ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260929-2vav4axdkf
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{2EA8DD29-3E99-4C03-B780-EA1C67A0B3FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4648	540	msedge.exe	87
PID 540 wrote to memory of 2380	540	msedge.exe	89
PID 540 wrote to memory of 4188	540	msedge.exe	90
PID 540 wrote to memory of 968	540	msedge.exe	91
PID 540 wrote to memory of 4188	540	msedge.exe	90
PID 540 wrote to memory of 4188	540	msedge.exe	90
PID 540 wrote to memory of 968	540	msedge.exe	91
PID 540 wrote to memory of 4012	540	msedge.exe	92
PID 540 wrote to memory of 3128	540	msedge.exe	93
PID 540 wrote to memory of 4012	540	msedge.exe	92
PID 540 wrote to memory of 4012	540	msedge.exe	92
PID 540 wrote to memory of 3128	540	msedge.exe	93
PID 540 wrote to memory of 3128	540	msedge.exe	93
PID 540 wrote to memory of 1920	540	msedge.exe	94
PID 540 wrote to memory of 212	540	msedge.exe	95
PID 540 wrote to memory of 1920	540	msedge.exe	94
PID 540 wrote to memory of 1920	540	msedge.exe	94
PID 540 wrote to memory of 212	540	msedge.exe	95
PID 540 wrote to memory of 212	540	msedge.exe	95
PID 540 wrote to memory of 1808	540	msedge.exe	99
PID 540 wrote to memory of 3704	540	msedge.exe	100
PID 540 wrote to memory of 1808	540	msedge.exe	99
PID 540 wrote to memory of 3704	540	msedge.exe	100
PID 540 wrote to memory of 2624	540	msedge.exe	102
PID 540 wrote to memory of 2560	540	msedge.exe	117
PID 540 wrote to memory of 4072	540	msedge.exe	118
PID 540 wrote to memory of 2424	540	msedge.exe	119
PID 540 wrote to memory of 3996	540	msedge.exe	120
PID 540 wrote to memory of 3996	540	msedge.exe	120
PID 540 wrote to memory of 4004	540	msedge.exe	123
PID 540 wrote to memory of 4004	540	msedge.exe	123
PID 540 wrote to memory of 4596	540	msedge.exe	124
PID 540 wrote to memory of 4596	540	msedge.exe	124
PID 540 wrote to memory of 2476	540	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffb67b3c188,0x7ffb67b3c194,0x7ffb67b3c1a0
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,11615796657509469376,181886438647674280,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,14540292236704120538,17553334409282410803,262144 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,6913944943801084284,5818562144283052787,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,11136064659910602331,309859293569921943,2097152 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,3231631627480300626,13147151767964263974,2097152 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,14674823041340304674,8810942577418020485,2097152 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,632053991494265990,14573220252230971828,2097152 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15533955487449958400,17823701105853262320,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,8065985703545379091,15718610686742807401,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10829791066032681232,7492723938220458086,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10829791066032681232,7492723938220458086,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,7467654614852319773,10369747707078784123,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,16540051793493519751,3436274457311339752,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,2344899572834826878,12278515164319899906,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,5615486270871454563,9586471196438689520,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,12231164954839239486,7895031240522695624,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3764467152110936682,3420923363400649043,524288 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,17489462168772043260,16584610195528160524,262144 --field-trial-handle=2436,i,500799418968689627,2165285230662192445,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d72052b078910c640f8678a55a9ddab719780625d4a130d259cd2950543038f9
