hxxp://www[.]knapperundpartner[.]de

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.knapperundpartner.de
Sample260728-pxjjsshc46

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2316	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297161548817082"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{FAE00BF1-1E76-4DFD-A165-EF2DAEFD4F59}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 668	5016	msedge.exe	85
PID 5016 wrote to memory of 2316	5016	msedge.exe	86
PID 5016 wrote to memory of 2848	5016	msedge.exe	87
PID 5016 wrote to memory of 2848	5016	msedge.exe	87
PID 5016 wrote to memory of 2848	5016	msedge.exe	87
PID 5016 wrote to memory of 3808	5016	msedge.exe	88
PID 5016 wrote to memory of 3808	5016	msedge.exe	88
PID 5016 wrote to memory of 2332	5016	msedge.exe	89
PID 5016 wrote to memory of 2332	5016	msedge.exe	89
PID 5016 wrote to memory of 1112	5016	msedge.exe	90
PID 5016 wrote to memory of 2332	5016	msedge.exe	89
PID 5016 wrote to memory of 1112	5016	msedge.exe	90
PID 5016 wrote to memory of 1112	5016	msedge.exe	90
PID 5016 wrote to memory of 3544	5016	msedge.exe	92
PID 5016 wrote to memory of 3300	5016	msedge.exe	93
PID 5016 wrote to memory of 3544	5016	msedge.exe	92
PID 5016 wrote to memory of 3544	5016	msedge.exe	92
PID 5016 wrote to memory of 3300	5016	msedge.exe	93
PID 5016 wrote to memory of 3300	5016	msedge.exe	93
PID 5016 wrote to memory of 2028	5016	msedge.exe	96
PID 5016 wrote to memory of 2028	5016	msedge.exe	96
PID 5016 wrote to memory of 2028	5016	msedge.exe	96
PID 5016 wrote to memory of 3996	5016	msedge.exe	98
PID 5016 wrote to memory of 1292	5016	msedge.exe	99
PID 5016 wrote to memory of 3996	5016	msedge.exe	98
PID 5016 wrote to memory of 1292	5016	msedge.exe	99
PID 5016 wrote to memory of 4124	5016	msedge.exe	101
PID 5016 wrote to memory of 4556	5016	msedge.exe	110
PID 5016 wrote to memory of 3936	5016	msedge.exe	111
PID 5016 wrote to memory of 560	5016	msedge.exe	112
PID 5016 wrote to memory of 4556	5016	msedge.exe	119
PID 5016 wrote to memory of 4556	5016	msedge.exe	119
PID 5016 wrote to memory of 1696	5016	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.knapperundpartner.de
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffdff04c188,0x7ffdff04c194,0x7ffdff04c1a0
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3638823261722459534,3329929100769955430,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,896268440031064418,4038585042377986528,262144 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,15634718186280002940,2421452060508494749,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,12944914984015021553,14380342599923777759,2097152 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,85722807609260576,7263937377665981934,2097152 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,2339786921983383784,9467688817962828628,2097152 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,821431454897527752,13390613194958076036,2097152 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,4155205250754912211,10460433598795460701,2097152 