ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-aaa7ksws7p
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1100	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{2F6FAB1D-ECD4-4A07-92CD-817860309A8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1428	4468	msedge.exe	84
PID 4468 wrote to memory of 2452	4468	msedge.exe	86
PID 4468 wrote to memory of 1100	4468	msedge.exe	87
PID 4468 wrote to memory of 2452	4468	msedge.exe	86
PID 4468 wrote to memory of 2452	4468	msedge.exe	86
PID 4468 wrote to memory of 4908	4468	msedge.exe	88
PID 4468 wrote to memory of 4908	4468	msedge.exe	88
PID 4468 wrote to memory of 4904	4468	msedge.exe	89
PID 4468 wrote to memory of 3180	4468	msedge.exe	90
PID 4468 wrote to memory of 4904	4468	msedge.exe	89
PID 4468 wrote to memory of 4904	4468	msedge.exe	89
PID 4468 wrote to memory of 3180	4468	msedge.exe	90
PID 4468 wrote to memory of 3180	4468	msedge.exe	90
PID 4468 wrote to memory of 1640	4468	msedge.exe	91
PID 4468 wrote to memory of 3364	4468	msedge.exe	92
PID 4468 wrote to memory of 1640	4468	msedge.exe	91
PID 4468 wrote to memory of 1640	4468	msedge.exe	91
PID 4468 wrote to memory of 3364	4468	msedge.exe	92
PID 4468 wrote to memory of 3364	4468	msedge.exe	92
PID 4468 wrote to memory of 2544	4468	msedge.exe	99
PID 4468 wrote to memory of 2544	4468	msedge.exe	99
PID 4468 wrote to memory of 4020	4468	msedge.exe	100
PID 4468 wrote to memory of 4020	4468	msedge.exe	100
PID 4468 wrote to memory of 4192	4468	msedge.exe	103
PID 4468 wrote to memory of 4888	4468	msedge.exe	111
PID 4468 wrote to memory of 3520	4468	msedge.exe	112
PID 4468 wrote to memory of 1692	4468	msedge.exe	113
PID 4468 wrote to memory of 852	4468	msedge.exe	120
PID 4468 wrote to memory of 852	4468	msedge.exe	120
PID 4468 wrote to memory of 804	4468	msedge.exe	121
PID 4468 wrote to memory of 804	4468	msedge.exe	121
PID 4468 wrote to memory of 4968	4468	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff82ab5c188,0x7ff82ab5c194,0x7ff82ab5c1a0
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,12717384210223301552,5243959080368017981,262144 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,8195531525758812834,7417714906573260256,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,590536342362299746,14140959806312199882,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4377674347476251995,2563848291591604530,2097152 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3028216121126864023,16204175162428482430,2097152 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,2694683381033456226,13930680753280509,2097152 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,2428708092291803734,11081534639408034895,2097152 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3809317694606528577,8298272854490417273,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,2276780878997452045,4606516057072165741,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,12360023999898696301,904894390038969846,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,12360023999898696301,904894390038969846,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,12880774174406617882,4434453637498844004,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,11598152984705525555,16916151888832713978,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,9003093349927761984,227022429364207553,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13788393591342029120,9074415259613340665,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17799817134648564411,1952803437975673096,524288 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,13707865516934194540,8463296391121548157,262144 --field-trial-handle=2320,i,12537798197657764705,8356426603092273291,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 282236acb86c464bf6dffbdeee0e96d37e9accce6d493f84a56c66fddb036bd3
