.exe	97
PID 4628 wrote to memory of 4248	4628	msedge.exe	96
PID 4628 wrote to memory of 3144	4628	msedge.exe	97
PID 4628 wrote to memory of 2288	4628	msedge.exe	100
PID 4628 wrote to memory of 5476	4628	msedge.exe	105
PID 4628 wrote to memory of 5476	4628	msedge.exe	105
PID 4628 wrote to memory of 5476	4628	msedge.exe	105
PID 4628 wrote to memory of 4368	4628	msedge.exe	106
PID 4628 wrote to memory of 4368	4628	msedge.exe	106
PID 4628 wrote to memory of 4368	4628	msedge.exe	106
PID 4628 wrote to memory of 4664	4628	msedge.exe	107
PID 4628 wrote to memory of 4664	4628	msedge.exe	107
PID 4628 wrote to memory of 4664	4628	msedge.exe	107
PID 4628 wrote to memory of 5924	4628	msedge.exe	113
PID 4628 wrote to memory of 548	4628	msedge.exe	114
PID 4628 wrote to memory of 5568	4628	msedge.exe	115
PID 4628 wrote to memory of 212	4628	msedge.exe	117
PID 4628 wrote to memory of 212	4628	msedge.exe	117
PID 4628 wrote to memory of 1428	4628	msedge.exe	118
PID 4628 wrote to memory of 1428	4628	msedge.exe	118
PID 4628 wrote to memory of 4468	4628	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://blackhopchwarz.top/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ff8e7a0c188,0x7ff8e7a0c194,0x7ff8e7a0c1a0
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,9689575230458966809,5888414623580963006,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,5814372672696348074,15498049549311908151,262144 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:2
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,4861091168985682997,2337026867789414479,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,12073969627072488688,12993165260403764633,2097152 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16243536938843982588,5897986275066465601,2097152 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4968,i,16132261654994901109,5853678347417959198,2097152 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,16414025652008911347,8534900905468202414,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,2057003205649630517,6510237694889106116,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,6020745792479066033,4100686310307107764,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,6020745792479066033,4100686310307107764,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6056,i,6198738364330057599,12271619963604581016,2097152 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,9270012426713141551,16996906391785640998,2097152 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3512,i,11369951477492954929,15945142935864643939,2097152 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=684,i,12494449987590945701,16935222265050301777,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,10144510679503322492,3917517854813166876,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3759735130601369508,14359784792338780472,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,11289609678715643873,4612143312588179597,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,1843522312609404283,5540523177145815619,524288 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,6165282082918714166,17211964096151169152,262144 --field-trial-handle=3068,i,4838476498373169091,12369396652072417918,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05510c98-8ecd-4b90-8634-553c6894619a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05510c98-8ecd-4b90-8634-553c6894619a.tmp
Size 27KB
SHA256 7f4e0bc909e575e592bdc091d9e5ca51c76f400896d9d5bcdeeac244e112ac9b
MD5 886e8fba6b74c4165afa445597608206
SHA1 d676e46e351add49008ea1460419ae7730434807
SHA512 e9f0ff96e99abf78515eba100049aa24ef55c50b71cb1682b0cbec320ab3e7fe19a15919ed6af4b11d753f985a4c7b032d113c1b43c3e5d4f7d045dbc6e782b9
SSDEEP 384:nriFzQkUSvI3sNU8TUNTUlI4Z5mg2JjK2flBVTPUVYD4zvaTZceHlgL/7IzYIIlw:GFdI3xwgVnVBVTPvGvaTZceHqLe
TLSH
T1B0C24B32E8A9D9BB9DEB4F95A70A3643EEE04253C68C9AD4D5CD4C5C00DB1DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f599b6f-2124-446c-8ba8-41ea75145b11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f599b6f-2124-446c-8ba8-41ea75145b11.tmp
Size 26KB
SHA256 2558901e309f95bf8324442b002ee127a215bd5de7a010491a9f68e287907e4a
MD5 998f712392fa936c504d7e0897330c35
SHA1 6607153c2b8d03f6d006ca07cfc8f758914e854f
SHA512 428a8e489845f236533e519c90ca72445922d120f73c169d0a59652f6d1f3202b21c612c4a0ee71f1f747b2a95eed565b8a70f77f00aa8fafed125c655ebc663
SSDEEP 384:noiFiZcI63sNY8TUNTUlIm25mgyRQK2flBVTPUVYD4z7O6R2FeoCWgL/7Izgow:zFQ63BwgSXGBVTPPG7TR/N3
TLSH
T179C24B32E8A4C9BBADEB8FD6A74A7607DDF04253968C9AC0D5CC1D1D009B5DD530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

