hxxp://sodexoretail[.]de

Analysis

user interaction
yes
max time kernel
298s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sodexoretail.de
Sample261102-lxflcsa13p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4156	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{98E2A2DF-EAB2-4842-B8A6-93B15C77E837}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5652	msedge.exe
5652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4580	4540	msedge.exe	84
PID 4540 wrote to memory of 4156	4540	msedge.exe	85
PID 4540 wrote to memory of 3788	4540	msedge.exe	86
PID 4540 wrote to memory of 3788	4540	msedge.exe	86
PID 4540 wrote to memory of 3788	4540	msedge.exe	86
PID 4540 wrote to memory of 3684	4540	msedge.exe	87
PID 4540 wrote to memory of 3684	4540	msedge.exe	87
PID 4540 wrote to memory of 5184	4540	msedge.exe	88
PID 4540 wrote to memory of 1344	4540	msedge.exe	89
PID 4540 wrote to memory of 5184	4540	msedge.exe	88
PID 4540 wrote to memory of 5184	4540	msedge.exe	88
PID 4540 wrote to memory of 1344	4540	msedge.exe	89
PID 4540 wrote to memory of 1344	4540	msedge.exe	89
PID 4540 wrote to memory of 5172	4540	msedge.exe	93
PID 4540 wrote to memory of 5172	4540	msedge.exe	93
PID 4540 wrote to memory of 5172	4540	msedge.exe	93
PID 4540 wrote to memory of 752	4540	msedge.exe	96
PID 4540 wrote to memory of 752	4540	msedge.exe	96
PID 4540 wrote to memory of 1932	4540	msedge.exe	97
PID 4540 wrote to memory of 1932	4540	msedge.exe	97
PID 4540 wrote to memory of 780	4540	msedge.exe	99
PID 4540 wrote to memory of 5080	4540	msedge.exe	111
PID 4540 wrote to memory of 4520	4540	msedge.exe	112
PID 4540 wrote to memory of 3016	4540	msedge.exe	113
PID 4540 wrote to memory of 4468	4540	msedge.exe	115
PID 4540 wrote to memory of 4468	4540	msedge.exe	115
PID 4540 wrote to memory of 804	4540	msedge.exe	116
PID 4540 wrote to memory of 804	4540	msedge.exe	116
PID 4540 wrote to memory of 4944	4540	msedge.exe	117
PID 4540 wrote to memory of 4944	4540	msedge.exe	117
PID 4540 wrote to memory of 5652	4540	msedge.exe	118
PID 4540 wrote to memory of 5588	4540	msedge.exe	119
PID 4540 wrote to memory of 5588	4540	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sodexoretail.de
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffdef7ac188,0x7ffdef7ac194,0x7ffdef7ac1a0
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,8970826416090564686,769686700046158407,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8607698651701428758,5563555057733204349,262144 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,4378045819266645811,7693982637657298576,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,5971679430697556929,13114678266927171708,2097152 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5991842595834438724,12938412757007025739,2097152 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4820,i,9457572150637828157,14738155820508646622,2097152 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,5496924631838805721,9911194339468287280,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,18171258434931791913,10593705956230208353,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,303621700266246101,1604525570989959867,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,303621700266246101,1604525570989959867,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,12865609960328813452,14911373751017609482,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15720926735023086736,18442187339828727142,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,2717195011415324106,10545853424666841063,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,13207132093624058774,6684657415994764462,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,17283489662126264872,3899271649492272968,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,14145258009317187906,2336676165077012824,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5096,i,3528520646520739654,1120644824458139079,262144 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,9537848815730181329,16496318290247659809,524288 --field-trial-handle=2300,i,14647716186316419094,9041372752092187933,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

