ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-213has1t4p
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{CE6ACA8A-4554-4AA4-B9B8-A653B523A35E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2604	2984	msedge.exe	89
PID 2984 wrote to memory of 1900	2984	msedge.exe	91
PID 2984 wrote to memory of 4436	2984	msedge.exe	92
PID 2984 wrote to memory of 1900	2984	msedge.exe	91
PID 2984 wrote to memory of 1900	2984	msedge.exe	91
PID 2984 wrote to memory of 2840	2984	msedge.exe	93
PID 2984 wrote to memory of 2840	2984	msedge.exe	93
PID 2984 wrote to memory of 5780	2984	msedge.exe	94
PID 2984 wrote to memory of 5780	2984	msedge.exe	94
PID 2984 wrote to memory of 5780	2984	msedge.exe	94
PID 2984 wrote to memory of 4528	2984	msedge.exe	95
PID 2984 wrote to memory of 4528	2984	msedge.exe	95
PID 2984 wrote to memory of 4528	2984	msedge.exe	95
PID 2984 wrote to memory of 4848	2984	msedge.exe	96
PID 2984 wrote to memory of 4848	2984	msedge.exe	96
PID 2984 wrote to memory of 4848	2984	msedge.exe	96
PID 2984 wrote to memory of 4772	2984	msedge.exe	97
PID 2984 wrote to memory of 4772	2984	msedge.exe	97
PID 2984 wrote to memory of 4772	2984	msedge.exe	97
PID 2984 wrote to memory of 5044	2984	msedge.exe	99
PID 2984 wrote to memory of 4936	2984	msedge.exe	100
PID 2984 wrote to memory of 5044	2984	msedge.exe	99
PID 2984 wrote to memory of 4936	2984	msedge.exe	100
PID 2984 wrote to memory of 4316	2984	msedge.exe	102
PID 2984 wrote to memory of 2632	2984	msedge.exe	106
PID 2984 wrote to memory of 4156	2984	msedge.exe	107
PID 2984 wrote to memory of 5420	2984	msedge.exe	108
PID 2984 wrote to memory of 1096	2984	msedge.exe	109
PID 2984 wrote to memory of 1096	2984	msedge.exe	109
PID 2984 wrote to memory of 4512	2984	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fff6888c188,0x7fff6888c194,0x7fff6888c1a0
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1812,i,1099092849484283857,4923818366834715601,262144 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,14545097771166826024,8963458445411778137,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,1227525087345335679,3829104407499913751,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:13
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3360,i,10864553251955711451,17179035290995269544,2097152 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3364,i,16379046251977716634,10908402354511390634,2097152 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,636556971609459376,11242999988531757936,2097152 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,789714277031919974,14835037110536971552,2097152 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:9
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12241857162042138125,2876242683696636928,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,398434180622391568,15327551337109692498,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,3217374980835233264,121032025264864552,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,3217374980835233264,121032025264864552,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,2260035295733422088,10016507094487569899,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,10690099954287320970,12238519605113339064,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,8532862268787465815,4960072722506508210,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,9996684257361236374,11834780495787102914,524288 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6428,i,6223077129585877381,3210845502678341195,262144 --field-trial-handle=2364,i,6528421974679414146,15888331153580915758,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0526a2a51e51d4fabd0b1d17ef03f5340c42a3dfcb2119ece19ca3fb7900a64d