07f2eeec-430c-45a6-a046-7a2dcf9f07ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07f2eeec-430c-45a6-a046-7a2dcf9f07ca.tmp
Size 12KB
SHA256 e5a3447440ea4cd48b984246f80f934b36348191e73b068297f8c5a67b7b50e3
MD5 dd03ed0e783f46c0cd70a35e69e0872a
SHA1 4751395826a87b33f950e6a4b4f4b50013fd810d
SHA512 aeba0a236d08a311d42a953e126e70c474ddd9e4fa374f94a7420a880d278d7bde965978dba0f88cd2c26d549d5856affdc4464cde98b9d91f563e3dc922e67e
SSDEEP 192:sxZgRukV/f6sEQZZUazodptzuHW6+WNpmED/YbIxD9Y1B+Ig5MKaJ:sxZgDV/f6sEOZUhoHbv/FXY1oCL
TLSH
T11742D815AD38A93B8CC7D61EFA59BF53D3F9503290941E84AAFC8A1C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

496d2f8c-ce05-4a81-850c-d0c8a82356d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\496d2f8c-ce05-4a81-850c-d0c8a82356d4.tmp
Size 414B
SHA256 420984d70eac431f90afdda4f7d04d9e4750cc825edfbb5e99c0c2974a5059d3
MD5 ebc81bac79ccffbc439210719e86eb57
SHA1 951d6c762ef6c09e185655dc031c913cb0944224
SHA512 6597aa94b344ddcd14d0c1e7d77ffea122cb40d1478741b615932a8a07dd616906eac6941fccd127c7c02321af5ffc8c47cc8c459540bd79b84d0957ff72c2a7
TLSH
T172E02BF5C816BC3709FC5B2850640646EA5503472A80848B3B3CD41D8FB1736458A96C
MD5 SHA1 SHA512 TLSH

Submit Download

64bbb284-af5c-4e67-b610-ee51e4c1cfca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\64bbb284-af5c-4e67-b610-ee51e4c1cfca.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

799c2db1-b30e-49fe-abba-36eef0f3e3ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\799c2db1-b30e-49fe-abba-36eef0f3e3ce.tmp
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 111f26221962df5724168811f08498f8559bed9c45547b3c535722027f5e154c
MD5 66ac69a3845692e34a9e4e3bcb6efba8
SHA1 73ebc4e4de00d4d630d21201fdd60b1f77535aa3
SHA512 cad0d3e08eb89f36bd16a7a764c115920b2b496015846bb66dd0133251b007e795f6ada4bf9e7eab93b3224f6a29b9aa6463ce9f5fd3c130b57c54b965691d9a
TLSH
T199E026C414CAC36FA218668B026CAB0C8B91265ED2D0BA9E1700CE84720B054F3D26D4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 24c645b51922f1420d2628ad858d979f128d589b3ec1a33bce8883ad2e2b4924
MD5 90329fd15c8946a6eca590b3fe10d211
SHA1 06996bd992204324168b421c48cae984d6f98dd9
SHA512 797d52af678f74dad871c5068f4e4bea373a9ebb519deac45945f869d814e936b9d47a64609fe3e9780f11b3d66234b5f6631331579b55d790a231111e7fd74f
TLSH
T14361D7818843B027D3982031A3DF32CB393474B1B6E7AD1207ABEDB68B4F7494D07082
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a921bc3832d279231bdf665d3b264dcc4d0f5430d80ca0cfb4b4adf1b70fcbd
MD5 1bfe04f4d8057a65ec5f2bbcbe26612e
SHA1 931ee4ff98829191326b85dd89b5ca7f467f03dc
SHA512 42421014413fbdcf9085d5f0dea3abdc2eea3902df9c59925d2d1bf96019eade93946390a7a4f6c43ef3d99210977e3f61f135aa2b8882954fa552a7a1dc42ab
TLSH
T11F61C6818843B427D3982430A7DF72CB393478B0B5E7AD1207ABED768B4EB494D07082
MD5 SHA1 SHA512 TLSH