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,11708299559362803924,11305217565866155452,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,5767383705441553346,2345016980877111373,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10068557052652931425,15249134937896688756,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10068557052652931425,15249134937896688756,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,12481338380147648703,13702809331930112111,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,15728213782218870629,13026572400630017483,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,1640734806231317719,14999044594069163932,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,2480542861372668184,9223090653588382811,524288 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4388,i,1351120338240486050,17470263199275061748,262144 --field-trial-handle=2304,i,7184011448936171230,14618011279120563336,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4576

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 35KB
SHA256 15dfed5f26a2f1ddfc57377b5132a0dc42b6473ee1d1ed8f547e12c144c85acd
MD5 a80f9a38ea8eaef0fd5b1ff8d5e95481
SHA1 cca0130ae8e3d9202f9778533011b1f185fd78ab
SHA512 937ea935b90f8542d6d891cdf2f58fa179c56c2cb4d50693dbd5dadbc05410cd44d71cef0b4f57a74eee553d83b0f81735e68c4bcc1debe2bdb0fef3cb594104
SSDEEP 768:UDm/VOmz5Dm/VOGILhI3+Ct1ghquFEWJaDhMThuQ/pHH92FciHQ:Uu9uB53+S2htECaDhMFX/+NQ
TLSH
T132F2BF24FB25DDA0FDE92635A98AD387D33352844B937603798C0D817F21AF5ED49782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 153KB
SHA256 0d7c2eb1bce357175f3a03b3128a027f10c9534da5486aacab550c84dbfc220d
MD5 f687ccdf93c33a287561ac7ae1bb4eb6
SHA1 a87188da79e2f3d746b3e091fcd49b0c9802cb24
SHA512 34bd39a8b95225b1d35d388a603260e0d50f673b84247d9403cdb1278d80cbc5f658b6d9b9df54d6d25fb0dc8382c9a0c42dd5c50c0603a362756593ce0b01a6
SSDEEP 3072:LBTPZAr4aO2RhaanjwjEZCIn/FTshxJkY7:LRhhh2RhLjZFTIX7
TLSH
T15DF3127DCB409C22CAE55774EE70E69D8399122922DBFE5AB54F0C8D7BD8301AC79309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 190KB
SHA256 0cc5c869bf1ab8860b9a044323912e9e76290563e833f9133c9b9629246a6894
MD5 56501ed42ab2afd83566a55f2061cbea
SHA1 1a2283d669ead8acfe0c520c164cf0788634cc36
SHA512 53ba2cb3f9d44d507f089cce72b067017a19b3c0840c3d45ab6a78991aa17ac71c28c4fc5739117bd830c94002fdfa55c6298cfb2fee367fa6e7999b5c8d722d
SSDEEP 3072:lE2Eeu4Jre7o+CvEsIawCuwBlSh4VO1x0b04cOA1zItJ+u2peU1Ypc/X2CPClCCj:PJMDCPwCuclSh4VO1x0bhUItJCwU5X2l
TLSH
T13114221BCF532C5AE6EA23B78405C3C6E26663DA99333462B90C7C593FD99458FD0282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 142KB
SHA256 250d80c24d04ab4416292e5c0fcfa452c8f85da4e5067aec520ebe8380a2e965
MD5 627401da4f0a7e795e20c65758744c7f
SHA1 bee3b1cc3253f12b6d43730c9b8a1578c797c167
SHA512 247019ad89048a877d3489ec7cd68a850115a0cc73db0864655246c56ccafbc12813eb49a62c0e3d336239c8ef4389b1cae374f10d65ac39183347aa8f6ca88a
SSDEEP 3072:rzrGzrAdxPDd6V95/aTN4HkusgkF6bIEiKe021YQd8ORQbaH1va:DiAXPDdg5/N+EiftwB9
TLSH
T1D9E3123D23908F20DCFDD23C89B4E36B572B821FA66F781F796D70501B868B26D5461A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e444d7d9f4a13bfd766931e2e9860f86edae8cb2623cc799dcf027015f4b540
MD5 811fb66d91304ec726151fe9dc998819
SHA1 99d0af1f4a8fb0ed8abb6c68b6d2c1ac38ba2482
SHA512 51f9752297bff41bf92b5145f9cc81c8bef4ffead4240325315149754f379927462fb5ac2f40081763536da9d6e2a04064b715bcf13deff440ec62666659e068
TLSH
T1B071A2C8918370A6EF22613DD0D39AD234788D7CC9D36E4231C49ABD220A7FD48E6538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f940.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f940.TMP
Size 3KB
