hxxp://www[.]bluebiz[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.bluebiz.com
Sample261102-n58cfseh72

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{138A1CFD-42AD-41C5-A079-46C41B9C3A0D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3540	2252	msedge.exe	84
PID 2252 wrote to memory of 876	2252	msedge.exe	85
PID 2252 wrote to memory of 2688	2252	msedge.exe	86
PID 2252 wrote to memory of 2688	2252	msedge.exe	86
PID 2252 wrote to memory of 2688	2252	msedge.exe	86
PID 2252 wrote to memory of 1772	2252	msedge.exe	87
PID 2252 wrote to memory of 1772	2252	msedge.exe	87
PID 2252 wrote to memory of 5700	2252	msedge.exe	89
PID 2252 wrote to memory of 3092	2252	msedge.exe	90
PID 2252 wrote to memory of 5700	2252	msedge.exe	89
PID 2252 wrote to memory of 5700	2252	msedge.exe	89
PID 2252 wrote to memory of 3092	2252	msedge.exe	90
PID 2252 wrote to memory of 3092	2252	msedge.exe	90
PID 2252 wrote to memory of 2620	2252	msedge.exe	93
PID 2252 wrote to memory of 2620	2252	msedge.exe	93
PID 2252 wrote to memory of 2620	2252	msedge.exe	93
PID 2252 wrote to memory of 3812	2252	msedge.exe	94
PID 2252 wrote to memory of 3812	2252	msedge.exe	94
PID 2252 wrote to memory of 3812	2252	msedge.exe	94
PID 2252 wrote to memory of 2400	2252	msedge.exe	99
PID 2252 wrote to memory of 2400	2252	msedge.exe	99
PID 2252 wrote to memory of 5640	2252	msedge.exe	100
PID 2252 wrote to memory of 5640	2252	msedge.exe	100
PID 2252 wrote to memory of 4460	2252	msedge.exe	102
PID 2252 wrote to memory of 5416	2252	msedge.exe	111
PID 2252 wrote to memory of 2392	2252	msedge.exe	112
PID 2252 wrote to memory of 5240	2252	msedge.exe	113
PID 2252 wrote to memory of 3092	2252	msedge.exe	115
PID 2252 wrote to memory of 3092	2252	msedge.exe	115
PID 2252 wrote to memory of 3092	2252	msedge.exe	115
PID 2252 wrote to memory of 4004	2252	msedge.exe	116
PID 2252 wrote to memory of 4004	2252	msedge.exe	116
PID 2252 wrote to memory of 4004	2252	msedge.exe	116
PID 2252 wrote to memory of 4624	2252	msedge.exe	117
PID 2252 wrote to memory of 4624	2252	msedge.exe	117
PID 2252 wrote to memory of 2396	2252	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.bluebiz.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa22cac188,0x7ffa22cac194,0x7ffa22cac1a0
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4095381282510660769,5182845370487137567,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,18166133719870451192,18108345785518421007,262144 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,13583110887157682782,17399212672575495796,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,17747746449710218794,15908660267302903502,2097152 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,17666354792351005939,5543528522676128671,2097152 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,16000296112777992834,8001687809384313369,2097152 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3584,i,4841380646831234359,7068840812364619405,2097152 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,14294439949521934973,14183081252227292231,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,14846277122100379386,12996827841571511710,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,3440111318688018654,12917933064034331013,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,3440111318688018654,12917933064034331013,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,6378621906391999159,11537652534369003354,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,6702772666435814080,15367754047695813088,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10990448057565270113,4191553904645449943,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6308,i,6761920462285693200,5790749578899003952,2097152 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6392,i,8286067332384166597,10762462735204614633,2097152 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,5964401869424884539,6231294512825265486,524288 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,10412018943620952915,4511550608709224317,262144 --field-trial-handle=2340,i,12431024880483043036,10469801513031568507,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16c25d96-84b4-4695-9749-a08fb3f87bf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16c25d96-84b4-4695-9749-a08fb3f87bf6.tmp
Size 25KB
SHA256 38fb1183401859ad0d2497c6c10fab0bd820a16c1f119eb58a871c8564751f6c
MD5 1199bed83520ff42f60e2c3adebe13ff
SHA1 34a749daf3885338deb2fd69df50eadd8352a0ce
SHA512 6351759239088ee9dccf8d25c3926fb7739b673df6f2782c830864bcc6cfadff80b3edb0f9494ee9ae67317a1c5772083a134e10ea11ad78ee9a633dc9f1be37
SSDEEP 384:nOiFiZcI63sNo8TUNTUlIm25mg5xnK2fLBEUD4jiZHRmBlQ7O6R2Feo5MgL/7IzL:lFQ63NwgSi3BEUJkBlQ7TRMGl
TLSH
T172C25C36EC94C9BBEDFA8F9AA74E7A07DEF01163819C89C0DAD91E1D008759D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

