ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-cxtcsazgjf
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1504	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{6AECA6F8-2FA2-4CD2-A759-54C78303389C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 4972	2068	msedge.exe	87
PID 2068 wrote to memory of 5084	2068	msedge.exe	88
PID 2068 wrote to memory of 1504	2068	msedge.exe	89
PID 2068 wrote to memory of 5084	2068	msedge.exe	88
PID 2068 wrote to memory of 5084	2068	msedge.exe	88
PID 2068 wrote to memory of 2084	2068	msedge.exe	90
PID 2068 wrote to memory of 2084	2068	msedge.exe	90
PID 2068 wrote to memory of 2072	2068	msedge.exe	91
PID 2068 wrote to memory of 2072	2068	msedge.exe	91
PID 2068 wrote to memory of 3752	2068	msedge.exe	92
PID 2068 wrote to memory of 2072	2068	msedge.exe	91
PID 2068 wrote to memory of 3752	2068	msedge.exe	92
PID 2068 wrote to memory of 3752	2068	msedge.exe	92
PID 2068 wrote to memory of 692	2068	msedge.exe	93
PID 2068 wrote to memory of 692	2068	msedge.exe	93
PID 2068 wrote to memory of 692	2068	msedge.exe	93
PID 2068 wrote to memory of 3184	2068	msedge.exe	94
PID 2068 wrote to memory of 3184	2068	msedge.exe	94
PID 2068 wrote to memory of 3184	2068	msedge.exe	94
PID 2068 wrote to memory of 1724	2068	msedge.exe	100
PID 2068 wrote to memory of 4408	2068	msedge.exe	101
PID 2068 wrote to memory of 1724	2068	msedge.exe	100
PID 2068 wrote to memory of 4408	2068	msedge.exe	101
PID 2068 wrote to memory of 4852	2068	msedge.exe	105
PID 2068 wrote to memory of 4488	2068	msedge.exe	114
PID 2068 wrote to memory of 1344	2068	msedge.exe	115
PID 2068 wrote to memory of 4968	2068	msedge.exe	116
PID 2068 wrote to memory of 4744	2068	msedge.exe	124
PID 2068 wrote to memory of 4744	2068	msedge.exe	124
PID 2068 wrote to memory of 4352	2068	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffdef88c188,0x7ffdef88c194,0x7ffdef88c1a0
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,6574891537776811533,11926156198693102756,262144 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,3426074697390764981,13733513259040402504,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,5226412443860985735,13685007425459332916,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,8451891971218061654,5765918674160979407,2097152 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,4041178870353269837,17491139970080048507,2097152 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,4912877077389308656,12034361181911168171,2097152 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,9588351565051250320,6418601903137724694,2097152 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10418155765663459448,852720217425191881,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,14574497348829297254,7304432461190909550,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,879705019367051910,416841031939871775,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,879705019367051910,416841031939871775,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,7830250762116263261,6097541311422097028,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,3204139145624030901,9807681934293613087,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,5291142988979970005,4994268651766117178,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7254174367034397240,3769925211712637871,524288 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2688,i,6502351838490512195,8550701097579048337,262144 --field-trial-handle=2308,i,15358796886538736375,10813025032829082364,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ebf81cee3935c05e6ec47826196ec194bc5d106e98620b606d7e86354c036f50