MD5 844a3eca2c89c5806ce623a8aaa667a4
SHA1 92425b0bd5ebe6baf101dd06c4c2d65b1cabbe97
SHA512 19fb4fa602526e6121d2bbb2984c8130d972906c815cef03a10d6c046e88bc013fabfd2daed35ac6fc10b90eb453c529c4fb4c4b465fb957c45a55ec67aa247f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7a50f5d93750b0bef68e595adc436d29bedf54d79063d980a1001030517ff078
MD5 6c119a1bb71a77207b275b2e9ab15ad8
SHA1 9a9b186e305b80bb36a489701bfbcac7d6acc61f
SHA512 b810cae16494159d65c9ff8fe7228f8e9d7d458ee533ee2053e5eb0ec8f85762faaafd8c25ef61cc60f2e02b002b76688d52bedb58f320947071b3154497ca30
TLSH
T1B9515C8C8D438E8CE7A8FB72CDE130CF3A2063B8B5C31E4E3065C47877A6748619421A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 df071870a53ccd310dc08ab14cd18c5fa643918261833be49740bf6025d4034d
MD5 21538d39325082fdd4b849797d67f3e4
SHA1 b89f667f7f18581f90b823d808317a79e33012cb
SHA512 72a7b8e65d3be76bd56b5bec013c8a42c94db84023c262566ea696df95f35357d078fbbbc6dcc98b01d975e04f119ea913645a2d342fc935ac60f9ac1b899d05
TLSH
T121418DF7C3E8867E890156F0AA186E1BCF2D0915431C3D5AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3f27611d95500b93042e7f7829233ead9fb63d5542439818d5e8d01b967a69de
MD5 209dff2ff908ab86d3ca6c631696631d
SHA1 440143b0448e9703b73eba8848c80ff8c3f02b2d
SHA512 d45dfd02b7c84d1c4ac83c71d4cf253733bae926eb016c8f88c188a073c0f9c822e0f700b409894fbc30b4430281b9a77e8ba9b63920b9d393a8c2b1eee085d8
SSDEEP 192:sxRVRpbQ/fIsQKQ7R7f1zoA8p4a/g6+WNIYlacywG5IgDqJ:sxRVzQ/fIsFy7fYH/5Ihy
TLSH
T11032C815AD68AD7B8CCBE21DBA65BF53E2F9113361941E48B6FCC61C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5835363de285baaa6a4bf32179eaae0d44651a612a446c2bb135454c6038dc74
MD5 16e9dc5b2fd4074e00ffee228a546b1e
SHA1 de000e86339a6aa23b8dacf0a4ec85d1c3bd1e3b
SHA512 b0ebdc7deeb2177f98ab2eaf4cf7987b0c7d944e448ccab4a96bf7b280b4d0975b93a2d01cb1955e4c2bebaa7e00e318185a9dd5688b5e2188758e9461eda541
SSDEEP 192:sxR2RpbQ/fIsYQ7R7f1zoA8p4a/g6+WNIYlac+wG5IgIJ:sxR2zQ/fIsYy7fYH/5Ins
TLSH
T10832C815AD68A97B8CCBD21DBA65BF53D2F91033A0945E48B6FC861C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 80813a1c5caf1ca244669542c6df50bf81829950832bdd759383bae96b84f21c
MD5 3153450c0a8f05bc7c2676fa20a94111
SHA1 7be73a0e9ad53d9ce7b46d70c41fa6ac57e7dcbb
SHA512 5dd0b460dba1be53b10ce128557ee6b23e1daa3e46d0569dd21afbb5b8b2df369a8ca2b7c9390dd08ae0451b7a8504b54368447bb7a2d5b6d8e8696437327f54
SSDEEP 192:sxRVRpbQ/fIsQCQ7R7f1zoA8p4a/g6+WNIYlac+wG5IgDYJ:sxRVzQ/fIsly7fYH/5In4
TLSH
T1D932D815AD68A97B8CCBD21DBA65BF53D2FD1033A1945E48B6FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 4891deaeeadf7bb775bd863d4735ce94377c5f04c742a9cc4fabbc74d909e4dc
MD5 2ad2817cc216fbbc69aeff4f7387af5b
SHA1 2ba98359c909ef960542c80d0f06be4e3d77d2b4
SHA512 6eee8aa767b59bd5be517ea805a8b8c8564a9958cfa6f213c4daa60874c4f3809f8036a0a44320fd3ef62f8bf3707b238149dbe4faa133e3bd9b674b0d3bca2e
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfqroe24:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0VL
