ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-c82tasda36
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2960	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{14572386-AB6E-4E26-857B-47B80F542553}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5752	msedge.exe
5752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4380	1560	msedge.exe	89
PID 1560 wrote to memory of 5420	1560	msedge.exe	91
PID 1560 wrote to memory of 2960	1560	msedge.exe	92
PID 1560 wrote to memory of 5420	1560	msedge.exe	91
PID 1560 wrote to memory of 5420	1560	msedge.exe	91
PID 1560 wrote to memory of 5216	1560	msedge.exe	93
PID 1560 wrote to memory of 5216	1560	msedge.exe	93
PID 1560 wrote to memory of 3188	1560	msedge.exe	94
PID 1560 wrote to memory of 3188	1560	msedge.exe	94
PID 1560 wrote to memory of 3188	1560	msedge.exe	94
PID 1560 wrote to memory of 4168	1560	msedge.exe	95
PID 1560 wrote to memory of 4168	1560	msedge.exe	95
PID 1560 wrote to memory of 4168	1560	msedge.exe	95
PID 1560 wrote to memory of 3400	1560	msedge.exe	96
PID 1560 wrote to memory of 5816	1560	msedge.exe	97
PID 1560 wrote to memory of 3400	1560	msedge.exe	96
PID 1560 wrote to memory of 3400	1560	msedge.exe	96
PID 1560 wrote to memory of 5816	1560	msedge.exe	97
PID 1560 wrote to memory of 5816	1560	msedge.exe	97
PID 1560 wrote to memory of 5564	1560	msedge.exe	99
PID 1560 wrote to memory of 1524	1560	msedge.exe	100
PID 1560 wrote to memory of 5564	1560	msedge.exe	99
PID 1560 wrote to memory of 1524	1560	msedge.exe	100
PID 1560 wrote to memory of 3444	1560	msedge.exe	102
PID 1560 wrote to memory of 4804	1560	msedge.exe	106
PID 1560 wrote to memory of 3188	1560	msedge.exe	107
PID 1560 wrote to memory of 3504	1560	msedge.exe	108
PID 1560 wrote to memory of 1180	1560	msedge.exe	109
PID 1560 wrote to memory of 1180	1560	msedge.exe	109
PID 1560 wrote to memory of 5752	1560	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffaf0dcc188,0x7ffaf0dcc194,0x7ffaf0dcc1a0
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,2835558972859239316,9120049453674644532,262144 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,9839014307453716382,16001298604267679566,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,1080403639879507362,6585881463775216495,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,4505096054486054554,7433573503430452627,2097152 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,1940897902887155427,12591088576988483877,2097152 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,12834835975375994695,7391778021421340524,2097152 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,5854914242547993713,4147979378788565305,2097152 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,13667809944188497709,14028776067239873643,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,9645928564232845992,5752043547959721590,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13722341075898462963,1554756737443190430,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13722341075898462963,1554756737443190430,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,14623135530795449545,5095600919669631263,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,15838211447035733508,11419095493717902828,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,1802189650194541311,14793455390811150234,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,11037910365329140323,8668167459979702130,524288 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:14
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,18061229096459726098,16824005748107350624,262144 --field-trial-handle=2332,i,14803079024550367875,10115069673022468848,262144 --variations-seed-version --mojo-platform-channel-handle=804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c739dcbc69198e531511b42892a917e24aabff8cfd160669ca61b7c68f7a18e