Submit Download

822b548c-e3bc-4b24-a85b-f601a2d74b85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\822b548c-e3bc-4b24-a85b-f601a2d74b85.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5546f85b-2465-432c-8e18-dcd4885fd150.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5546f85b-2465-432c-8e18-dcd4885fd150.tmp
Size 3KB
SHA256 46628a215cef226dbbfcb57881d8680070b60b20f43ade1de42f9cc04d02054d
MD5 ebd701b76778941df93e58b79cae2d19
SHA1 3c94d1cf072765267af2d3d8ad10017b0be9a432
SHA512 9f450509c8332262afc7e80313061cfd3683bb349e9f15b62efec8f1731ba8cad83b0e4f5d2ca3b4354e2329cac0d3567417685bf5448609484af3e045989fea
TLSH
T12981EBF2C7E9822EDA0556F0AA187E3BCF6C091493683D1A8DD4DF1B93F24B1E14164E
MD5 SHA1 SHA512 TLSH

Submit Download

bc610e21-77c4-454b-ae1b-daba8087cf2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bc610e21-77c4-454b-ae1b-daba8087cf2f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e83e96e0-9b00-426b-9fe7-303fecf98153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e83e96e0-9b00-426b-9fe7-303fecf98153.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 55d5cacf716204999507f9b9d3ecf32bf03dafb444b3ee72b479ba6e6d7827b1
MD5 e6043805598604204f41a1fac0806488
SHA1 35b8d17ac0ddc8af3f1ba36521e39c0201030ca9
SHA512 f1bed4dc9218991fb42bca33f951e663d25e9627b61bf415e2896852a18d9168ed3f373157e9b316c4e85e72723c41225d9f28b997c90a6cd214427e38e1d5b4
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX47fmh:OtfFvpopPxrB4Rhf4Tmh
TLSH
T1DBB2321471BA121038FE790C81B5972E464232B33259E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