29bd92da-07b5-4422-a923-2e6028318793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29bd92da-07b5-4422-a923-2e6028318793.tmp
Size 25KB
SHA256 65ea2b4accb2356977fec427cffcc015be59e78515438b6dceba39c0474f89b6
MD5 685471d37d4d42263c3ea957f9583758
SHA1 fc2d4e6639cbbd31663db41914529900c3f733fa
SHA512 fa39bb5f0cee9ac0a89de22388963355939f61c62383d7b80ae7156988c89013e4c7deb5f121484d1860967a83fe1510632389358dcd606144a409b97d60b8af
SSDEEP 384:n7iFiZcI63sNq8TUNTUlIm2aKMiQ4w2fiBCauGlAiF9sa+VYYrgL/7IzdoC:WFQ63DwgcbnBCaXHF9hgPJ
TLSH
T162C24B36EC98D9ABE9FB8FDAA74A7603EEF00163959C5AD4D9D81C1D00971DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6289f54d-00c6-4cf1-a394-56658d79b939.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6289f54d-00c6-4cf1-a394-56658d79b939.tmp
Size 26KB
SHA256 ec5f17acec3ef627e4469fa55cedb4a4af3727a6a76fbf0491f09e612f9f2587
MD5 eeb2bc9427cb8f92f17088ead01cd5f8
SHA1 8d331f91649f1f6a6e4beb1ce45f2c5d3e28c385
SHA512 bdc0850b4ae8b56252a275eab7f345f735acf506b271f577f0ee06bf2b6c37143bd94996430e561ddb8b9b1e55f248ffa8cf3bbb429d8fc2e04ad0912867e02b
SSDEEP 384:nfiFiZcI63sNw8TUNTUlIm2aKMRHt2w2fiBCauGlAbuci6csa+VYYrgL/7IzdoC:qFQ63twgcTzBCaXWti6chgPJ
TLSH
T17DC24B32EC98D9ABEDE68BD5A74A7607DEF04263958C9AD4D9DC1C1C009B1DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dea03f2-2b5c-4b0f-93c9-0fb7d31549bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6dea03f2-2b5c-4b0f-93c9-0fb7d31549bc.tmp
Size 26KB
SHA256 956d714fee70730748f81a3cb0c59bd71156ec3d8e605f98cb29e8010a463abf
MD5 5bd43c79e0aef9d445413bd9ac67432e
SHA1 a4a319e61edddc71178eef2d5fce7462869d0d77
SHA512 9f559c354cee3ab9a4a8b4b94627d1533b57da7222412b93e6bad90ce86dc1af93f6da9fb6556b5d157d783e521d4b4796885555e010b04dc15dfcca3bcf23ae
SSDEEP 384:nfiFzQkUSvh3sNU8TUNTUlI4caKM7stsduw2fiBCauGlAbuBi6cH7vBE/fgL/7IP:qFdh3dwg8iOnBCaXWGi6cH75ESLO
TLSH
T1DFC24B36E899DEABEDE74B85A30E3A43EEE04213C99C5AD4D9D95C1C00DB1DD134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

22135fcf-76db-446f-9c27-95230e6743be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22135fcf-76db-446f-9c27-95230e6743be.tmp
Size 12KB
SHA256 aed72eadcb3d3efc75c2eba0f7c71f3eeb3ebf7967bfe472562dd818fb19f7cd
MD5 9c531412c96dac75df85a61abfa7470f
SHA1 763dd849217896fd3f842d585317645afbc11a4a
SHA512 e258a954ab0b8fcd68aed77de205bdbc870ac0cb4d2e07168e5cdca487312ae60a6e7c62f8f11ff7a1a4672b8386f1f38913c76411cf960367bb5c5b4cd617af
SSDEEP 192:sxZ+RTko/fFshnaQZLqb8izodpFkHW6+WNgnX/Yoy253SLVJIg5etoJ:sxZ+mo/fFsEO/Z6HbA/bSvQtM
TLSH
T18042E9156D286D7B8CC7D219BA59BF53E3F9503291D12E48AAFDCA2C14EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24b5c613-975c-434f-b822-1766481ddf0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24b5c613-975c-434f-b822-1766481ddf0a.tmp
Size 12KB
SHA256 245ad97a80130507716dd5a40c630fec84178467a31d554b9ea86ca323ab9fab
MD5 6f0e954e8157d1cae2446efd75aeb138
SHA1 adfdf7695b2c3df948de78967ac82186d2a4a23e
SHA512 b63f543b8c960e95615b4a55fe5624689f6c59394aedf5f4f4767a3ee793bb3287acc3e89a34d47f03c4463539f1d512b41cba6aef83ae5c81292e8ced2dfa62
SSDEEP 192:sxZ+RTko/fFshhVQZLqb8izodpFkHW6+WNgnX/Yol253SLVJIg5etoJ:sxZ+mo/fFsrVO/Z6HbA/CSvQtM
TLSH
T13842E9156D386D7B8CC7D219BA59BF53E3F9503290D12E58AAFD8A1C14EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53f82a13-b1a0-4fa2-9504-3e165607b2d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53f82a13-b1a0-4fa2-9504-3e165607b2d9.tmp
Size 414B
SHA256 226a9e8c679beaa5e5a4815b10788716529fb77d5d0b546f51464295ea62893d
MD5 31e60dd0f99c7c81ead4c3e32972361c
SHA1 fe7aa12159db821d72530980b1a1117ee935c242
SHA512 2a602c9f1914052b7338332634075357fd6f8471e2d6a6517e022da53fb2010f5d5a0217015c4ac472f0004cd17f8400781bd17970993b1272e6af38a4e66a5b
TLSH
T12EE02B6AC815FC3B18FD4B7854544685EB00232B2A41985B3B3E84088FB0736898986C
MD5 SHA1 SHA512 TLSH

