ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260929-2hxt4azz2q
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5896	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{A85D6A00-134C-43CC-915A-C85901692D29}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
472	msedge.exe
472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 1604	3136	msedge.exe	88
PID 3136 wrote to memory of 3312	3136	msedge.exe	91
PID 3136 wrote to memory of 5896	3136	msedge.exe	92
PID 3136 wrote to memory of 3312	3136	msedge.exe	91
PID 3136 wrote to memory of 3312	3136	msedge.exe	91
PID 3136 wrote to memory of 3836	3136	msedge.exe	93
PID 3136 wrote to memory of 3836	3136	msedge.exe	93
PID 3136 wrote to memory of 2124	3136	msedge.exe	94
PID 3136 wrote to memory of 2124	3136	msedge.exe	94
PID 3136 wrote to memory of 2124	3136	msedge.exe	94
PID 3136 wrote to memory of 1724	3136	msedge.exe	95
PID 3136 wrote to memory of 1724	3136	msedge.exe	95
PID 3136 wrote to memory of 1724	3136	msedge.exe	95
PID 3136 wrote to memory of 4432	3136	msedge.exe	96
PID 3136 wrote to memory of 4432	3136	msedge.exe	96
PID 3136 wrote to memory of 4432	3136	msedge.exe	96
PID 3136 wrote to memory of 4076	3136	msedge.exe	97
PID 3136 wrote to memory of 4076	3136	msedge.exe	97
PID 3136 wrote to memory of 4076	3136	msedge.exe	97
PID 3136 wrote to memory of 1704	3136	msedge.exe	99
PID 3136 wrote to memory of 1704	3136	msedge.exe	99
PID 3136 wrote to memory of 2404	3136	msedge.exe	100
PID 3136 wrote to memory of 2404	3136	msedge.exe	100
PID 3136 wrote to memory of 3948	3136	msedge.exe	102
PID 3136 wrote to memory of 3824	3136	msedge.exe	106
PID 3136 wrote to memory of 2964	3136	msedge.exe	107
PID 3136 wrote to memory of 3720	3136	msedge.exe	108
PID 3136 wrote to memory of 5644	3136	msedge.exe	109
PID 3136 wrote to memory of 5644	3136	msedge.exe	109
PID 3136 wrote to memory of 472	3136	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ff946dfc188,0x7ff946dfc194,0x7ff946dfc1a0
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,15692021958777701459,15224242295841947452,262144 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15809037722127649274,14695103037996021701,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,15671880948175376109,12833786459237790753,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:13
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,5894856296626628837,7794878123865122616,2097152 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,11191137780866712751,11518106888794419472,2097152 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,12885339632357182537,2169533718649973144,2097152 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,777211601274819038,13236722824013223765,2097152 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,1269407464789137706,16274933990283781774,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16136172932741378879,6810709019738346903,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,3174157875208132177,1142335426294285613,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,3174157875208132177,1142335426294285613,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,15688803493483835772,14471325692759653434,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4084369163186859464,6098928453090962370,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,6559354775446576020,11874312954580387589,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,10247717830934949169,7800809031943037599,524288 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5360,i,1924474212565718853,12967993714246054729,262144 --field-trial-handle=2660,i,8799818344107268668,14655895861000032699,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2a520a65b20600a184ab0db35b5b4907105f039b0d90178242714e0481d9fe73