MD5 8ba8beafd23824cb2470203e87c3dc47
SHA1 f1b364b4464ce098750014b60e92d55d32c4787f
SHA512 02067fbbb544b246d83e63862e0680a2a0c5ad6a47250d45287b10951935e539dc2aac6b94f22ba26bb56d6b952ca1e712064b7816a6fc847b3c26285912285c
TLSH
T109E020CC45C5D31F7104688783B4B71C819D370E96DC6B151700C88970C184C67D55E1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 976aaa38dee0e7fcbde28433364328272e7a7a4f5aae54013077e2cf977de46e
MD5 baa41a91d48a7394bd9a75f277388fd7
SHA1 8b41eb70e0d53225c0790b7c0e15a7e2e8181705
SHA512 2f669f9759e570a1a5687c71b6f5bdfe32b9c7fa59630fd3e4095a562f506419f02c89ef6b12e23f2698122930a9259f872376a67852a9be443117d41f33a56d
TLSH
T1A7516182A5674291FFDF51BD99FFA5C336374984C5A76D3180ACE5B68A0DB3E0923084
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 28143a30bc33ca44630074a01570e67bafd118414f9fbea7941a12df8f2137ea
MD5 1f0188f1e6e2a03f44e2509ee2721497
SHA1 cdf50502174de1271423e552bff436ae3da68795
SHA512 18b8efc074d13f321368dbd3396da4d6a86f6d477208d3083428af091656fac46726f93285711e8cef3d3e30a6f9ffba029a01b43371c37d1bc84f768ad496a5
TLSH
T120119CF3C3D595AE890556F06A28AE2BCE2D0606431C7C19C9D4EF2BD3E3076E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1e99dd49732dab8409bc62c42ae16765ef0a7e052c1bcd94a8900e6925c8bc0c
MD5 6534ef91c1bdaee89742d2744b2fe4c8
SHA1 7670b497d94d80734a93c03679632909995c1940
SHA512 f53d48567ee3d7a157431acfb52d27ed75c23d6e80315b2a5598baf53621e4254f1c81f324c9a6b1959e13f7d9811f4b793d6d05a36f140cdf0885090e45d1ea
SSDEEP 192:sxZVRPWX/ffsp8QZIdpdSHW6+WNGY3RftIgrJ:sxZVMX/ffsiQyAHbGm9
TLSH
T11F22C711AF28A97B8CC7D20DBA25BF53E6F9403261D41E58A6FCC91C09E6ADD120785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5b66a18931bf992f7d6e6c3c676df5496b451062241af34d74ece771c5df5e74
MD5 63c0f9209aeb2cea6315b6377211f24b
SHA1 d7377ecdca43058369ca75bf64a3511958813a8d
SHA512 0fe889d832c00bb6ca80d9b04f8566ab904727291c4b69c8d87868f1736ca7782efb84b881955f9ddc8e8538591ecf6a59ef9fce66b802315865c9997db802be
SSDEEP 192:sxZVRPWX/ffsi0QZIdpdSHW6+WNGY37ftIg5pJ:sxZVMX/ffsPQyAHbGKN
TLSH
T1F522C811AE28A97B8CC7E20DBB557F53E6F9403251D41E48A6FCCA1C09E7ACE120785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2a9cc0dc94424787277b642e3fa1ea58592166481cefb565f785d17c68905a54
MD5 eb26a437e3576d5a946d3938a4696e03
SHA1 43016b3b0f49d7490289cad3ef882b1341cfdee6
SHA512 324bf991989c99c6abf5144e79cb9aa11cc22294f879771b96d9c21b03344f8c06065f0dd7b67e9d7018e54ccd839accb8f0f6c95f6b458f7628ac7d76d35f96
SSDEEP 192:sxZVRPWX/ffsi8QZIdpdSHW6+WNGY3RftIg5LJ:sxZVMX/ffsnQyAHbGmL
TLSH
T12522D811AF38A97B8CC7D209BB55BF53E6F9403251D01E48A6FC891C09E6ADD120785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d00d902486fed023844f1511b49b0dc689245ddea6db9112fae14887cb4c7ec6
MD5 eb5ee6340b0eb9ff9c7ec16b78b20e0b
SHA1 f5b2d7128e2768324080b48e654af506153ddb5c
SHA512 9ab0170b43962380141ceb7f1792c0f4ee7964fe6e0d51f3dbffd7066e6b91a28e8c23442e0c1c0ad7494328e39d35bd752c58003e98d9a6dd4a2ac9ef188c71
SSDEEP 192:sxZVRPWX/ffsi0QZIdpHSHW6+WNGY3JftIg5pJ:sxZVMX/ffsPQyyHbGIN
TLSH
T1BD22D812AE38697B8CC7E21DBA55BF53E6F9403251D01E48A6FCCA1C09E7ADE120745F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 83ecdbf0ded28bc2b794500aea7d891f27e76a64af2217fca0c339512bf053db
MD5 0b0dcccb08be5f899555aefc7f0ea76e
SHA1 992e4705f8cc2a04b64225d307492aec2445deb7
SHA512 dc8a3fdd6f33cc6667eed9f6e9f02d109c8da13ec9dac484f962954ff1e55fe96c0a59f2a87ddb26de9336478b2de6fc08fc7053514f9c45d213a5814f2e6166
SSDEEP 768:Hl30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72UrolZMP:Hl30AbSWvS2l9u1jaLmLZ12/Y