MD5 d8a35c477f1480a0fe371c0282d9fc34
SHA1 b73ea409f1c4192f49aa2f9982f75f8f6f69f422
SHA512 ba2b620f928d38412c1ca442608fa316f231f56589fa1839508fa57eb796a25583661a14d5275b32ffdcd9d15d67174f6439e788bc656035d00f2bbf7ffe31bc
TLSH
T1216160B848808241FF7E407DD7D09CC336B34AAB52432E612A58FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595f4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595f4d.TMP
Size 3KB
SHA256 9f68b08f520f0fcc32c5f8b38e6fef251135586018f37097e7fe7c0f489dfaea
MD5 c5d4a647dc9c39cdb63d4024c96d1cbc
SHA1 ec3e11186f99f52934face626e3a917eb9cd76bc
SHA512 b8f3e51dd94aeebe896aac7b43a4e6a8fa2314334ec325a3335077fc5c8f38a9207f9a9fe391235c9aceac9e10c5979ceeb34ba3c3a36f3918ab2a9fd91df306
TLSH
T1A961507859808245FFBE407DD7D09CC336B34AAB52832E612A58FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

a632c60c-944a-461b-b084-631a6db6acf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a632c60c-944a-461b-b084-631a6db6acf9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b0de8f7f5347d7acb0d7686a0e27fd4e9c5ccd07ed4e59de5aa9533a0e0e16e4
MD5 d95ff9044de70eb404fddc99e56939ea
SHA1 ef08c1723fd50bd07006204a88a9785a9fbfeeb3
SHA512 aeb1b11c9653d6f96c6a1f01bce5587242de8dd85216807f61ee68cc8590937c8d118a9179c5ce5565230ca237aed39cec800a90061559d298ee9862dcaf9c56
TLSH
T137418CF3C7E4866D890156F4AA146E1BCE2D0915532C3C5AC8E4EE2B93F34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e999fb867eea57911028fcee56464d52640b05124faacc1f35b38e3a89abdca9
MD5 5a61273b461994297cd6dfbdfafb4ba3
SHA1 3b3855d2d7667b93ae9f373429bb9ab59fd6e942
SHA512 0ad4e9fc6f2e2ce9d6e8703699764443da891764dfa25c8b37e054c9a5553f263f84b8946f4333fd6d8bfc36731016eee4430a07268ccbc47b14ad99637f5ea0
SSDEEP 192:sxR1aRnbD/feqs/VzoA8p4i/g6+WNIYcNXtiTC+G7IgD6J:sxRo9D/feqs/4L/5It9iTCFq
TLSH
T1AA32A715AD78AD7B8CCBD20EBB55BF53E3F85032A0951E48A6FC962C14E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 484dd686783d17b501744d778e23be0c48abb4239e62a8bf40c8e9d4640ff6d7
MD5 7d9b77d0ebff4192418c26ebefe417b6
SHA1 dcd4cd36394865b2d06e3f6ec2275361a97cac09
SHA512 3bb6d982f0939705134192285e7fefab3274ad6d7f2248c041455728325a1e86688ecc3b780db809ccf3ce9ed8be25f100d73f24f03ed90048e3adbfafe92659
SSDEEP 192:sxR1ZRnbD/feqsnVzoA8p4i/g6+WNIYckXtiTC+G7IgIJ:sxRH9D/feqsn4L/5IE9iTCFs
TLSH
T10A22A715AD38A97B8CCBD20EBB55BF53D6F85032A0E51E48E6FC962C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 26f8bc96d81f07a9fb9bbba80d604c2e4d8f43ef77f887c9d6ed44c4b48bad44
MD5 76359d5da7e7607ea1d6372025365f67
SHA1 0eb4bfb08863c9b096d8e33676e1e75cfec1f3ef
SHA512 5d658cc5a096492ee6fd9107d2806da92918a9ec9e341d2f59a6436c2dc6d6f2abfe491c4d1453b0d91058120a32c33f2ddeb692154effd2c38910ca1b0580c1
SSDEEP 192:sxR1aRnbD/feqs6VzoA8p4i/g6+WNIYckXtiTC+G7IgDoJ:sxRo9D/feqs64L/5IE9iTCFg
TLSH
T19632A615AD38A97B8CCBD20EBB55BF53D6F85032A0E51E48A6FC962C14E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 70a4f1ff37562e33cc3a73b1cca53a7fbc770e58eeee36c766d09c9a58db2538
MD5 73af3584051867e9031829faa0f211da
SHA1 ee6300dc429e8f4426ee6a2e25df431f273a3483
SHA512 be2140e284cf7ef731c90f2b7bdc639dc92bddb2b677c043f58e1a614359c3395b7a1e8c6737b356b7ce0aad7f8babbb36e2a17796641266b8b013aec03fba81
SSDEEP 384:D7JakElfCtg17Ff9tKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXn975RwCroMXM:DFakE5Wg1Bf9t8F1+UoAYDCx9Tuqh0VZ
TLSH
T19BB2CA3F744CC77E9F800A9DAC196F976D9802C79A588D4047FE994C03C77EA92294DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b5b09a4853803280d07d238b4efcb67373cf760f7f612a53f111fd3c5e9f8f48
MD5 083721c016f98568be1378c93f2ea174