307e44b3-5f1c-4fb1-9025-f036c846b9e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\307e44b3-5f1c-4fb1-9025-f036c846b9e7.tmp
Size 32KB
SHA256 d92baf16665b5a94ccf5647427060ae942c3efd5ad3c0ea142b74b0e971c4271
MD5 65e9131bfee2fd0b3bd0dcbfc98b3b91
SHA1 00a5ed579e8de352d420382d8fd930579a3d877a
SHA512 4bd73a482e11ca109718e2eee7bcfea30e4a630b39a34f4c3d408e4ac9124d16299c4a433dd1c1887388fddeef91f6353a94d5991ba3f9ddc14818d20cab1a2d
SSDEEP 384:nYiFzQkUSvqu3sNN8TUNTUlI4M5mgvC3K2fLBEUD4jiZHRm3ktvqaaX1L9tL8cSp:jFdJ3gwgItHBEUJk0FqaaFBt3eVL9
TLSH
T16BE2A3F1A4D789B7D9AE4B93A33D2D429AFCC113B1885980B7C95D1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dadcb76-e4fc-4dd7-a80a-2131065110ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4dadcb76-e4fc-4dd7-a80a-2131065110ff.tmp
Size 26KB
SHA256 56f8c9bee05773737f90ee6843617c9e76f68ff8774682a1d21b08d3b19dafd6
MD5 e62b12cfafa74cf1d674e80e86250394
SHA1 c097b31a177619af42005f8e8fc559a0c190332d
SHA512 170dfe4697eda40cf5757b189913ea526fd405c174edddd88dcfc20c269f8dcbd5907022b0f1453c3267f6b64daebd0a7fd192fe71292a7659add5b78be7d6b2
SSDEEP 384:nviFzQkUSv93sNN8TUNTUlI4M5mgPY3K2fLBEUD4jiZHRm3UtvqaaX1L9tL8cSFn:6Fd93gwgInHBEUJkkFqaaFBt3eVL9
TLSH
T1BFC25B32E899DEB7ADEA4EA5B70E3643DEE04153C6CC5AC4DAD95E1C00CB19D230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

27ae3bbc-b6d2-4e4d-9321-d61f9fce5145.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27ae3bbc-b6d2-4e4d-9321-d61f9fce5145.tmp
Size 12KB
SHA256 e1d0fda288541a27d992f465d63bcb127cc271c743e41362718f39a949e428b5
MD5 a1583681e7280d4679553da182269746
SHA1 a0b2af647e7b24efdc0d92a3405dc10c707be571
SHA512 942beed282471a9364c9f45a5305b39b69d0a7942825439624df99df9409920203c0a11b844033a0718e3041130f8de8ea97f289d09acddeafbf92a7d264ea4b
SSDEEP 192:sxZsRRkd/f+swrQZZ+Xqzodp7HHW6+WNv2l/YbIvJ3UwYUgPIg5PxcJ:sxZs4d/f+sOOZSRjHbo/FPYjhu
TLSH
T11342D755AE28A97B9CCBD219FA15BF53D3F91033A0951E44AAFCCA1C14E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

364e1841-4cf1-4a82-b871-273ebfb45ab5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\364e1841-4cf1-4a82-b871-273ebfb45ab5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