TLSH
T1BFC2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d24492d6f8964e07ea59d1d8a8336be78dcf362c9047ff8b51a47777c4a58c42
MD5 4da61ba7f2d42d1abeb66ad0a72872ea
SHA1 44d0d2d25710b051951148c9852d9ea0669c79b5
SHA512 1ab96dbb5b5332fe876e7e0a487705cf0dc536f2c52513a5ff9cc384cff2a5a53eb1dd1b4f7b5dec060c49ba870ece3d2d3438f94ec18eaf26b9f3ee9f8e832d
SSDEEP 96:KYpOKyYSKqIKjS2jWvTlp9kNpQPPrkK3BPdkbzTwlz5Sz:E5XPjWvTlp98pQ3rXBPdMzTwlz56
TLSH
T17F91138171B7061139BE788C87A4972F46413172346CE67BBBBC40A14F6BE590EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d2e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d2e6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5a2ecff80d959f7520a03d1ef2beb8281b36e86b1b7c9dc0e770d10c1021ca6e
MD5 a2e53f67cd8a8f72e4f5d6eebd8c976c
SHA1 40fd39210988d7a36593a5f5f6de7e4846569306
SHA512 23bd250a81cdde443aabcccdd924e0b56cb501e8577f304daac9cb2fcaff6fa9c9bdc89e942bd35cd161476e6115a3e5973f177b4a9e1292b4fb0a3d017d03b6
SSDEEP 384:WZcIhsNZZcsZrApuFb9/9iX5FgLMNJg+tgOIwZOyuLIoQ:Eh4Am1awR+XsNkn
TLSH
T121828E3299749CBB9CE6E550F18B36034FB8906BD7C8AF94D8EC672D05D65D8030B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 d94032a4f922b3783b9be1b148805b40d91bd55bbe647d0a24bfeb32b8102c20
MD5 a9728f299b617a7e8f34473601c68809
SHA1 80152fb9c2be39d6e332a5779576019bb0ffe5c9
SHA512 6b8e385b9ba29fdbba4e52396acf921e44b8f56ed7215c6dec9b16f003a9623aa03ec5c96535735827df1cc9533f9c960459836ec60da7bc78579666031f704f
SSDEEP 384:jiFiZcIaqzsN78TUNTUlIlGcsZrApuFb9/9iX5FgLMNJL+tgOIwZOyuLIoQ:OFQZSwgyAm1aw4+XsNkn
TLSH
T145A27C3389648DBFADF6DA40F58A32038FB88067CAD5EE94D6DC5B2C05961D8030BD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f5387e7e41bcb3c60788c5f78e469cce927bd84d552954fce969cd70a7f94fe
MD5 f3cd73688f47d8afbcd32f1af17e3f4a
SHA1 75ff9106862f9c792a76eef380a68ae91d22a183
SHA512 f1455f00eb8bc23d1fb160483bce6ca8541e5725315049ff0662a81f3f011091f337c5dcc90dfa37c9cb1953316981030c2badf221873ebea513fea1df6ccc9b
SSDEEP 192:LONg6AmwprQmiUyM46siX5FgLKBtRJiSiVU6:LONg6ipdY6siX5FgLMUNVU6
TLSH
T15802E939AD786C7B8EF2AE55B18B36135FE5116BEA942F44C9E81B1C01D768C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f413ba1ec97198de7ce5e29e073d57aff4d4d726f587f6e224c69594cc595a6d
MD5 ea7229439a50cdccd7fdf133d8f52a93
SHA1 6787016414fbef3fb404dfafa3b05a14d7dd8306
SHA512 585e045b8ba1fbcdc9cb62823194221e568aa6ea5e6e47f4e2a9257600d174dd790a1beba9c5b7108cf8997655fdf51ae1c792ad2317bc3c1553555afdf3f8a4
SSDEEP 192:LON86AmwpqQmiUyj4dsiX5FgLKBtXJO6TlR3qBU6:LON86ipmZdsiX5FgLMNJh+U6
TLSH
T121122C36A8786C7B4DD2A560F08735139EA9522BEF897F84C9DC272C06DF59C530B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f23b32e879aa3f6b90bf6ea73f2d74c997a95fe65e6ef3471b298124cde9a4ce
MD5 8d19949df7ba652783137af17bf251b6
SHA1 43d777a0cbc778890828979a91db3ca97570bb43
SHA512 b30a940e42f93fa8f5d78cd4b29c07154a7cb1d5c61a08b4d104e55f2c9c8b591ea8d03e9dae813be16a1a90530363caa44e6852eaa90c083584419e85136a18
SSDEEP 384:eZcIhsNZGcsZrApuFb9/9iX5FgLMNJg+tgOIwZOyuLIoQ:chzAm1awR+XsNkn
TLSH
T1E7828D3299349CBB9CE6E550F18A36034FB8906BD7C8AF94D8EC672D09D6598030B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6bd5e0e-14d8-4da8-aca3-11f3e9ded7af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f6bd5e0e-14d8-4da8-aca3-11f3e9ded7af.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ace80992895cf956e672757ba026b0936dd50e09945ac22c48d6cce86aa9a548
MD5 100cbdf276f22e1c99728b8e0f68d68f
SHA1 6a3fcb11c1697a8b162e3aab1a20235ecb2b4dd9
SHA512 6b47d77b63c1f2f90cf229f7c512e3daa88a3c37bd3087bc5426b484cffaab6eb84d4f61cd26538f54ad12d65f070b050a48a1c5eeca5880b4de9aeb7ddc4cdf
TLSH
T1B0412C5CB6EA1108B3B7AE56ABF7A96D443FB9732E06D55D00110D4E0A27B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download