MD5 30a794d1c8f7d1aeddd346b0edd4cc01
SHA1 de6c1c4163083539713e032f7415749b2224c6e4
SHA512 9b166369e5b5ea59cc2d41661449e7287d99d09424a718b72c1b5b2d5bc24a297f28f1dad1655a0931b13b8f1b372ffc740fbd95683bbe73731e21fa0f8d4eea
TLSH
T17A51B7896661A0B4E7A71A704DD132C37B34867ED7FB2E9E0DF8F0B51B4E350601103A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a2dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a2dd.TMP
Size 2KB
SHA256 10ea18e65f6db5ef5c2c3c8806df3d598ed09e3d4550a552ba9f5a93c137ae41
MD5 61c3d7e7f14449082fe9d945c28a5067
SHA1 1a35e517dbfbdb01debb63d0b2894413f1cbb19b
SHA512 8cb6ad1d3f7f19030c6afe45594bb43fdc1746dede481d94885b1c8667079f3372e511aaec2d17d2f88644cd167e941dc750dee6b322c2b1609918ce79b49842
TLSH
T17051A6896661A0B4E7A719704DE132C7BB34867ED7FB2E9E0CF8F4B51B4E350601103A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2565aa44-1f4d-4afd-83d3-6852f6713466.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2565aa44-1f4d-4afd-83d3-6852f6713466.tmp
Size 2KB
SHA256 014fb799ed6678756c6629f33ee183a9b1b4c038acad3199f55d1fd4b865c781
MD5 9cf0a4ff7550de827364d9998d620175
SHA1 e987958d73ba015ac6d0d286a9e910794625360f
SHA512 2e38df7d3308c1ab7b813e0003b7eb099ad0131d45442ca4c99661d8c3cd06b9e22f337abd1c1d71c1e4046869e6ae17be6ae5315848dfb755527a7e438abac4
TLSH
T15C41A2F3C3E8867D8D0156F4AB146E1BCE1D0915432C7C5AC9E4AE1B93E28B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4d18240a31f4139d4f5dd79b14f7d4ed752e98393879e3585c7dd4cba8a919d3
MD5 37d4695c4040d394d735e6a7935339d5
SHA1 9eba48f998b8a9635c6c3db33a3577d4bfc5625e
SHA512 b5c8cfa2a5444fdd3f3c5f77c0364aee1b837f2e2d15184ec510adfdea82a44ac0371a79834eddb02cd267f67dbd5116feb44dcd254b412ea306f8e70682d763
SSDEEP 192:sxR2RjbS/fQs8J7HRJ+zoA8p4M/g6+WNIYEI7xGNIgIJ:sxR25S/fQsY7DF/5I46s
TLSH
T183329615AE28A97B8CCBD21DFB657F53D6F95032A1901E48BAFC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 74f34e476678dde4f0ea08dfbb7cba163f9278cb222b4c8bdd63d1b7b644740a
MD5 cb972053c1d38254e97e25d1ff2be57f
SHA1 355835b73fea489802a6957d175fee3528002fd9
SHA512 96da9cc6d64424d731f7a252e24acc1e93d9cbbb056b2b90154f4001cda4c54b8e293df63ee76554b9479998729244ce2e1a9b4ce7aafb1910ff7197de8390a1
SSDEEP 192:sxRdRjbS/fQs4J7HRJ+zoA8p4M/g6+WNIYEI7xGNIgDkYJ:sxRd5S/fQsE7DF/5I46D
TLSH
T19732B715AE24A97B8CCBD21DFB657F53D6F95032A1D01E48BAFC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5c4d1dcc4a0ec5235735f6eee73008cfbfa4d0444beadcff35f603eec795eef1
MD5 a6f28a15460f6d8528c4d827062ad748
SHA1 5a03b507b12af6da466276eef65247a99ff762e9
SHA512 fc30bb9e87bc1d25b1aa55c7354721b988c963a5f77eb7c687d091e845025d55bdb59e516abdb5e4336318cd4d68a70b6e7df208fc9fa680375c3395510ef9df
SSDEEP 192:sxRdRjbS/fQs4JBHRJ+zoA8p4M/g6+WNIYEa7xGNIgDkqJ:sxRd5S/fQsEBDF/5Iq6B
TLSH
T1F532B815AD24A97B8CCBE21DFB557F53D6F95032A0D11E48BAFC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 aefa25f0aac36d48c9c3f5bca1cb5fbdb69c675975c05d12cf05df33a665fd89
MD5 81effe202c9da39998f5f7db3d96f822
SHA1 b39e27cf95ba71222e49b6226377a684cde2f09b
