ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-a2ap5atgpf
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1060	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{DEEC936D-4178-4E94-9E2C-2A98D25BFB50}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4304	5040	msedge.exe	86
PID 5040 wrote to memory of 1060	5040	msedge.exe	87
PID 5040 wrote to memory of 840	5040	msedge.exe	88
PID 5040 wrote to memory of 840	5040	msedge.exe	88
PID 5040 wrote to memory of 840	5040	msedge.exe	88
PID 5040 wrote to memory of 4760	5040	msedge.exe	89
PID 5040 wrote to memory of 4760	5040	msedge.exe	89
PID 5040 wrote to memory of 4336	5040	msedge.exe	90
PID 5040 wrote to memory of 4336	5040	msedge.exe	90
PID 5040 wrote to memory of 4336	5040	msedge.exe	90
PID 5040 wrote to memory of 4000	5040	msedge.exe	91
PID 5040 wrote to memory of 4000	5040	msedge.exe	91
PID 5040 wrote to memory of 4000	5040	msedge.exe	91
PID 5040 wrote to memory of 3580	5040	msedge.exe	93
PID 5040 wrote to memory of 3580	5040	msedge.exe	93
PID 5040 wrote to memory of 3580	5040	msedge.exe	93
PID 5040 wrote to memory of 1184	5040	msedge.exe	94
PID 5040 wrote to memory of 1184	5040	msedge.exe	94
PID 5040 wrote to memory of 1184	5040	msedge.exe	94
PID 5040 wrote to memory of 2804	5040	msedge.exe	100
PID 5040 wrote to memory of 1780	5040	msedge.exe	101
PID 5040 wrote to memory of 2804	5040	msedge.exe	100
PID 5040 wrote to memory of 1780	5040	msedge.exe	101
PID 5040 wrote to memory of 4568	5040	msedge.exe	106
PID 5040 wrote to memory of 980	5040	msedge.exe	113
PID 5040 wrote to memory of 1632	5040	msedge.exe	114
PID 5040 wrote to memory of 4184	5040	msedge.exe	115
PID 5040 wrote to memory of 3824	5040	msedge.exe	123
PID 5040 wrote to memory of 3824	5040	msedge.exe	123
PID 5040 wrote to memory of 2724	5040	msedge.exe	126
PID 5040 wrote to memory of 2724	5040	msedge.exe	126
PID 5040 wrote to memory of 3684	5040	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbacf6c188,0x7ffbacf6c194,0x7ffbacf6c1a0
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,7861851462919520431,8020271671334492652,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,13049295065284344926,88515282515974543,262144 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,6035530141540513388,9590048285646871221,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,4006280577475921428,2669756199468874162,2097152 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,15480505217067182891,15842729979233173874,2097152 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,2856024566566311260,2812142236845750221,2097152 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,12412928732934263079,12960907391312449566,2097152 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3705346195110533965,1573542223620494361,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,13712967816432094528,4705813921595645681,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14112911297668066522,17504085683498512273,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14112911297668066522,17504085683498512273,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,5225443652110974321,8678810085855307232,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,2150548914383459436,11143221866810224446,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,17291448785835705426,14007889836265174989,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,9387603103821330666,13497548742571394802,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,378971006890310976,14459065938775353642,524288 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5160,i,14266498229127301115,12580717326671491065,262144 --field-trial-handle=2336,i,11200190430831348313,11122142267750738227,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4855ae8c9131c39e740d2adaec66302e1923adf7df688dfc327a026435c4a488
