ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-fpvsesfc49
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{44EB5845-8C45-4D0F-B774-FFE62E931E5B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4848	3252	msedge.exe	89
PID 3252 wrote to memory of 2816	3252	msedge.exe	91
PID 3252 wrote to memory of 4816	3252	msedge.exe	92
PID 3252 wrote to memory of 1408	3252	msedge.exe	93
PID 3252 wrote to memory of 4816	3252	msedge.exe	92
PID 3252 wrote to memory of 4816	3252	msedge.exe	92
PID 3252 wrote to memory of 1408	3252	msedge.exe	93
PID 3252 wrote to memory of 4628	3252	msedge.exe	94
PID 3252 wrote to memory of 4168	3252	msedge.exe	95
PID 3252 wrote to memory of 4628	3252	msedge.exe	94
PID 3252 wrote to memory of 4628	3252	msedge.exe	94
PID 3252 wrote to memory of 4168	3252	msedge.exe	95
PID 3252 wrote to memory of 4168	3252	msedge.exe	95
PID 3252 wrote to memory of 4460	3252	msedge.exe	96
PID 3252 wrote to memory of 4460	3252	msedge.exe	96
PID 3252 wrote to memory of 4460	3252	msedge.exe	96
PID 3252 wrote to memory of 3672	3252	msedge.exe	97
PID 3252 wrote to memory of 3672	3252	msedge.exe	97
PID 3252 wrote to memory of 3672	3252	msedge.exe	97
PID 3252 wrote to memory of 976	3252	msedge.exe	104
PID 3252 wrote to memory of 1544	3252	msedge.exe	103
PID 3252 wrote to memory of 976	3252	msedge.exe	104
PID 3252 wrote to memory of 1544	3252	msedge.exe	103
PID 3252 wrote to memory of 3056	3252	msedge.exe	106
PID 3252 wrote to memory of 1388	3252	msedge.exe	116
PID 3252 wrote to memory of 3620	3252	msedge.exe	117
PID 3252 wrote to memory of 2276	3252	msedge.exe	118
PID 3252 wrote to memory of 4444	3252	msedge.exe	121
PID 3252 wrote to memory of 4444	3252	msedge.exe	121
PID 3252 wrote to memory of 4948	3252	msedge.exe	126
PID 3252 wrote to memory of 4948	3252	msedge.exe	126
PID 3252 wrote to memory of 4616	3252	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa7ecac188,0x7ffa7ecac194,0x7ffa7ecac1a0
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,7152882455573788521,10830295897483010748,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,2204761523414126318,2589541635804917348,262144 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,11122685088756161131,672613874646169784,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,17917619364936374356,7288719648612570529,2097152 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,17848624852500570867,14505447063691026096,2097152 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,7954426371455016974,10714344945677923086,2097152 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,9220436701298947408,8019997474673544406,2097152 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,16125666073932049822,5724918390131883478,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8642795910407173439,12872055371026354684,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,12210040521800245033,6630944684143895005,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,12210040521800245033,6630944684143895005,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,4496936803735862326,17355116158395685070,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,11698271287833132013,2273427709283234014,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,1580428020004244559,5632131582311998732,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,9656752230114189963,9566239283582979725,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,4592970051690718345,6115136180670502770,524288 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,6220316694237649489,114621716401506813,262144 --field-trial-handle=2428,i,5443682521099322234,12467644350463198433,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b999d0e2757f94fbd153912b7809d8b461425bf8bfc5c6a20176eae605266213