Submit Download

6ab4b6a1-65f7-4e47-98fe-b36715922c10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ab4b6a1-65f7-4e47-98fe-b36715922c10.tmp
Size 11KB
SHA256 2e60e611ea844fccda70a6df69eb28412cd369f5d68a09743d0b7baa50973f29
MD5 f83354b65643145aea9ad3b16dc4e1d7
SHA1 3dcf83c96b37da89ff26e3896353c0d0ced2f778
SHA512 96008161d438cecc363ba0b724d396e81aadfa6b8c73eb83f6a92acab8d98f06d92a22e32871451fc86b4a848e393932c681f2ab762f8e1cb856e3f1d2e10b93
SSDEEP 192:sxZ+RTko/fFsInaQZLqb8izodpFkHW6+WNgnX/Yoy253SLVJIgjtoJ:sxZ+mo/fFs3O/Z6HbA/bSvjtM
TLSH
T15F42E8156D28AD7B8CC7D219BA19BF53E3F9503295D11E48AAFCCA2C14EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 93fdd4d1d66e816bf8caac62df2d690602ab94a13f71562bdb615a0d16bc87ff
MD5 7faf163c7981c61d27a4c8681e364b6a
SHA1 a5b71fac26f3cc422a4c4390ae3914eddab4ea26
SHA512 1badb897a131b745edec5501553625fb5609564d05dec3142c645e55bcd0d75842626af398c15a36a43f295f756d61e4e326b72dcafa4c12ec6cd0b72505c0a5
TLSH
T101E026E604CCC23FE718A74B12EC430C8A80B61F9BC0691E3710D8C97203060B6A67E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4b6dbcf5754596205e2fe0482e04b60fc562c54658af93eeaaa87f9f806375d7
MD5 b0a5f3a2f32df6571eb07985c1000851
SHA1 f8126bd96ac8416f9190bd32f99bc93ff7927da1
SHA512 62aa7239b30871a1133fb65bd71462b28d076137d3b9ef8fe64fe43be4c7aee26b6c27f2dda1613b039481a268330c9cdf5a6c29228b20f8b098a5da2b7b57a9
TLSH
T140E086A62EEAC22FE349694741EC634CC290761FD7D5BD4E7704C4897243544A3ABAA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ba1bd4af039c4bd46d36da862b62402ca078aed60ddbfbbdd4f6577856358849
MD5 5c05826c65758d161c03c7f7bd4518d8
SHA1 c8226f4c84da7cc1336a717024e0fb7f71588442
SHA512 277cd8c49a561b5d13cbaa4db89b394fc90facdc4e3e11f951e2c82b92618bd08cb2c0fa8d34239f0eeaac521552c3a50eb5b2c2bb757c5996f8a0202b0c60c9
TLSH
T1A0E086AB45DAC22EA209A64702EC838C82E1775FD7C8794E3B08C4997246584A2966A1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b41c16824f88005cce9c49c9b22858a3726156bece2bcfbf603f268fdc1cba1f
MD5 1bd93321f39f473fce29f5e804e51856
SHA1 1181308495cb05f5f238621af14d20f4c0bb0031
SHA512 9ea9cd2794b8e83b5b8c141a5d70cedf703dafb7695550fceeab0dce80b4a211d69f23ed04ea76349b2f231d9b7ac24aca1c38fe9a8a0c8e91e53992719083e6
TLSH
T161717F6AC94ECB53D7E9DFF8E9D952C331B8E5B0A1A74D022248D4785FB730833A2014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 556d7508cab3c32ddbf3715ffb5a1b29704bfecccac59b481e26b3fd4d802f29
MD5 e18ab4edd62765aeaa4acbea18022ff4
SHA1 9882e86ac6dad94f24314b84e387fb0e79d3bf62
SHA512 2ae586fd85c154ad2cb4a71f019738d69b6a2522215259055182fca4fc1d2dbe8f4de3b898eb7d763951a1851f2cdd377c406ccda1be647a28d5ef9d641aaa21
TLSH
T103514BA2919ECB53DBE9DEB4CAD960C735B4F5B4A5A74D0323A8D8384FAB3193312014
MD5 SHA1 SHA512 TLSH

Submit Download

a9bab04b-ca5b-46a9-8b67-f4a6d751ea68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a9bab04b-ca5b-46a9-8b67-f4a6d751ea68.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