SHA256 8057305bdf1e78e3a8917e8903c7a0dea6756f808a892b21ec896b88935810a0
MD5 2140143c2df816d9699e7ad080ab726d
SHA1 ca64c30d5a607af5de6491edd06fdd9905c499e1
SHA512 52cf33089e294c3a00f370ac238272d11554476045304afaca23c284be25b57137303b6e604db72c289fd84dbee7c306cef57feadba6d049e01f675e8fa21e6a
TLSH
T1936192C982437465EF12513DD0D3A6C6347D8DBCC9D75D9230C45A7D220A7FD49E6538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 253f3dfee95c5cb4cf1afe15b56dae523b1a62708a85bbec6ed3457860544dd1
MD5 1ac1612e89d46e533906fbbcbb7e702e
SHA1 df8706eaccbcdcdf109f8ccbc8a8278b7db409b8
SHA512 fa5f6cbe06dbf3d94bdc36f937c162cc776ecbd6bc77c062633105c14312cdad0eaf4e52f53faa9c986f36c7e711026b8cdb714d569e28459869d74bb47102d6
TLSH
T1F951ABE7C2F582AEC94256F4AA242E1BCF1E0A16435C3D55C5E4AE1BA3F2471E14058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 541ce3a23754656a5afcb36159f61545c3d96ab1ded9b49464834e7aa6f52b8b
MD5 9776c1c2958f1009d45fc435be8b0937
SHA1 3e48bb4c8b82add21429c2fc5672c3e2d3363d66
SHA512 ed3b2c6b8ce0a881c4388706c23afb3d842919cf29e4ea3ca5168fc401ed4d55712572c6cdde9789a45b16cecc0637d1285f1b598fd59ba1fe3c002cd6638fa1
SSDEEP 192:sxZ/RTyM/jK1Ml8Mk1/fAxsg1WIdpQFHW6+WNY36/Y4/AehsIgrJ:sxZ/rM1/fAxsg1XAHbt/dW9
TLSH
T1DA52E716AA3859B78CDBD20DF9457B93D6F50973D2900D44AAFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e9bed5f96fdb36d4356536f5df475d49159c3dad79ec8c6b46a4a214bfcc5c8c
MD5 8f1ec223ca1ad9d353dc2db7763bc493
SHA1 577a44b6366eaa99e52726196c597a03a0a00423
SHA512 c29ad39f613ab4f35f1b1fb0a4aee1c5a493036c4e507e227f2e9fb2c0152a67aaa5ad6fb760942435ff8940687bf36ab506c8c5c2ab7897817c433d94121795
SSDEEP 192:sxZHRTyM/jK1Ml8UQCk1/fAxs0C9Idp6FHW6+WNYYnZY46CjsIg5MEJ:sxZHlqB1/fAxs0C+iHbXZaSI
TLSH
T11352C756AA3859B78CDBD20DF9557B93D6F50473D2900E44AAFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bc6a1c5c36fc7f3e310c5a173a728b60afdbebc707c6f0dec10e02665dd9aab8
MD5 e3fada42e392a7086b9e5e524ff5cecc
SHA1 2fd8b40fa96a6656e9207216fd34f5b3c8955c13
SHA512 58d72552ec833a0ae085dce876f50f12cde024a4067da900de8f5e959e4e99641d9db2cdca5dafc180cf7dcc4e7ad4f54c21d2ff80539a9b739dab9ba8626588
SSDEEP 192:sxZHRTyM/jK1Ml8Mk1/fAxs0C9IdpQFHW6+WNYYnZY4T9hsIg5MEJ:sxZHlM1/fAxs0C+AHbXZCSI
TLSH
T18E52C616AA385AB78CDBD209F9557B93D6F50573D2900E44AAFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 75a19526cfa6ed589c0005bfa5f712af28cd7d1794e92df47a1cdc627de185a6
MD5 34ac4deced9af4aa32c3414faf61375e
SHA1 8ec9d211f2b6b6a166222bd1a8d0ccd9028f3596
SHA512 73de0c20ef7124a3c2bbd84037d2039933b1afd6f4995ecb04fec904c62eb54864790c6012ebb3260d2cf6eba1d80766d138aff8a43322cf49506a2ae0cdda28
SSDEEP 192:sxZHRTyM/jK1Ml8Mk1/fAxs019IdpQFHW6+WNYIPXY4IehsIg5CEJ:sxZHrM1/fAxs01+AHbfXgUI
TLSH
T10252E816AA3859B78CDBD209F9457F93D6F50573D2900E44A9FCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 160c8cc960ffb3155e76a490036bf5c1c26adf15064eb897b9550d4bf96db942
MD5 3284604e24af706b4eb9a98867b3f354
SHA1 7e1bf748574ca6bac24a8b9b236024c1a0425fe5
SHA512 e8fe0c5dad239b49bff34a1307729759c4338c190021be8c4f101b71c75b17e9b7ed0396e3f93e604bb30210cf93ee2091a693f9cefdc9ca388cf476c837263e
SSDEEP 768:P/8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd0roskNUni:P/8iJPNWvx76ru1jahALocdf1Ui
TLSH
T129D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 22669f299d62712dd1573fdbeef8e9695f4db003d240318b9cf1f4bcc3a0c93b
MD5 45d889a73cc9b8be6e99a46cd54b9ba6
SHA1 9d13503420af03d4ebadef0364ac0eed241e1fa0