744694df-7795-4c5d-a76f-86c6b5c95c5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\744694df-7795-4c5d-a76f-86c6b5c95c5c.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8832f5b0-61a4-43f8-bfee-781d07b35753.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8832f5b0-61a4-43f8-bfee-781d07b35753.tmp
Size 12KB
SHA256 4da59c8f6bae92f06c5460b729f09b9df512e88f6b778b18c436254c20e2c676
MD5 9e3373d320c6f1273b0609d795f095c4
SHA1 eb42f9c46bb9fc49d010a85892aafdb68f8f7bc0
SHA512 68739af8c96edeafd3c02792dc73bcd91b39d23fca42e10ca2e9dbcba93f88cfd62878ec9e005781b195a006b2f2454515fffaac1190e12168255d0a3965579f
SSDEEP 192:sxZsRRkd/f+swDQZZ+Xqzodp7HHW6+WNv2l/YbIcJ3UwYUgPIg5PxcJ:sxZs4d/f+sKOZSRjHbo/FOYjhu
TLSH
T10B42D755AE28A97B9CC7D219BA15BF53D3F91033A0911E44AAFCCA1C14E7ACD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 93KB
SHA256 b3b432e921aec068a30f921f6b40951b119e72757fa294621274414524520a40
MD5 0fb1d498462afc82232b49099ba37b53
SHA1 08d36d2af529b56132058f8ec75f549cd6b28aa2
SHA512 b60bb852c09d1582879f45a1f889cd29eb712ac6917a34e07878f36f4d3f5f86c47171a17731598527b27e46f63d304b6eda8bdbca06f74d2345a94f8a8c5a82
SSDEEP 1536:yebHRf1uQ1muRmPFKLQXZT3EOs8IB30SsT3tNy9LKDq1gdmaePmRW1Sfup3WnS4:hjV1uQ1muRmkLQXCB820SsxNy9LQq1gh
TLSH
T17893125237BE2550219467A1171E21BFEADBD2FF1B4BF0CA5C65C26C2E3D6358C13292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 26KB
SHA256 e0b3571f3f3452f68eb6fa4054f2de07c13c02d8fbbc3a3c97a1604211a2c41d
MD5 1aff9455866f3324169f817d90949e8a
SHA1 258ead3e016c24746b070ecb63ce46f94274ebb0
SHA512 59637660ab9f647d4c90e24e920084677b473d01b22018d18644ee108b1ba0c9549eea13fe19750863f2f322cce6c4db4c9f7b8bcc8aee94ac1f6c2f51cbd985
SSDEEP 768:luSENZTFy3cEKXUskqaZAVSvUebJ4UYAObujExiLd3rm8oNu5U:sd75ysDE4a2kseSAljsip3r3oH
TLSH
T164C2E1EBDE0474D5EDDF896DCAD103E29DE21D10A6819804DA0B21749C09F9DA4B8DF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 650ecf2fc5cbd02739d96739ab9ac118308037db7cd14261070b7831af4cc566
MD5 606f02c6a59fabac10b0becda6d1d94a
SHA1 31c6feaa34c024fd484303ede06ab3ed9dda4d41
SHA512 df27f7f2b2323dc57b92f880a9631cf87ca798c86df3bdd73fcbd4148ef7c445f43be5cbcc2b44cff55db3ff2f689d0635a4ee965d694ef793bc373b0389da88
TLSH
T15E7195E1604964EFF76839B043E2B047393405FF5587BFAA01E7F63D6C5ABAA9380204
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 54e26778509f76795e8cff0a99f97681a1d48bb586a2c9156d0a1fc7c31a73ce
MD5 66f1324f7f3d1872da6b17b2319b336e
SHA1 2337cb951bf494b70a2b9f5f72e6a61e90787e23
SHA512 a7f945c61f84dc5dff8b696bfcec1b8cccc092989c74f98aa2e5d93098a4ae98b6e6a0f6750b1a6c40de4cac512fd30e8b1e6daa20cc439690a05ac491b2c99b
TLSH
T1627197E1604960EFF76839B043E2B043353005FF5587BFA900E7F63D6C5ABAA9380218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b9a3e8c441f512685763377520cf88657a0f967196dffe547957ee5a85efbb7
MD5 0077376516f0a9c53bf5d228557639ba
SHA1 9e237d1881848789dd07541bb3701946b4735c83
SHA512 7c239fdc8e0541268d4d5b6844f649094ed0b90048526dec47fd4f97958f3f19e72e75e899730c78561e7e013f5dd6fa3eb5425ae18189c6d6e6089dcf424dfc
TLSH
T1116183E1600964EBF76839B043E1B047393005FF5587BFAD00E7F57D6C5ABA69380208
MD5 SHA1 SHA512 TLSH