MD5 8c8a7f6866b65b23b56fed9d8a32debb
SHA1 57f1be839108a095fdbab7ad42fe88ca4ff20619
SHA512 270b763ec20d3c6075a7337098e1e0fee69d0af510e7a886b7c685b3c80022f8277cd10bd648e2f7f7649d099071ab531417cb01c1737a0f05c3bdf930acf732
TLSH
T1D461858E516A4AB5FF9F9278A9D220CF3A7456E07F436D223D7ACC7870263818338354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b810.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b810.TMP
Size 3KB
SHA256 add3c5cd5c1bb330cec9dcba67cf14b3aae5b57acfc32e5fd0639fc282d20082
MD5 8d21bceb4ac67502a903fac999b036c2
SHA1 c0cceafd1ffb6d6a36cfab8ee22d02f77883c52b
SHA512 018d98919eb09b6e268ab57fb046f6db2433904718b5c801328d8b5ecd8259eb8f6aa2dd88249127d1defbbc4fcc8ed8789011e0bfa00f126626a5b8405e0a16
TLSH
T17C61858E516A4AB5FF9F9278A9E120CF3A7056E17F436D223D7ACC7870663818338354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 dc3a9e3ad12c006118c0d89824d7e52ea6791b0541e9de409c1a9c61b5123771
MD5 fda673d3619bb9f487f2541ca163832f
SHA1 e62d7291bea7247810c34f236828c6899fb11911
SHA512 0cce75d8ab1cfc15e996d31601f12037feeceaaadbce52385f59c0f3e2872e80c6ee24377a77bb1b1be44c2c0e6843fb06c6fa7aa796aa11b9e903628cf20b6d
TLSH
T1C1117DB7C3D585AE8D0117F05A24EE2BCE1D0506421C7C1985D4EF2793E3475D10299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 de96de2f298444232671e5e0e0e8d6db2772dd4c60eb6057c16d09c5a83911bd
MD5 02c8cec8f5212b86563f91e46f3a5e99
SHA1 38b44b3fff3622c4974f0bb39ae154f5b4b5724b
SHA512 7e14a66de52a2ab7bd1ffac77114e578a881b4de577aaab0c749b36bca81919b6c92c6733ef94d817c885f3012a455e0481495d42f22eb89f4dff0d684ba497c
SSDEEP 192:sxZXR+Wv/foslMIdpdqHW6+WNGY3RfiIgrJ:sxZXrv/foslV8HbGv9
TLSH
T18E12A7116E38A57B8CCBD21DBB25BF53E6F9503291D41E58BAFC862C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 34e44a72d7ad29b59104dd68a3e2004c4253ae61394a9ddb5666e45dffb4abbf
MD5 92c481eb530beb34ec094a12c9ff47fe
SHA1 eace678812ce4b3d65cfdcc43442090dac5f753e
SHA512 871fdc80809c5c367a1d3a86568f2859ba9f0791c20fbce0d0a4385b1e3ffaa3a3d0e6be1073d2c5cb0de4bacb261f44914edc37561350f87f10a054d34b31ce
SSDEEP 192:sxZXR+Wv/foslMIdpHqHW6+WNGY3wQfiIg50J:sxZXrv/foslVKHbGBn+
TLSH
T18522A7526E38697B8CCBD21DFA15BF53E6F9503251D41E48BAFC862C05E6ADE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f99a2c07db99cd2b067b24c2660ab1456c3e6f952eb3c6a80a558dce21e2339c
MD5 a79f83d871df68605a4728b1e36a5dcf
SHA1 1a7c3bb3f076a08d4b6784a96de487a301b82462
SHA512 fddeff7b267adea1b03ebd1baa1aae2a13371459ad4ef5270935894f058d8e25112ca64da9f6400514cbd158e65b6ec8c3b49b76602cdc31df292ed8370c77a8
SSDEEP 192:sxZXR+Wv/foslMIdpdqHW6+WNGY3SrfiIg50J:sxZXrv/foslV8HbGXG+
TLSH
T1F722A7116E38697B8CCBD21DBB15BF53E6F9503251D41E58BAFC862C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b07b37d3d9708561effe000b7de88f32f9b4a31cba9782d94a8a1810028407d1
MD5 3bfbc391a6672c4c8b4ac2bc61e21964
SHA1 8f5248ad0a1f4c2c3662848a7f29df19633d0f26
SHA512 3a389ceac5ea1bd12b600faa6b60dadc8f56e4afddaab36d978bd5aa2fa1cadc6a2991c5a234bc4fec3f2878e6196dc3f5910374efc7cc34a62439e62f43b364
SSDEEP 192:sxZXR+Wv/fosyMIdpdqHW6+WNGY3RfiIg5eJ:sxZXrv/fosyV8HbGvU
TLSH
T10222A6116E38A97B8CCAD21DBB25BF53E6F9503291D41E58BAFC862C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 eb0c3ad3be93036581884553ff289f13d2f0cc3c73cfc5de471fc14b6e3084e5
MD5 7fa0ebe66e5d57ad1adf35cc33b46040
SHA1 5b9504a362b733323fdf80a87ac627a26a55765f
SHA512 791999c08462467cbbbec4007d2d9e054a0e7e74011cd3b61c9957a1a3de10d4f2d1d1fb2fa02ad6c71071c67f82f78d4778924930250cc31199fbbd9e16241a
SSDEEP 768:5330AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72KrolZMB:5330AbSWvS2l9u1jaLmLZ12h+
TLSH
T14DC2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 967B