MD5 4d59cca938a5d0da71f54abf4b191ba7
SHA1 d639eb2c9b1a65d16d9d4d80f18d0f970c499877
SHA512 c94cbee2605ea0c165f6ec076796e61b7eb5a271fecc0ed2b8728595475017ec54cc46b1bc4dcddc0e947a030f6b0649b46a4ccf2b24db6862d61418dd3ef9d3
TLSH
T1806170805551E9D1FBD8707092C53183FE774A86CC839E3A12A4DBB94A0A7D41F490CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a66c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a66c.TMP
Size 3KB
SHA256 7fcbdad4863aa388c8e3b6e0e2fb739439d75ac4f6c2b170060c09ea08222f3b
MD5 0ed8fa71bff4d52ca413a9a2cc5bd115
SHA1 ab51c6d8b5ea1e55627d1fe148d15c808cc34486
SHA512 53cd90a5bc422b213804bcb5a18d7e32e058db38c723d744b7e35b3a82d60dc53d38c69374c776ad0e1b22912d36ba9054d6a83778f176bf18d7fc224bd04c8d
TLSH
T1976150809551E9D1FBD8707192853187FD774A86CC839E3A12A8DBA95A0A7D41F490CF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 76d31a0b8f1c8e6409062c412a28fa4d349bf4b0ca8c10397fbb4227adfbbd30
MD5 18ec97af07c7534286d735232aa91a5a
SHA1 5a18270da8cae46b410b4bada6b8243f66752087
SHA512 8989c903f0db588ccdaa2e1dde4a15eef590b9714d41bfecab511fcc1e57feab6ebc3b0d09ccbcc6deefa031ab136fd79f6dedd8e7301a794d344fea95e3fa98
TLSH
T1560190B3C3E5956E8A0052F0A614AE1BCE2D0546431C7D19C5D4AE2B93F3475D10189B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 db5098cc962ce6f5428be483f907aad88f129cbc2d2eb937f3151f7df1695490
MD5 86bee39a59f9ae2aa792091140c2fbc7
SHA1 52fc945ddaa0d606db8583185e27811f1104a7d1
SHA512 99f5ee7620011493c9c41f741d5c1014edc9880c067b106d5c0bfa28c6560e567bccd55caa3c8ced1c266b562c213cab60b625aeb3116967cc1e3e4188e302de
SSDEEP 192:sxZCRDWO/fTsmOyIdpd9HW6+WNGYapYggIgrJ:sxZCkO/fTsmCnHbGM9
TLSH
T16722A6126E38A97B8CC7D21DBA29BF53E6F9503291D51E48F6FC962C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 734fc1018e0880406eb30527a79c11cfc13b8d7b197e99be905b880f6979f8d6
MD5 6e492356a86a9fe971b698205bbc0ee7
SHA1 42a18ee46a51d52ceab261a782b4f1f767c94f71
SHA512 0ff0aa4323220702f5733a2ab4fa086197e9687276277b57138b3e591dcfa77a6a03abf51c3a731ebd64c0d721582a42979275a7a9c356f8549d00a32c29148e
SSDEEP 192:sxZCRDWO/fTs6OyIdpH9HW6+WNGYappBggIg5sJ:sxZCkO/fTs6CdHbGjje
TLSH
T18522B8166E38697B8CC7D20DBA65BF53E6F9503251D01E48A6FCD62C05E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 00befc1e01aafd3df2d3f5ac6e1ba4c202750da0e41a611e986dbdc8e23a6b79
MD5 00681bca3d3d02ec98abb9f7d980227d
SHA1 0b22ebbd9a07a49b2988eaf2a397bac267fce82f
SHA512 6798fcfc995f261cebd2c4c3e86c372b7872ada5e50e6fd026d2c4475e44706c0147261412e7b8b09883821053108a151f86efa8c05bb487d98ce590675a3c91
SSDEEP 192:sxZCRDWO/fTspOyIdpd9HW6+WNGYapYggIg5GJ:sxZCkO/fTspCnHbGM0
TLSH
T19D22B7126E38A97B8CC7D21DBA69BF53E6F9503291D01E48B6FC962C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8410523fb755a07c0350e2acb6cddefde83adafaa1d1f8e81615eae01ab958b8
MD5 e569086570b470127aec067a3b0bb2b3
SHA1 b34d827806a4d3359c3c29491e58ff902688e4a8
SHA512 2946a8d636a6177b3a7dc892ad94f0becad06d6f7a5ec64aef676fcdf64fbb234db5917ac0db1b2448116412bbccbd29318e5472533c0abfddc8b0de952bb5d7
SSDEEP 192:sxZCRDWO/fTs6OyIdpd9HW6+WNGYaptggIg5sJ:sxZCkO/fTs6CnHbGJe
TLSH
T1BB22A7116E38A97B8CC7E20DBA65BF53E6F9503251D11E48A6FCD62C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7378dedd9896fd124ba8501a1833d5d9ec96693ad8ee3c90015dba68a72dfc70
MD5 71b06821b01c79ddcadd25c51b74e832
SHA1 512b76a645adecd47f31a16f1d030b62a248ccc2
SHA512 0f7ee29def9591f26527f5640d337891b57aa5acb242df6f59fc9c1936086853cfa4d4932266c649a61ea69c5e46c77b7d26fc5365956a46af303fbc11ce7467
SSDEEP 768:NvWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Cro45febmRS:NvWPcLKWvKeEeu1jaClLiF7Z45WbmRS