364d5856-a700-4ce1-bda6-4f25bbed91cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\364d5856-a700-4ce1-bda6-4f25bbed91cb.tmp
Size 1KB
SHA256 99ea48b9bd5a0c61edbd6c05d869ae2bd7af49d71d5b45a7e7bfb4731869ba02
MD5 0427e0d05a9e6ffdb0a8d232340490f9
SHA1 e59e0f48560b72b597741da264d74d02751f38c0
SHA512 006e3ee6677eae49a0c34dbeb175152629e39659246c7b19e7405abe957cc59d9aa351f9a92742901c2d596323838b6a423d18c39f8d3185a604c37438616f31
TLSH
T1D241AFF783B4866E8A0196F0AA18AE2FCF5D0511431C7D9AC5E4AF2793F3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

57625e4b-35cf-40f9-bbb7-72c629ef0aca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\57625e4b-35cf-40f9-bbb7-72c629ef0aca.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

82c6dd46-41b0-4217-92ec-43523e9300a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\82c6dd46-41b0-4217-92ec-43523e9300a9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 03e19e8c5c06e389427da79e657780e75ae82c759b43a580b00639dbfc93a214
MD5 2ba7280f20b5b8c52f067ab12851b731
SHA1 7c338b29ec9a657d4da11458e9e489f824976007
SHA512 f132733f418cf044cf79411926088e9d5d2087da2ecce1a161c92fd308531f94ceff53e3d27dbe3120a368f97417a6b2b23bcb0ca1b86c2e6f38f962b1c3c257
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3w+Z6eME0DE/eeuT04vG+no+nF3:SL29ObJffppdNlrtqf3
TLSH
T151B2335571BB421039FE391882B5976E068271B33119E66B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a5d36cfc-782b-40a7-824f-fdd77ef80f28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5d36cfc-782b-40a7-824f-fdd77ef80f28.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a2099c-5e0c-4c9c-b9b5-1e2db76b654b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5a2099c-5e0c-4c9c-b9b5-1e2db76b654b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d908fb25-498b-401a-bf62-5d06ec0b837b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d908fb25-498b-401a-bf62-5d06ec0b837b.tmp
Size 26KB
SHA256 a3cc60ae542048ce42edd423f59e67593992bb1fac6f1871ba72e8a79d4a00c9
MD5 c8da0118268bfc90cea57a9d49487b08
SHA1 f74f8b32d9bb59e2653b7f3a7879cf06549b85a6
SHA512 836b277ff356ff6df0043285ad6d95e7ae505bd3b581601292f1fc3bb30977fc57ede84b9eb08c2f3f214c846df73f507bde7d17d6f6ec4b6b5abe39830ac789
SSDEEP 384:niiFzQkUSvh3sNU8TUNTUlI4caKMYstsduw2fiBCauGlAbuBi6cH7vBE/fgL/7IP:pFdh3dwg8HOnBCaXWGi6cH75ESLO
TLSH
T1F7C24A32E899DEABEDE74B85A30E3A43EEE04213C89C5AD4D9D91C1C00DB1DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e55fefc5-e4ea-4d9f-b02e-07d54cb08136.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e55fefc5-e4ea-4d9f-b02e-07d54cb08136.tmp
Size 31KB
SHA256 e3c17ab4bbe9331e4b96ab4978b01beb6251ce6666374101f467162e1f6df977
MD5 96f81d0c1ac8bdcab8cb9d64b4b2f42c
SHA1 e09e9281777621d53ef16393cc83474d0d8c9a41
SHA512 188ff69eb884cdcd76bf33524e227d7ae100e9685e026e6b45a22b66e922bbb0427702d069dc21528a90eb0f9b6a5d16dba0c4d965362b122eb2318258da60ea
SSDEEP 384:ngiFzQkUSvx03sNU8TUNTUlI4caKMYctsduw2fiBCauGlAbuMm6cH7vBE/fgL/7k:7Fd+3dwg8fOnBCaXWVm6cH75ESLO
TLSH
T13FE2A1F198D79977E9AE4B87A33D2D429ABCC113B4885690F7C91C1CCC961BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a99a7f020033e0486d0351a251079d37313c6bbde8e56b412e12a0dac84d2b9b
MD5 30aa13c7bdbf48d7e7f3971aac8eaf83
SHA1 f6dea399a15d61f7c8060bf3e2a45af5914ff6c5
SHA512 96b006ef24dee9a6124349616ac16a2a314a45302a16e55fbf9f2cbd5479a1faa7e51d45981851d8d62a35b78861f5b911f3ebb09f5c57640ffe692240a03e10
TLSH
T13A412C5CAAEA1108B3B76E5AABF2A96D487EBC371E06D55D10110E4E0A23F40DC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/780-235-0x000001FA958E0000-0x000001FA968E0000-memory.dmp

Download