Submit Download

19c9ff73-77e2-4f8b-a194-f7e44e34d7bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\19c9ff73-77e2-4f8b-a194-f7e44e34d7bb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

233359af-a405-46a5-91f3-7e5408cca418.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\233359af-a405-46a5-91f3-7e5408cca418.tmp
Size 4KB
SHA256 f8832602a3a7269db8f63fdda6a4f36dffa5cb9c72a3d6b1d8fbddd4c1505a0d
MD5 2757f65d70ecb2dba248f8800e3617e1
SHA1 d55e6a334192e96d546945593062fa6d2ede65ef
SHA512 73dc5f83710325e6d0571487d5919ce0c1fb0cd8c65362e34cac3079d65cdec1c94e7185a033f0fab4fb43fe9872dd3e7d5041624b40458d4e21512a36724378
SSDEEP 96:D19ROutuXuTWaaqzwNuiuLuguVIuyuZulDupxu/gGwBuZuT:D1i0ohaaqsHYf4INEoGfGkCA
TLSH
T148918FF783F4962DDA1152F4AA247E2FCE2D1934431C3C6A85D56E17A3E2471E28174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

896fb0d2-1aa6-464c-9e11-88cfbb466a06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\896fb0d2-1aa6-464c-9e11-88cfbb466a06.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ad925d75-03e1-4bb8-bb4f-6cd530e59344.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad925d75-03e1-4bb8-bb4f-6cd530e59344.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 151c99ce2374cb2c72173fd093e7977f77be19498883b72d3604fd74fd8ced59
MD5 ff3f0deee08003dec696d6c9a2ab88d6
SHA1 e63dd878dd4a0b9f3d44d17af07361b3f1548892
SHA512 1e714044e8b61cfed04593a0c4aec57c74f5c0aa0704fe196dab9727620df3f35012b75f802d968cc2dd581b311ca8c5bffbcc47ff373d05857ec9b12d5b2fcf
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXmd3d:OtfFvpopPxrB4Rhfmdd
TLSH
T10FB2351471BA021038FE790881B6972F064232B33159E63B7FBD55A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b8ef5abf-738c-4c84-9bcc-c5573a267571.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8ef5abf-738c-4c84-9bcc-c5573a267571.tmp
Size 414B
SHA256 8afa399d6cde24551efbdd10655f4c3c977ec37451c04cf27ad9ce00af038aa9
MD5 5971a9a581089d52b12563a3cddd5b98
SHA1 e476ddded25d0d014e9145a19a6e9bdc20227613
SHA512 84ccc3da120ab4a6cd534a52c3b0de92fdf1217ecdee7639128fbd7a03afad388c5ca6ca8082276cdc771d35b892e1835a908c0ed078859799a6e2844d04f422
TLSH
T1A9E02BE9CD5AAC7709FC071850640645EB5103572A80948F373D810D8FB1B3A52879AD
MD5 SHA1 SHA512 TLSH