MD5 5c3233c24c9132e6dd8c1c7419f9278a
SHA1 8b3ffd68f1a7607e52b660464e6c8f8fb48ec681
SHA512 9f8de622d5c39c591928b5ee22af49d7eb14a2e6364cf8434d29290f845d4885623e6d44f8847ef88c6e89f31e731dfeb446f83dd879b843e4e8d08d08869092
TLSH
T102615E815A8044E3E7B9753CBFD5229F3E375AF043A3EC051DAEC86CAB0631B524E242
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 3e70966efdbcc86946b9bf7c7571933ea3a2b69439ed16fba5afd5a21000d45e
MD5 a63482f42e80ea9c65fc11f03326e31a
SHA1 edb47802cf37d69b1d590d9e6c19c6a04678c634
SHA512 23ba606d5ce1a8a9ce50c3079a97e640c65db7c5b7a42d903bd7c396893fe674f9a55b214c472d1d0fbefc492b06badfe038b9d5d00126dcbf9d1774c8e3028d
TLSH
T16F117DF7C3D595AE890156F05A24EE2BCE2D0505421C7C1A89D4EF2793E3475E10259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a22aec62-da4b-48af-a31b-3aa64ad9ddfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a22aec62-da4b-48af-a31b-3aa64ad9ddfd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7d9858aaa0b9bac7d8fd01ccab81e83677fa56e79ae77ad70b2e91df71c1a5db
MD5 84fe8fd6cc754478cd49a84fd41e54cf
SHA1 9a8a4e718a61d65dd745efaf07a8a538c07cc15f
SHA512 49b164f2f95905c20b20bc2800c4ed6620550273afd2f25f81a07f842f07205b7f19305d320565cb15d8d01c93bcbd93d0743e0ad6ca30c175772603c7bcf32c
SSDEEP 192:sxZERVWh/f1shBIdpdoHW6+WNGYgUCfIgrJ:sxZESh/f1shqOHbGp9
TLSH
T11122B7516E38A97B8CC7E20DBB55BF53D6F9503261D11E48AAFC861C09E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8103d3d5d9c5d09563fb1496fb478369fb762cedf3dd07a498983d6e49b17103
MD5 693d8b8a5a82fe9f6b2024760bd8fdaf
SHA1 f29ebded7bd348c9a033920ed58c212c1996047a
SHA512 97d7636af286d45c225d03834e6e20a2d67fa682d278ec71a2e3dfd760878ca2717aeaa9bf6563fe4a1b9972edf417c75c15c0c1420cfe63aaaa4d5b093289c5
SSDEEP 192:sxZERVWh/f1syBIdpHoHW6+WNGYgzCfIg54J:sxZESh/f1syqIHbG+O
TLSH
T17822B7526E38A97B8CC7E20DBB55BF53E6F9503251D11E48AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 32df7eb11ed3928fbd25c5ed169a30fcbcaa32c8bcc28780e1e46511e8ca0a64
MD5 5c2bab154d6607869ae2d508932c3a61
SHA1 fac5a36fa2cc8bd7a920387197c3ffe0d9e67afc
SHA512 5df71ec8d65d5132709449e08cd534f9bc46b4b72e4a79b96c1ba901b6c7087543cb6282cb0e415305c07e592319a8dbe2a2b7df4461d03f09cf0865d57efd74
SSDEEP 192:sxZERVWh/f1syBIdpdoHW6+WNGYgmCfIg54J:sxZESh/f1syqOHbG/O
TLSH
T18C22B6516E38A97B8CC7E20DBB55BF53E6F9503251D11E48AAFC861C09E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0dba11dca64acb9e5841da0bdedb4c5c79d90774f8aa65df90b5ae8d8a0a037f
MD5 4ba666d7cb7a1334cc3e900de4c5e2ca
SHA1 2569dd7dc78f01ddc8745306d09ae2feb67e4f31
SHA512 235248be4063e96336f1deada7d26fac0f547eec93c4347f68ebfe06a63bfb249ac0aaf977d166e2308ffa653bd818b368f0d9fb7fad53cbc1da763e3cca756e
SSDEEP 192:sxZERVWh/f1s9BIdpdoHW6+WNGYgUCfIg5SJ:sxZESh/f1s9qOHbGpk
TLSH
T10122A7516E38A97B8CC7E20DBB55BF53D6F9503261D11E48AAFC861C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4d98751f696a1b61fb53f98f91e6fe62b9ef5a541bd7d7b3e00a918d49031486
MD5 4478e363ea5d3925eecfcdb8a89a3ea9
SHA1 b8168b9b9499917b0030fa713a2014a7e9e3ca29
SHA512 f3a1428fdc700a084771daa3373ca2830af5db275fc3a6107b3bd4be095296b5aa3bfb374f8db647481bc2ab24ed96599be77459ff1f6f8fa2504e1fb8340f74
SSDEEP 768:khichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzDro8jP:khichfPWvPZplu1jan+LKgzw+P
TLSH