SHA512 af86058e41ee6f201262ba5806c18e826de047559d1b77ecb4087886a4111da068bef0ad34373c3919bddd1f7b0b68635cbce05c47b2cbc10708eccf71f6c86b
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXhroJeQ:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0V3
TLSH
T1B8B2D92B640CCB7F4FC04A9EAC196FD77D9802C79A588D4047FE995C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a5a004a32e87be71620ce3491f5ca76042ce365a35abab6bad15406d556770da
MD5 65c2ed50638f0e7a0269e32cbc416854
SHA1 cb48e262f18bdddb15a61f07435226ea7c2b1f84
SHA512 fc8f8f66a92b4d994a7dfc6dde19bf23f20231ebb5e6e6832497d1825f2b61dcf92a48c0921cd0e9587ece29394ab1779b1b189470efc4e98392f6c1b222ff33
SSDEEP 96:KYLSKYQaaZ8lJXLPkfLSPFhkKNBFvkRpJyX/q8Kziak:8J/oPk
TLSH
T151910F0074BB4650387F79889275962E568672B33559EA3BBFBC40A24F2BE041DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3bb2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3bb2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 62c97a42c0ee58c26115f0be623651cea393b485f087a097e795b045e7f6dc02
MD5 011b5bbab4b364a0b2b05e287bb116a4
SHA1 5c2468f9c3501505baae29b311d06e12f16e5120
SHA512 7bc3d2c0b706dca291eb1d7c02d0a6244e476ef4aff2f9e7c1ba633ef20654f43e831dfc06a7d456935bcd1480ba6cc83d5ca6820623bd70fbd391d59ceb3963
SSDEEP 768:N/UxvxjgC+R35urpXc7fZrKTHyHKp5XSwQs88uBkiT2J2sSNh:wZj3+R3SqtrKSEILNBc2sEh
TLSH
T1B003CF39F8A45873ACB79381364E2347AFF05553C4C41AAC89EE6A0E02CB79D574F897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 279c2bdcb2cb2319261bca1d30114b086e85eba412fdf66bdb490a459225a8dc
MD5 b9409d37b9e9c26548925e41f4a5fcfd
SHA1 bec95cd3be398cfda8389d608bd0dde0bf7ab330
SHA512 289953174eda587ba776e7481fff44217247d21427f2144598f81e01c818287750e6410d4be260381835359a4638c2e65238d46b939acd848f17e3bec1df6869
SSDEEP 768:Sg3hurTXc7fZrKTHyHKp5XSwQs88uBkiT2J2sS8q:Sg36YtrKSEILNBc2slq
TLSH
T179F2BF35E8A488B76CF683C17A4A37026FF09147D4C80A9889EEA71E0297B5E574F857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 940c6b897c75c282a4ac0706eda7ebc0c9e2203f3cb67e04cc8d2b2c063928c9
MD5 2b8b5cb5588329220c6b8e2d3d9ba7e4
SHA1 97df778e6eaa392991cf0860eb1d93551043d0f0
SHA512 b536c5fe3989a2cd9173a99b480b6826e7254628b5c969c52b6c800d9a617dad58ba9b37b7a3f158d4443c3624b03c699c34384354494070228b80243d955daf
SSDEEP 768:hg3qurTXc7fZrKTHyHKp5XSwQs88uBkiT2J2sS8q:hg3pYtrKSEILNBc2slq
TLSH
T137F2AF35E8A488B76CF683C17A4A37026FF09147D4C80A9889EE661E0297B6E574F857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 bda9eb4a0aac8e5debe26829aa9b118bec56bc3a058d000530ff1ec404ffe184
MD5 a7519ceea65d549fce9fe3abbd17017c
SHA1 1ccea3d2b98f341db250795b5d200c456d76fd9d
SHA512 c50c85e85d878341c6e6456aaecd2367497e9e40c46595733592a50762920e885d7a0de7922bf0335a9de32103958b521cd1fbb996bbb0f2b343ec01d1f40884
SSDEEP 768:R/UxvxjgC+W3jpxc7fZrKTHhp5XSwQs88uBkiTCt/P84g:kZj3+W3jstrKvILNBsHg
TLSH
T1EC03D039F8D45873ACB39385365A275BAFF05053C4C41BA889EE7A0E02CB75D670B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 4e644438bdea905fab2a9ace968b72f3c4e9b2f204f10d0ff4fc8b9aa1be3f53
MD5 dbb1a2a8a3a22c5848bdf597911beb38
SHA1 d6e4ced24cab9604a8044d4bb3e5a74fef17a40b
SHA512 9eb2621a43ec240c2cadca8f9f98f86a59c83356e7fb0adf03bb54a9771924e185f745f28391499fc546d961e26146ef0745d569e1cb243d12b592fc40661d3d
SSDEEP 768:ZFQZ3RwgLurTXc7fZrKTHyHC5p5XSwQs88uBkiT2J2sS8q:YZ3wYtrKSinILNBc2slq
TLSH
T1E3F2BF36EC90C9B7ACFA87C1BA4A33029FF05197C8D45698DADDA60D019769D134FC93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download