SHA256 8b915d751a843544a4005c69b44626d56e658c405c0c3489961390432324c95f
MD5 31102795eb203de97f41c430192cbf8d
SHA1 709fbaa56a05a68ee2a167ab183e3d3e074ed6a4
SHA512 0d53ab0f06a726ba1bb53cff046d933630c3b73742953a6db3ccdcee68a2a910385210dd3f96e0e13116f93408c2fcc13c76c8b3d368919d8f3f369568217c11
TLSH
T1E1115E52323A06D0287D29248198E61E62413553359CEF6F7BBC88750BAEE0CCDFC6ED
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 be248366794872f59912fab9e2e5fef100e192a18b1e47c392ab4daf47988ff6
MD5 4ef1c86fc7078e76ba5b3b1a3ea0d786
SHA1 97fa7675d212b99ef63a9f241fe57d7e4bb75f05
SHA512 6590db53b6b508bfb38ea0c754590e75a023e7ad18b03087d2b7b059f40dca1bc95a026db204b1f3ae5423ff79d6aab52f0b34d3bb56abe44e6115e28ad96d33
TLSH
T101218052723606D0287D25288158E61E52423563319CEF6F77BC88750BAEE0CDDBC5DD
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595356.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5418e562e16175390eb4f554294f089592f01b68e61b074028170845a88b0b57
MD5 e17224e5a34b972da331223bbb6dbeba
SHA1 201f6663813a592416c62a987d7f259a17bd2fd6
SHA512 dac6660c77c478716383e44af6f71c3e9faa17a2cd5a9d54054064fca27807d2c7c6f002dc0c71caa934941d84196127ba7dcc5310f4a27c2e9f30f8355c762f
SSDEEP 384:VZcIhsNkkrfpu8S89iX5FbzxhdVZh6DKhH4oc:thgfO4ad/fYGH4z
TLSH
T14F82AD32A8785C7B4CE6E155F0473A03AEB89067D7C8AF84D5EC7B2D01EA9A41307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 eaf515c86e12f62aead899c3ff89cd7648648ad443937512693a3e188c7a9b69
MD5 49c1b42164a41e232f5779e9704d952e
SHA1 7b84d6d58278e1ff5924fcab79ac895cbc71a933
SHA512 a71d28d514f2738c7df248b26dcb079e46d66a47c816e80361180122d0751eb966bab1f4835bd4e3c4c7835ffbb2278ec285a773c60438239897ba6d3895b541
SSDEEP 384:piFiZcIHzsNs8TUNTUlIlTrfpu8S89iX5FbzshdVZh6DKhH4oc:AFQThwgFfO4aA/fYGH4z
TLSH
T14AA27C3398B8887F9DE6AA45F44A3603DEB451A3C6D4AE94E6DC6B2D01A70D81307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a64328ae2aab3c877c4c4b6f245682f3d6ce52c24fee0da984f6b472ef19ca59
MD5 62e7cf7f3d62a3af1069569bb900643f
SHA1 c4021e1bcc1b7c3f9dace01889957311e70261e3
SHA512 a9cacd54852b16469f2df28755437707436bec8abf83c93d467bf082c2e926dea834ef6c50b4d42cd43e0138309059601c0d91fb018a3bbc1301a7a31d4ad3f6
SSDEEP 96:gqONkEQsjpfuMVwptaL5ih/cIPURHl8h4otop5WiCD4BIPuva6zx8X5FxbxLYviR:LONM6AmwprQmiUyuM6siX5FbeJi3NU6
TLSH
T1AB02D935B9686C7B8DF2AE49F54737239FA5117BEA902F84C9E81B2C01D769C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 54836453dc3aff0a7637ae67238167630eef2cfc4f5fb7654f9240128f2a9f73
MD5 15178a1608d767e52269de1f16d89ebe
SHA1 0593e28b067f993b9c2a264fea318eb6319f05fd
SHA512 3b74b2e4583c8ae0e52f82ae8653cc9ce72b67ad9190e878b087140b0c3cd61becabc778c809529be310b34414abe5de11b22478b31698955264ed4a082400d4
SSDEEP 384:jZcIhsNkTrfpu8S89iX5FbzxhdVZh6DKhH4oc:7hnfO4ad/fYGH4z
TLSH
T168829E32A8785C7B4CE6E155F0473A03AEB89067D7C8AF84D5EC6B2D01EB9941307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0a6d2c473b9a44bfed4198abdd3a745c7492648ab96858f8cc294c552cd1f24
MD5 a25642320fdff5b5141fba123e377901
SHA1 03fdac912566e748e5e7a5f9a7884753f00d7faa
SHA512 fe939f071c0322b53e1b0384db247462c7a3ee6982f1daeb4da81954933ebfb4aa0edf159d8b7b6604806dd18db203727df209c88366a902d7ab77c2c77f5662
SSDEEP 192:LONF6AmwpmQmiUy1MssiX5FbzQeTlRjqodU6:LONF6ipCfssiX5FbzrhdU6
TLSH
T138123B32A8B86C7F4DD3A554F04736139EB55167EB886F84D9EC2B2C02EB59C530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a708bbced7cd322e4bbe1f9396b05bf596554da0c019962c597f836d20ee43ed
MD5 3922ee3e28bd5fe941b4ca75f062d2ec
SHA1 07f1c0504beca1ff60aa473870dbe135a0d43384
SHA512 760993a3a9b5bebd6e3c5ccb5fcce8f035a7835777ed6eba480927d2caaf80cb0863e893e753f40280f62656ba8199e7a4bcb4165a1dbadad22c5d30d258c216
TLSH
T1D3412C58AAF91108B3B37E599BF6686E487BBD672E07C45D00110D4F0A37A40CD62B37
MD5 SHA1 SHA512 TLSH

Submit Download