T166C2FA3B644CCB7E4FC01A9DDD5A6F9B7EA802C7A6588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c3e65853468a1342847c5b848865b06d434e7cce0c65c5af30bee7f4e35f567
MD5 e55934c3173d6f3975c11794fb143b8e
SHA1 6979bee092920e3e7bb26e7667379d97089f4f55
SHA512 077876c64c1be905ae8ff0065780d6b0584b0132b6ac20777573cd9de533159ed57a2cab9ecba2d638e11531029a59436a4be1ce3bd616ec926e3cf0881861a2
SSDEEP 48:K0bef7F99ebtAFISbeK9r1pexzOYo5L/yLnKzHJp5Sbx8hISXSK9X19SxXCY0lVk:KcooKByWSYwK1aiMoKxuC1
TLSH
T1B291051635B70250397E299D85B59B2E414232E33114EBABBFFC04628E7BE448DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599457.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599457.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5f501e2183fe3b8dba2e1317f984e9304d8703f3d8fbeaf0cbe9939bbe380742
MD5 42c00808798f70de5c1e46dcd5c6e4e4
SHA1 19dde452fbd73cf3a0446701f1a1c55dea4c5f6d
SHA512 723482012c7b61819fe87197d2ecddf995e13f387f15f117885f76b529cc7f09e467c6e2fec8f6f289773afab7aa52a5cb08d49a062c8d837829b48f91f7efab
SSDEEP 384:KZcIhsNIwU/gf5+7LBGYX5EiOszV0bVZh6DKhHqoo:ohifulGYuiOszybfYGHqT
TLSH
T1F0828D329CB89C7B5CE7F581F8872A034EF88117A7897F4485ED6B1D05DA6982307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 12cc68efb5df47988cf034e25b91659b75367fa1fae49473fba5d1f2f1a46a0e
MD5 966948ffbe7cc68a49e20f6cbe96e777
SHA1 acf46c5d8ce0b9c3dc3fff7edda53c65c1d9b9ef
SHA512 03f47b6532b0d60837e9247818279fa02c70778da66baebc75fd4f20888a20be1938e494bc09abe81c12d000a85e96030a07e2c7c345b71ad11cb7b628e698ea
SSDEEP 384:0iFiZcImzsN48TUNTUlIlnU/gf5+7LBGYX5EiOszV6bVZh6DKhHqoo:PFQWdwgxfulGYuiOsz0bfYGHqT
TLSH
T129A27E338CB8D87F9DFBAE81F98A26038EF48167D685BA50D6DD5A1D009B1DC1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7173bd1d9f65333933d49a20e98d261bb7bfbc5ca9620c9e79280b477c9442d6
MD5 a81d053fd4527e7a6ba9b5b5b13f60fb
SHA1 518114ce9e0f374d495c423c123c6058a7d0c51e
SHA512 1bae26f41df327c298c36a8c271e538f44c2502b0744276294617981d9b4cbd1c26e043872167ec45526a12b4e9593163d6e07df96750bbbe94c10a5ea2a6224
SSDEEP 192:LJON96DphmqQmiUyMPq8wGYX59ezrCOsFkk7g7U6:lON9619XRwGYX5EiOsJ2U6
TLSH
T15B02FA39AC787CBB9DE36D45B48B26135FE9112FA6916F54D6E81A1C00C768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2fe0e8cfe1ad0ca3c69747ce7f898a5ed6d0ea0741d636ec95a6b55b79d2d226
MD5 35b3fc0764b0927c00af9a93a7e8a22b
SHA1 b38d90656c20a65debe178ff0a23d2557dfeb65a
SHA512 111ae3895e25a28616b8c07f97e36786c5240c40aa2c136180c8207f934669d25b4791c0274c7f840e1391082888aac0ff111db0aafe7e3794dbf32667d4447d
SSDEEP 192:LJONB6DphnqQmiUygPJwGYX59ezrCOszV3ebkIIJq5MU6:lONB61UxJwGYX5EiOszVrbU6
TLSH
T135122B35A8B8BC7B5DD3A951B48B35038EE8521BEB857F54D5DC1A1C01DF29C230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d189341a20dfce0ba2a6f1de36d7858842a8c7c1c48c4376da6f0ba45ea3eb3a
MD5 e594824ced5d5a696f927a09acf58cbd
SHA1 552d3477b151493b3798a435eae169364ed99935
SHA512 3ecba9867e53cc7b5a0a93981c987764e92be3bf5101c17614fcc8443be3abd7b22be6a41b402706359241c1738bbdd3b0d289613d7addb637adaa4aef2cdb5b
SSDEEP 384:LZcIhsNInU/gf5+7LBGYX5EiOszV0bVZh6DKhHqoo:ThLfulGYuiOszybfYGHqT
TLSH
T1EE828D3298B89C7B5CE7F581F8872A034EF88117A7897F4485ED6B1D00DA6982307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ab70ea81c1346f6f98b6da1acdc315060faec2a6f0efc3405dfeaac9e3e6016f
MD5 30d330d6d7bcf7c47695ba3f1b280a45
SHA1 b8af9877f124913df1efae2b4a15aafa1c46b127
SHA512 421a40f8c9727d7692d90feb15ececa0ecccf7d68cfe3c967ae235cd93269424b0645b81867b787a6bc693e8fc7502cb070588135f3a6cbd33fcf8f734f34768
TLSH
T1AF410958B6EA1149B3B76F5A9BF6A85E887BBC372E06D09E00110D4F0663A40CC62737
MD5 SHA1 SHA512 TLSH

Submit Download