SHA1 dfe5bce9cdb22c41129297284ac396ec9555965c
SHA512 329516eb3ca2185fcbba7a7b70a62cb8b07c7ced561e633930167edf0598226bd0d7ca6ae3ca864238ab97b9506c2276cca395a8023a9f67f2a03696f0a6c824
SSDEEP 48:KMLGnrFNdWTNYdIarWKVz9BWRjGoQRLHyDC9ocC4IpTM7kIakpKVg9ypRa5oj08R:KsYoKRqmuZ+KqcBR6KaIK0
TLSH
T1E891132175B71250383D3D0C96D49B6F86813773741CEA2B3BE908655E2AE088EFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 891291d85980706acf078ec99279b131690e448f5c5319580cc8def6a9c94f85
MD5 060de3cdd82c42520eefcac473e98819
SHA1 5eaf08cfe7ecb74fcd2033d8f5ab35240868160f
SHA512 176b6a5782925e0360d858a821983bac700ea6a944fadfb54592c83e7c79f6d06dceaad0397d529b22cba1daa658ed61b54d6dc4c232673bcefed2c79a312593
TLSH
T15281E52175B71250383D3D0C96D49B6F878137737418EA2B3BE918658E2AE084EFD9ED
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f756.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f756.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6c0276a5f801cbb78082a0c9750b33bcfb65650a96f9ce2e52181b7007a78b03
MD5 534a9aa0d2312a3791c75cdd0305b79b
SHA1 62ce04339d24b7fe02a2a50e91c5db6f2b11fc41
SHA512 d9f3aac642de658655d3249617b54f74776b52a192a1c7a4a057cadae715282a1953567eaefdcdae8926a6ebcb28119442634c98fa4a89c31fe6c467c5b74177
SSDEEP 768:D1/UxvxjgC+L33kgvcieOT93xbXnUPO4Qp7cPAiSm2eo4w4cciGrTFlno/8MB:DYZj3+L3JUCVXwQpYoimeoR4ccFFhoEQ
TLSH
T15D03BF75E8B8BE636CF39281365D6342FFF04563A4C52EA8CAED1E1D42872AD4307C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1c9d304df54690c009f1a996378645f3b612b9c3145f054d45463996b641f051
MD5 aaf16eaf4b226c319925da03b2426dc5
SHA1 fb8c56352bc46629cca73f88d08648de32fd233b
SHA512 e60e4d4ce09af88dc170305dae5aafc81fbc18cf8e843f69f831630ab3baaa71b3c418223eeb8d917902e91f5784b89e74982c3986497039ba5bd8f9084813e8
SSDEEP 768:eK3dks5cieOT93xbWnUPO4Qp7cPAiSm2eo4w4cciGrTFln2sWFN:eK3jiCVWwQpYoimeoR4ccFFh2syN
TLSH
T188F2BE71D8F8AE776CF792817649B702BFF08123A9C55A54C9ED2B1D02476AA031BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 104f9c78fc21cfed29d7e455ce6cef6e49993e4465ea0656b955c5d950ce3b81
MD5 d2f722ca866407dd8d76530eb000d251
SHA1 14c473eb0574b5039ba5cd7b1ff554f7ee31f8e3
SHA512 3f21ae001258b5ed24719aa0d1b69b9001072eb8fb19a6a7670b0052aa227ee55725f390a56625550430f79182398b001bc44f9376c88a517b9259dc629a1cff
SSDEEP 768:DpK3Wks5cieOT93xbWnUPO4Qp7cPAiSm2eo4w4cciGrTFln2sWFN:DpK3qiCVWwQpYoimeoR4ccFFh2syN
TLSH
T170F2BE71D8F8AE776CF792817649B702BFF08123A9C55A44C9EE2B1D02476EA031BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d295c92adb4c34e003606ccd3d23edfe8c0736a6e70fbb5bceb140f27f4fab39
MD5 00c07b046632b4240bee037145ed976f
SHA1 e537a4be1746479a0c1bdfb9f4d58446e6033ae2
SHA512 029c6bd7a4dec04052e5b7db5b67b1189b2175a2f7576ab54c6d81436aa0d6b0ee7ae5b902f72bacaf496cbdf455e850b8df033ce7b5d84f3f45fdbf00a59c0b
SSDEEP 768:IFQH3swgEks5cieOT93x6HnUPO4Qp7cPAiSm2eo4w4cciGrTFln2sWFN:rH3diCAHwQpYoimeoR4ccFFh2syN
TLSH
T11603BE7288E8DE7BACF79B85BA4D7301AFF04163D9D5AA54DADD1A1D01471EE030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 27289634ecbbbd386e9483eabce8e4cc08746d827cdf00c53d8be7bee2fe11de
MD5 03332767b2b77c5eb544eb2b41947a83
SHA1 f4c7d5e3c637498649758e9e81de462cd5229b59
SHA512 19a0b22e46d8d9fce2144773b43b35783f8eb29874ff5370bc50c9299b18898c428768f91364882cddfb99b321b0dcab61f479e8946017a5b218ef678e2e8ffc
SSDEEP 768:vw/UxvxjgC+5j3wVOI8lieOT9TjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5KAgZbCMc:vdZj3+5j3wUIyCTjFwQpYoimeoR4ccFV
TLSH
T16603BF75A8A8AE77DCF39784365D6342FFF1416395C22AA4CAED1E0D42872AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97e4f723-2f28-4f0e-97b0-f0a055d73140.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97e4f723-2f28-4f0e-97b0-f0a055d73140.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download