MD5 4a96da572b3e232846eeecdaaef546fe
SHA1 c770efb5d0ade1ec212cbbadf1ec2859bbd6a61d
SHA512 bfca1384794cfc21ec4794d17b448aa95962cf9fc9294713eeed111109efbc61c91e78aefc4f009d543764a6a3d01306cb7353901994e484d07cdc4b7a1c3370
TLSH
T13A617041DB9183F1FB6E4072F8F800ABB23E6D8965831D831248D575E4CE7EC61DD84A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591cf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591cf4.TMP
Size 3KB
SHA256 bc45350b008afa87dcf237636a9ab5b398c1fa7d7712282c4a16ac8d8b181512
MD5 f1684c9a4376eb33a83ebdd1fdfec5ae
SHA1 c5a5ad1c2c385971773275d25b7b073d448e985a
SHA512 b8abc87786212a3d62228bc91d231ab08eb4680d682c7f7a14c5742c89b5e535d3fe76d96554071735eaa9fd58c7d559a49ee0d72431acb50d45ffbd81b53de7
TLSH
T1A8617041DB9183F1FB6E4072F9F800ABB23E6D8965931D832248C575E4CE7EC61DD84A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 957ca8a626e61834151c2bdcfe0a48c24378eb1c3e54de75921d111d28820439
MD5 90cae6ac4d0372d1624a98f00d79a672
SHA1 7104b58af9a6e13d514efd8b2d3fc282400d4c0a
SHA512 5e66e35df429043a3bffb595c77cc8a767b3f79bee666bf65451fdd244b0eb8b9280d4071f0d15a5b15476a104cd03bb8168dd5c9dfa802234b702f8a1acf92b
TLSH
T105117DF3C3D595AE891116F06A24EE1BCE1D0605431C7C1A99D4EF2793E3475D10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f6d63a9cc60dd4b6065997768b316c21edf7a3821c3b7292f4f27d61ff67323c
MD5 5e626e7cb23c5dad44c01a38e2a4b925
SHA1 f36923078a4104bf0972056d71c5085b8bebcd0c
SHA512 591d4ccafa44de50ecd233e34876f9935ae1ed43501cde0e82ebae3ff5b41336d53ca0f998e4f56fefd1d6fe247fcf72f2cf6810741ca2f043c31dcc5d5dbb5b
SSDEEP 192:sxZORAWK/fQs5xIdpdKHW6+WNGY3RDQIgrJ:sxZONK/fQs56sHbG99
TLSH
T13712A6116E38A97B8CC7E21DBB25BF53E6F9503291D41E58A6FC862C05E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4ccb8bba1821dac41664becefa25495b67c9e09f3734bc0a9bd321f75a0b2e64
MD5 6efe08bd17090b4c88d0a1b740ee21ae
SHA1 d66765f907d62d81aa7adccba2967af86a82d199
SHA512 313cd07952c7941ddfdf112b50d8343e8511b683036b57f3dec094d7a60596adcb348f55b1ab449be920880229db40598de3175073dae87200b30468f6b0b8c5
SSDEEP 192:sxZORAWK/fQsyxIdpHKHW6+WNGY3JDQIg57J:sxZONK/fQsy6qHbGHH
TLSH
T19022B6526E78697B8CC7E20DBA15BF53E6F9503291D41E48A6FC862C05F66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 28325cb3d457211525265f2a23cea974349a7ab8e0b86b9908d8b70e01fa2e3d
MD5 91069a7903fee7f613a39c6f1e4d189c
SHA1 711ce6a258a2921d22f97fa6ae798785b12826b5
SHA512 733646c75ffd4fc2773aaa802c3ea0ffb86fdce989a5409517cbff58d7523ed72d14bec7c4d41483c5175d0a00ce3fcd087b8e0399a3a52d62906855ae6826c8
SSDEEP 192:sxZORAWK/fQsyxIdpdKHW6+WNGY3RDQIg57J:sxZONK/fQsy6sHbGrH
TLSH
T1C922B5516E78A97B8CC7E20DBB15BF53E6F9503291D41E48A6FC862C05F66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1b459824d197ecd42f2fa4ba4c4bc48a35ddd9db9b1a798152a568f4da5e7e0f
MD5 69a95bdbde1576084b930dd1f7b33be6
SHA1 7f663c656466a16887fcca6f74d9949bfd4eb60c
SHA512 c1bf164f24c94e42db15360e2b48efd4295ece624b31ccbf543c1247b42a21a5e3fc80e0ed76b62883089e60c9c6d1054a9599cb319b29922b66b8534834af5d
SSDEEP 192:sxZORAWK/fQsyxIdpdKHW6+WNGY3RDQIg5BJ:sxZONK/fQsy6sHbG9h
TLSH
T18F22A6116E78A97B8CC7E21DBB15BF53E6F9503291D41E48AAFC862C05F66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c9e6c86a55bb8a59b5207fbc8b308160497e60ecb9bc357ce71598884c096d6f