TLSH
T1C0B2E93B640CCB7F8F814AED9C196F976E9C02C796588D8047FE984C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e64aba8d8218546d4b2cbc8c7c1e3451873bde1c775489f5978783acbe5f3451
MD5 2813d612db5a4fbb9a3a1c89328898b0
SHA1 1b12a1c5d6c92e99d3c01f9152416654e6c13df0
SHA512 da43cca39792674b459dd6611db071d53553ffe74f8ddc51199c80ae4615a1071281eef4c129fd19f0a950559d7e0dc30a33ec8dfed30c6b7008eab902cf6819
SSDEEP 48:K010JF3jXYbLuLISdYK991vYxdIY+vF1yL5IVpz3Lkb3SPISBkK9B1rkxJ0YyzTj:KUGsKzSmSycK3q8jWKA0CSz
TLSH
T11791FD5071B7060039BE2A9C84E9976E02D531727019FA6FBEBA00594E6BE0C5EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 589e7e0da54a49692214614fb38518e5d622705686e07531c1a892aa2fa2531a
MD5 2474b80ec062b143546aef1d2ca43ed3
SHA1 530b936283c8dc5f36998a863d7f4eb9e3bf8864
SHA512 25162371ea923862e12de98b6250c83eb91fb102fdf1b444a5a7caab9053321c6bb65254052aca583e8991db5d6afc05da7cc8eb422567602f457ef6deea4fcd
TLSH
T1BD81FD4471B7060039BE299C84E9976E029531727019FA6FBEBA00658E6BE0C5EFD8DD
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fa25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fa25.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aff07c862cde57f38a06658d7cf4e4640974080d3c95f6024d0ea4bbee6c10a5
MD5 46f11ba28a941ca151d96e628b2b499b
SHA1 a984ddee05d8a4ae47fbe1b3e28fc48a61f58276
SHA512 d3fb437b1c71315c2e2e4309a63798d593393c5b3570d79d453d3fc43ff83a7a313e40988a161c26fbea94c5bf5d141c3be91153a0adad48a58c2f9dc7cd2539
SSDEEP 768:103YIepSFajkKvtyvnqMwQi5BgK5/CwYcZC4YGHml:103LMavVmBg8/d84YUml
TLSH
T1A1F2AF32ECF48EB75CF99280F6467746AFF49253D589098484DE6E0E429B9EE1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ac4733a2be71bef19e41f208cbee6e115bbcc59f7c17c751faae84d7a76de6ef
MD5 43450ef0923b17e0f3e454f58d5a32cf
SHA1 07bb326818b3acdd18a9262c57da6ff3e2575c6e
SHA512 5b799ae715502d7c2538de0418444155e472d4fd97ee5e7584641849fdfe9d0c4cb55fc925abd0fa29cb1bfeddbd9652b44d89595879f08cb129724ba5b82e55
SSDEEP 768:LFQ231wgtI9pSFajkKvtyblnqMwQi5BgK5/CwYcZC4YGHml:e23GFablVmBg8/d84YUml
TLSH
T1F3F2AE33ECE4CEBB9CB99B80FA467746AFF45293C989599481CD9E0D01978DD1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bb5bb61e21e74f780722a1d4ad34df0445a1a46ceb5e15d75e665a0f2c78b065
MD5 ba3b329b9f458eb73fb1c4e32cdf3bed
SHA1 10a92d86292c3b640d0598f8e305f2c734420a3e
SHA512 553e8b1630406b6c056123eb5ce28f4159bf5351d8c55507a4624a43744bf4711c0fb6cf1389e4587d74221d1dfe3d14e0bdd098de65d09b143cd1ad6d4b47b7
SSDEEP 768:u03nI9pSFajkKvtyvnqMwQi5BgK5/CwYcZC4YGHml:u03IFavVmBg8/d84YUml
TLSH
T128F2AF32ECF48EB75CB99280FA467746AFF49253D589098484DD6F0E429B9EE1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e517520d6a3c2d5cb988ecc02336b29c037793e17f40759b8c988f63c2295f0b
MD5 ac867cf3be6da42cb0d9a2d958f7131b
SHA1 900623d4979e574c616326cb1486d3ee1ca2c490
SHA512 74b15f4db4294064d28115da04d92b35adee09c20e8bd9f2b1b773e98b9c96d5624d3f8b9a61470e41c94a888e7b9e5ccae6e197a09017051508c0a903e99245
SSDEEP 768:O/UxvxjgC+Ft3EQbSFajkknqMwQi5BgK5/CwYclRA8Dea:DZj3+Ft3EwrVmBg8/dzA8Sa
TLSH
T14603CF36ECB49EB78CFA9644764A638BEFF45193C484089885EE1E0E06D79EC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18d204f8-664e-4d9f-b502-09e941611db9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\18d204f8-664e-4d9f-b502-09e941611db9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download