TLSH
T1FDC2FB3B644CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a561184e03abc30011ff2f6701b142c4fe919e8cbb54bc6115ede323c09ae973
MD5 45dfb7e6dcb68c001686af92712223a6
SHA1 367cffd3d209ab8846198f57550f65c7ffc416ff
SHA512 14628b4caefa622356b82fd65d8e2015db9494e06ddd720047177b9f33b16926c5803eaabd258b9c5000e7acfdc5531f9f1d0894d713fe8a80add43c9f061a12
SSDEEP 96:KkRMNhb/LQv3uDJZQKRFJjQNpZeDR9iG0KHqYgQKRGeKQh:yPXA/H
TLSH
T173A16841717B624138BE289C81B48B5E464231B37468FAABFF7E00D55E2BE059EFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5940a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5940a9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 829df09b5bef8abae825642fa33c974eb5ae7c5a0cedc54b192036a63abcf030
MD5 e0158cd57c5c6a52ca084e893441912f
SHA1 6d041d94521170171c9e5ce9bc469e27e03990b2
SHA512 50cf2484c8dca648bf7a34490fddafe630e86d68a86933dadf4f4730a4511a976761648fbaeb3a306dd166da29abc3f37f3fbc199b299c06a6df583a2bfdf8c3
SSDEEP 384:mZcIhsNXUXp1z/LzIGm1nd/HxidLtgOIwZOysYL4o3:0hzp1fendZiFXsLY0Q
TLSH
T1ED827C729CB8AC77ADF7E404F58676135EB88027E7C96B90D4ED5B1D00EA298031BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 31d7be9211fd433cb93ed21e5b7f3e98d362ba1f19656697aa9d5ad851ce4b2b
MD5 001480d4262b3a4f27f754f713670495
SHA1 d654e28645eda56036e9971f91c11f4c6abf7e2a
SHA512 86dde49edae5feec53bcffb97e079c0859ac02bb68702bd7cd1ccdbc66cd55849f6a8485645909c3e0ecf9c5b757e3c23980e1d9294d15d88a5b40aa4007359a
SSDEEP 384:WiFiZcIOzsNp8TUNTUlIlBXp1z/LzIGm1nd/HViidLtgOIwZOysYL4o3:9FQO0wg3p1fendNiiFXsLY0Q
TLSH
T1ABA28D738CB8DC7BADFBAA44F54A32139EB48067D6C5AB90E6DD5A1D00DB19C030BD52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e8e2156794a4af8e0fa36d97a1803784932303fae444871b4d9128cf351f49e7
MD5 8b7210df83425b92de49e567e618d403
SHA1 2129aa4a84973a4d95dabd31f59ceedeaa602e06
SHA512 7d2ea460d6fdb5ac616d6f8cda058c5dc121bb241c761e462dea389fd7d27661ea173b2cd6833a0bbfa472ebf8dba62c2e452218b039271fd8a7bb44f171f229
SSDEEP 192:aONH6IE7QmiUy5kTPuIGm1ZFh0C7sVtU6:aONH6DttPuIGm1nnsDU6
TLSH
T13602E875EC78BC77DEB3AD08F4877A236EA5112BAAD12F84D9D81A1D00D724C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9092e9224ac14e99273f8dd7e8a6b68d8a03040f2b6ffb1e0100e47fc9419d7a
MD5 d3dd2ff1cca27ec786703d8bc0724a42
SHA1 c7dab4936f00a3702ff22b3f2fd0fec0d80fc240
SHA512 b2443e2630091f565e3cabccc433325a5e95cd8c0100d14bf5a1941a5ce5df6a197a1d309559fe18ae54d191e6095038c30c5164f4e443d460557bc65f30a194
SSDEEP 192:aONS6IELQmiUyfkTJuIGm1ZFhfZ95Fx27HMqPLU6:aONS6D9ZJuIGm1nd/H+HdLU6
TLSH
T16C120976E8B8BC779EA3A844F4833A236EA54227DBC47F90D5DC1A1C01EF25C530B956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 30691e7340ae46adb89c2f4469f2637df7d61c4f27e2bd37c7e05d5dffc1c31c
MD5 48d9ac4a0ff67f774a0d3153cd89808b
SHA1 a2bd6fd44a9749a9a5eea9e96a3c424b0dd6ec53
SHA512 fbada251893e85e0b4e03391e0993b6911fedc865090fd5270929fcce263e4736a7b4b5177e188b15c914e4403fcac4c672ce306a169a9bb1fb6286e103adbcf
SSDEEP 384:UZcIhsNXBXp1z/LzIGm1nd/HxidLtgOIwZOysYL4o3:Shqp1fendZiFXsLY0Q
TLSH
T13B827C729CB8AC76ADF7E444F58676135EB88027E7C96B90D4ED5B1D00EA258030BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37c06b454fee29a9ce61708862a9e3a94455bc8b633ce72e2319c4af60ae0588
MD5 2a13ca27bbbd6022e9bebfa7a83d321c
SHA1 b1c47f2f492c1a1daa74673eb8def47a55f18629
SHA512 cb2aad4e8988a5e7967a91fe97cf9786f93579456bc133726216fa8bfdff02df06380dbb8dd7204484b8a8ed28be8197eacc8a7ee90e6f27bf9afd56f78918ad
TLSH
T1D041F659A6E91144B3B37F5AABF2A86E487F79732F06D45D10110E4E0623B40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download