af3a9260-3bb8-4131-aeca-e1b603939dd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af3a9260-3bb8-4131-aeca-e1b603939dd0.tmp
Size 12KB
SHA256 04531127b39125b3c2adfc686cac33cc560f49875a658b4b60787fb39aceca29
MD5 21d64b3f232bb472c0439274b62a06d7
SHA1 4375963de677133e031296ff92fc1f0153cffc98
SHA512 3b88a06562df2af1e6cf1855654fdaa6327c04958b2c1db8809d158bd20f7025a9ed2aa4157c10539be6ee7efbfe31fde998c8ac745c15d3f2b25f8b8b3ca7fd
SSDEEP 192:sxZgRukV/f6sdQZZUazodptzuHW6+WNpmED/YbIYD9Y1B+Ig5MKaJ:sxZgDV/f6sdOZUhoHbv/FEY1oCL
TLSH
T18B42D855AE38A93B8CC7D619FA55BF53D3F9503290941E84AAFC8A1C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59bfe8e-1a3a-4634-a925-12c521d3a1b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e59bfe8e-1a3a-4634-a925-12c521d3a1b0.tmp
Size 12KB
SHA256 2b47cc5d2f9400d8bd7ea9d6b57fbe1826cc64edd60012de14a7a6210838b081
MD5 ef1e51e517f99e581a0f665a248bde56
SHA1 f74d9fb8ca79500ddb21d210ed7cb6da3d1a3b80
SHA512 6983458685cc0792a3622498578afad95116a7ecc7aea02732ab96cba0f1891356a0012aa0ddf5bf80be4e682089c6fe1e6fe1a51b7b740398caae4851c2e4a9
SSDEEP 192:sxZgRukV/f6sLQZZUazodptzuHW6+WNpmED/YbIxD9Y1B+IgjKaJ:sxZgDV/f6sLOZUhoHbv/FXY1ojL
TLSH
T13C42D815AD38A93B8CC7D61EFA59BF53D3F9503290941E84AAFC8A1C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c44fe7a8-c065-4b33-903e-97e330e1b2c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c44fe7a8-c065-4b33-903e-97e330e1b2c6.tmp
Size 32KB
SHA256 b53e1933db79bda35c6e700b368363a3d1e53e379e196a1dad0b4016cdb2a628
MD5 8e7359916326b083280076ee1ad4b4cb
SHA1 e35014ca8ce8f3a0f2b709f64310cda323315074
SHA512 9320630233802d2d72e11f691cd6466837354b1bdac9299da19e4e1b40bc3d4b1431a25043ea2e9ffd3d7f40d0ef0139f64d5aa2ef4e50ed363a6723a5e95243
SSDEEP 384:nkiFzQkUSvnHsNU8TUNTUlI4Z5mgxjijK2flBVTPUVY84zvaTZceHlgL/7IzYIIe:/FdHxwgVrVBVTPYGvaTZceHqLe
TLSH
T15EE292F1A8D79977D9AE4B97A33D2D0299FCC113B5885A84B7C90C1CCC961BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f07ecdea-e10d-4dfc-808d-ff778226f1ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f07ecdea-e10d-4dfc-808d-ff778226f1ac.tmp
Size 27KB
SHA256 80d13c4044914b7bf7c9ea5ec3179370b35b7f8e9934bcba6e44d5c9bf859546
MD5 40109669129914f148d8bd149b4f0a01
SHA1 9a4d5ed3796cccc35860423d3f2eeb10f5646345
SHA512 ddeece4a5764711d7ae788e52fe4c93c3399182649af1f72899d7cdca14264460be92e3da782c6ba1bc8f6d39a587de9d33d41da2114ab6c6e93e05eb356de7f
SSDEEP 384:nTiFzQkUSvUsNU8TUNTUlI4Z5mgxj9jK2flBVTPUVYD4zvaTZceHlgL/7IzYIIlw:+FdUxwgVEVBVTPvGvaTZceHqLe
TLSH
T187C23B32E8A9D9BB9DEB4F95A70A3643EEE04253C68C9AD4D5CD4C5C00DB1DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe7b90ae-e146-414e-bbc4-d9e144edd93e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe7b90ae-e146-414e-bbc4-d9e144edd93e.tmp
Size 25KB
SHA256 77a9cff94733bd823d3b2e4926d4479436da11de9333feb44573219f15fd5afb
MD5 34f336470250ec077ab67832bf5c60e2
SHA1 1d9c9f3f7e17f1faa8058e1d16556f5947402cae
SHA512 8a774ed79a95bfb3b63038040c36f6ebdcb4ee8632fc05ef1b0ed00f0fe4db565fd2eba270d54f041210f94bafa09645801881d6209289b7c6112b96b6034b8e
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg5BnK2flBVTPUVDV7O6R2FeoCWgL/7Izgow:qFQ63AwgSOJBVTPyV7TR/N3
TLSH
T124C23B32EC69D9BBEDFB4F9AA70A7A07EEF00163959C8AC0D5C85D1D009759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bd979721cdbd631b55e5cf43370ce6487f35c192e362929fc0bdce46f6a58865
MD5 08c4bb50cd047b082e2e7e06255a3069
SHA1 d3ee0d1612fd0492eb53a8641e3cd15bf2838570
SHA512 faf8dc922f0880cfdcaf4fa68ca7b1cc187a51420860e527973036e0e04339826df1174a59da39ab4dae9aea7616711f6ea89a948ff6ecab0644c8bcd0f24819
TLSH
T1CB412A5CB6F91148B3B72E1AAFF6A86E187F78772F4AD59D10100E4F0622A00C871737
MD5 SHA1 SHA512 TLSH

Submit Download