MD5 daba2a6d47213210b2fb827a3deece2c
SHA1 6202730a4909369656a0219496e14d24b718c4b5
SHA512 d6685a790f95c9fb4f45259bbfd683b03216eef55c46a9ec00d037d19f91ae083d486ce2400d02760390516c1767c137f55e6cf6332de190f2337088696a265b
SSDEEP 768:yK30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72+rolZMe:yK30AbSWvS2l9u1jaLmLZ12Vh
TLSH
T121C2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796688D4447FA944C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b7bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b7bd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 add3def7ab6721250878f0e962cec59363f2f0700c7f8a23504626de49b5b18b
MD5 e72d95a05a3de2416b475ba2a3a52e47
SHA1 f6e65b2dda0bf4defb326efdd55bfa8e11763db5
SHA512 b4da1dd88fe2f409c0e63005700e5e923b25f9a2360e95387e52d8905b2540d65e68643d82c4199056bf1049c94220f54722ac4b41f52b2b4a4ba4e1274c318e
SSDEEP 384:uZcIhsNERKb6S6pu7DYIu9iX5Fj8okXavVZh6DKhHB+no/:MhFI6S6MYPaCavfYGHkk
TLSH
T1DE828D3268B85C3B99E2F141F84636039EF99053E7CC6F84D9ECAB2D01DA6981316D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 cbd1497f8049f9daf195323c4a827312ca152ba0cdaa5fbfd2ef12f2b9bd68f0
MD5 e15f61d9022ec44a80d0c6486974d4cb
SHA1 218a9976955facff8a843454e024f22a8270e12b
SHA512 062c5bef8acf7a63f79b83deb6e8ecc1be3d764336efa3a9dd5552a67d54f1b065563e8404d83e1ccc6c1105dd240791d5181f5d52854cbd6a6f3f44ec20a486
SSDEEP 384:BiFiZcImzsNM8TUNTUlIlkKb6S6pu7DYIu9iX5Fj8okXNvVZh6DKhHB+no/:oFQWdwgyI6S6MYPaCNvfYGHkk
TLSH
T1DCA27E3358A89D3FADF6EA45F94A36139EF58053D6C9AF80D6DC9B2C00DA1981307D21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a649de343fa4cec8a623a45a6a8b517757efb9c3611fafb90dd75341a719d225
MD5 69454e0faa6bc4f93236d5671dcf10c2
SHA1 333c9b791ec21594716b71061aaebefd5a480471
SHA512 379de981c5f3217c8c11039cf0338da4e4561758bdafd6de48ea8d48b517796029b2329cc747197c0c0c7c44f07498a2e0de8eb9de414e780a6cad657270ac8d
SSDEEP 192:LONz6AmwprQmiUyM46siX5FzjzorosyNJiPxU6:LONz6ipdg6siX5Fj8omZU6
TLSH
T1E702EB35AC786C7F8AF2AE05B58B76139FA5112BEA942F44CDFC1B2C01D765C1306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 33cb6eb985f35ec55466d6c2e997f4eb82a1a294a64380ddfb5a2451b2f14dd4
MD5 a05a1bee3ea42bc75de1543df00bf0d2
SHA1 3493f122509abfacdeee2410877370544bd8cea1
SHA512 4833e91c528236368ea845beca146cc2d3573f0ab4201abca9c6b9c6b2ce626a1dc99b3b6c40e78f3dde132982aad3b9857cf6f3a01b572150b573c63da5520e
SSDEEP 384:FZcIhsNEkKb6S6pu7DYIu9iX5Fj8okXavVZh6DKhHB+no/:9hwI6S6MYPaCavfYGHkk
TLSH
T1F8828D3268B85C3B99E2F141F84636139EF99053E7CC6F84D9ECAB2D01DA6981317D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 57c164b6bfb5fcb61a72c5958ee8726c9d9d172a67ff158dc5393764d0c89b73
MD5 a518669ca8ce865aa91209f6ecfa46a1
SHA1 fa4c2c370a5192f7f9ec4fc3c8df3895328571ff
SHA512 a03b75719246e0f4ba71605fa6f0a635387c58a18871e15aa6c79cf855e7cf31950231cd092c625483e7109e819c2b083162e4fd9f9dfb38a6c2528395f08322
SSDEEP 192:LON16AmwpUQmiUyhF4DsiX5FzjzorosyoXSlRwqdU6:LON16ipkIKDsiX5Fj8okXQvU6
TLSH
T122121A36B8786C2F5DD2B555B44B31239EB59127EB8C6F44CDEC2B2C01DF65C530A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 454644e041813404c86d5e9cfc1dfaf80793799863d460ba46234ae3d663c2b5
MD5 c1f729d7451e6028f3230e1ba1e0ac85
SHA1 43a7c906120cf23cdc2d9dc6e6549e2c0922514d
SHA512 7d1b1233047f7b067e0f9c22d28053a2c0c0696db6c2cdf618f3c34934079af972e4163c5fd5ea8e1f759bc60cf735d5343ee6feffe6c479e8241b90576f5cfa
TLSH
T19B413A58AAEA1148B3B77E59AFF6B46E457FB9373E06D49E00110D4E0663B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download