Submit Download

dabf20a2-b3a8-41ee-9176-eadf5c60838d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dabf20a2-b3a8-41ee-9176-eadf5c60838d.tmp
Size 12KB
SHA256 4292eb4b776c4b8def04a419be5a372a329c38b032867790fca8c2d3d38332d6
MD5 ec896a7a11eef5d2a3c1adb95c1ee8a3
SHA1 9cbd7faafbfdfd590bdf43c9a8a40ff580ecd2fc
SHA512 6a18bf2cb1144f318e7b5195623d9365a100cc0109702e57e2aaf488419a02b22945d9881e6d84d6f1067861b5872dfb1e259a50d5cccce95b7615e3eb1811f3
SSDEEP 192:sxZsRRkd/f+sTQZZ+Xqzodp7HHW6+WNv2l/YbIvJ3UwYUgPIgjxcJ:sxZs4d/f+sTOZSRjHbo/FPYjju
TLSH
T1FC42D755AE28A97B9CC7D219FA15BF53D3F95033A0951E44AAFCCA1C14E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7977c7b-3e5c-41fd-9f68-c1bc50470019.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e7977c7b-3e5c-41fd-9f68-c1bc50470019.tmp
Size 12KB
SHA256 d9207c7b6459e45a1b2a2c7d7271c5db3576731821a9c0621833538d9c4f947e
MD5 347f75afc8d2237ee64615a95d8cb9d9
SHA1 237af2675f236ceacc48c0b55a88d452228388a4
SHA512 749c3cf9ab3db17feb3d53b6793ea556051f8024ea3c615f70aed8d6b347083e1cf356bc8413cdab86763ddc4bea0ae4e6a14911487a7663c94c751b73dd9a8e
SSDEEP 192:sxZ/RRkd/f+swDQZZ+Xqzodp7HHW6+WNvwfXYbIqJ3UwYUgPIg5PxcJ:sxZ/4d/f+sKOZSRjHbgXF4Yjhu
TLSH
T12D42D815AE28A97B9CC7D219FA55BF53D7F91033A0911E44AAFCCA1C14E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2d9370c-7b70-437c-aaa1-3384853ee8d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2d9370c-7b70-437c-aaa1-3384853ee8d9.tmp
Size 26KB
SHA256 7c4c852133652c9effc092f0abfe88e5f7a6db99efe840ec0a82d0b55eb42aa4
MD5 64155d28c17fa07f7ba390a4b7b809c4
SHA1 8f99363d1d2a5512743de2b9f7afac4f28ce9201
SHA512 5eaf9ee864889bd6face65ff586fee445e5b7dd9e2b3e3c501ca125b65cbfaa0f182a31e973d0753e8f51dee29f4be0d4f53a274c572a247096f1525c866fdbd
SSDEEP 384:nqiFiZcI63sNZ8TUNTUlIm25mgcTEK2fLBEUD4jiZHRm30tv7O6R2Feo5MgL/7IH:hFQ63wwgS/wBEUJkEF7TRMGl
TLSH
T19EC25C72E894C9BBECEB8BE5A74A3607DEF04163858C8AC0D5DD5E1D00DB5AD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a36108ad-ec83-46ea-83f9-8cb94672f341.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a36108ad-ec83-46ea-83f9-8cb94672f341.tmp
Size 26KB
SHA256 99108fec943e0470e9080d5c51bc0eb3d60dd04569a97a86720c1fe82162e0ff
MD5 089b03481fa9a9deacf2a9c913013c59
SHA1 eefd461f9e0c2042631d66e26ee632dd4d281ddb
SHA512 2ec987876f258995e42ce3dde3390694450ee9b3665c9efc7c4cc8013a5680fdf19569cdbcbe69ca8c9d6c13dc17afdae2e2965728220da50d8522220ff213cb
SSDEEP 384:nKiFzQkUSv93sNN8TUNTUlI4M5mg6Y3K2fLBEUD4jiZHRm3UtvqaaX1L9tL8cSFn:BFd93gwgIAHBEUJkkFqaaFBt3eVL9
TLSH
T109C25B32E898DEB7ADEA4EA5B70E3643DEE04153C6CC5AC4DAD95E1C00CB19D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 76a74309081465b0d7a64fec495e088172539c50a26be006d6229a7e796fe1d8
MD5 e1c0de5992ff7cb3e4c401915713d21a
SHA1 35b7efa13754b242944396cf28b07ef0f345f90d
SHA512 4c539475247034305ea42d2ea1456496a3f934bc9880da3e9cd6ba27e512f8c6b9f25bfc8d06d49b6564bd66bfd61156bb969c0858719f1993b7dd623d6dfa46
TLSH
T1C1412958A6F91158B3B76F56AFF7A46D547A7C772E06D49D00010E4F0563B00C972B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4460-282-0x00000211D36E0000-0x00000211D46E0000-memory.dmp

Download