SHA512 32ec4d7e2a6f13956315db213f19cbba52f1a76a3c42aaba0577eb404a71f63ec85e46faf5106adb6fb972fa981dd0ebe6c60f4ecc132a1034df10a46e850f65
SSDEEP 96:KoRmKC4KWVyKmIpRuVx/XH2pXM9Hx2KPTHj2z5RUTRnB:05dkRuVx/XH4XMxxBTHj85RUTRnB
TLSH
T16D91351278BB26012C3E640C99A4963B9B8175A33059A47F7FE860760F6BE254CFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fdf3b804d0cd16c84f244c4325c0ea0108cd628a7a3fcd4567a677ca9c03a75a
MD5 c6237bd37ee0191311d11a6328520df4
SHA1 21c6fb245931efe8740b45a9ad7409f4d0615f36
SHA512 79ad2cde62993a603d97d6c8f1514c12ed03dd501963a5d980d9d01fc5217e16a5e6f5727b838bf6149ad4cfd73ba5842f6a2c13ca013699ab99c6652c8e8e0b
SSDEEP 384:xPZcIPssNel2F+YOrkjIDfPOObjI9G6w7W2e:xHUXFdjP29Mze
TLSH
T197C217F568E75876C99E9713B77E2E174EBCC027B6881A40B3D8A60CCD8657FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 826484686e3767f1e83a51976289fd0ec7226a81e16ce5f3591d0ea6e09d354e
MD5 27902bd6c99a0487b8dbc9ccaabc797c
SHA1 50f49e78155348b184a5a12e1ded1ddbe1d70769
SHA512 8923bf0066c9d5edddcc19ca1782ebc50873442b3e3fcfc24bb2680b5d1910a873984f45d9b40c23668179f85fd2ce06fa97c518c8b6cfcda0870cb1acf45340
SSDEEP 96:ZqONkaQsjpfmUTmDK5ih/cIPURHl8h4otop5Q5DgBhPwivh50xy0SFYKfAxZYJg0:gONu6kDfQmiUyyEZ903MiQiRQU6
TLSH
T12C02F73968786CBB8EF3AE49F48737275FA5113BEA942F84D9E81B1C04D724C1743826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3d38d2212f182a6bfcdfee39d637e73411144d0ba98afbe433c8a2066f6ae258
MD5 5f4a4fdd12f3a52c80aa95089c4bb0fb
SHA1 b5a8fd0dad6729c83dde899f4b5bc9a6125276bd
SHA512 06e4deb3f9d798fab37f2eb447d76a36fef8f857f4889ad4c8a80db5ac39e6a47593f3ab678faa30f928f505acb213662faf0bc18ff29d4de9d7377799385fa6
SSDEEP 384:hSZcIhsNew2F+YJrkjIDOPOObjI9G6w7W2e:hghMOdqP29Mze
TLSH
T167929E326C38687B9DA3A915F48736274FF48037D7C82F84E5EDA71C09DA5AC030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9008e5c5960708d0eca28ee4723ae6b4b01d41962bfedf90c4b9a935310873ff
MD5 fc65fb7e69a5fa51a9a03a67225eae6e
SHA1 76beed447012b04ff532979872fd7b057d1f6d30
SHA512 4fcd9f9680519dcaea53da507189a3b06b0aeeed50a3d2963958ed38a528961b906ae70ba981cb7e9936f3f208d6a4fe5503e49413347f9294eede28688c7b4b
SSDEEP 384:5UZcIesNeJ2F+YJrkjIDOPOObjI9G6w7W2e:5Se3OdqP29Mze
TLSH
T15D929D326C38687B99A7A915F48736274FF4903BD7C82F84E5EDA71C09DA5AC030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40f884d4a634b0ba65f99d1e35bf64f2a5286342fc372f7eac5290d734ecd5f7
MD5 17d61e117868ca121b0b4ae9e552b9dc
SHA1 79ba4652f8838b45d2f6bf3f14a344eafa01cc84
SHA512 e301e3f9362352ef70f8081143e562a369db2a29826065c187b3b2b58420338ccdd202c70a25154794880cac57e911837b2b920730dfc4b315d9bf870c1c806d
SSDEEP 192:NzONH6kDBQmiUyAEp903MRItFLcRFqaU6:NzONH6gf0p9jIDsPU6
TLSH
T10C122A36A878AC7B4DE36855F48732135FA54137DB886F91D9EC2A2C05DF15C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f44629b5-feaa-4200-a610-a7ccc38d1957.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f44629b5-feaa-4200-a610-a7ccc38d1957.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 336c6e086242930d5ae13d4e42925355cb3f1f499f0e0b4e7065a1887dbb4e19
MD5 6d7616d08f08ef86264fa89109b36301
SHA1 c58940ff05bef0d307989ae2ae0550dd6a552a1e
SHA512 b33bc23cdac9d5752b5fd91b9168640276b96e7893a0245e3ffba161a9b7d8bbd086e15489b44075b2fba19107aea05a08fc9f1a981e8af11c0648ae61d8bcfc
TLSH
T172412698AAE9105CB3777F466FF6A96D48BABC732F06D45E10010D0F0A32A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download