ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-kf3twssfqf
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{FABD5E56-52D2-4FA1-A9AD-C8760007DF60}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1208	384	msedge.exe	85
PID 384 wrote to memory of 4956	384	msedge.exe	86
PID 384 wrote to memory of 3360	384	msedge.exe	87
PID 384 wrote to memory of 4956	384	msedge.exe	86
PID 384 wrote to memory of 4956	384	msedge.exe	86
PID 384 wrote to memory of 3480	384	msedge.exe	88
PID 384 wrote to memory of 3480	384	msedge.exe	88
PID 384 wrote to memory of 3640	384	msedge.exe	90
PID 384 wrote to memory of 3640	384	msedge.exe	90
PID 384 wrote to memory of 3640	384	msedge.exe	90
PID 384 wrote to memory of 2600	384	msedge.exe	91
PID 384 wrote to memory of 2600	384	msedge.exe	91
PID 384 wrote to memory of 2600	384	msedge.exe	91
PID 384 wrote to memory of 1752	384	msedge.exe	92
PID 384 wrote to memory of 1752	384	msedge.exe	92
PID 384 wrote to memory of 1752	384	msedge.exe	92
PID 384 wrote to memory of 3528	384	msedge.exe	93
PID 384 wrote to memory of 3528	384	msedge.exe	93
PID 384 wrote to memory of 3528	384	msedge.exe	93
PID 384 wrote to memory of 3680	384	msedge.exe	99
PID 384 wrote to memory of 2060	384	msedge.exe	100
PID 384 wrote to memory of 3680	384	msedge.exe	99
PID 384 wrote to memory of 2060	384	msedge.exe	100
PID 384 wrote to memory of 3948	384	msedge.exe	103
PID 384 wrote to memory of 1836	384	msedge.exe	112
PID 384 wrote to memory of 1652	384	msedge.exe	113
PID 384 wrote to memory of 632	384	msedge.exe	114
PID 384 wrote to memory of 4848	384	msedge.exe	121
PID 384 wrote to memory of 4848	384	msedge.exe	121
PID 384 wrote to memory of 1060	384	msedge.exe	124
PID 384 wrote to memory of 1060	384	msedge.exe	124
PID 384 wrote to memory of 1892	384	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9527ec188,0x7ff9527ec194,0x7ff9527ec1a0
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,5098864421616829891,10823224485161495406,262144 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,17361075920649497135,14221072822826213523,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,9064858427836025326,11427718318036609175,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5407137718032120570,6395103515577835224,2097152 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16551841715217239180,9055901028445006245,2097152 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,6167236758223639271,10639441493152752123,2097152 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,1247797610028397076,12531037942985359124,2097152 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,6194514782091106321,12061705446595003718,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,7113234554386964484,9349641455469615561,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8550253455641107460,1058752051642225959,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8550253455641107460,1058752051642225959,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,16447298143988683449,16513835267252764840,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,13996513197262152933,18073990388909746770,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,11260828507312236491,2255832263212073597,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,16233690184580069406,8499828892647088253,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,12482428805322786,1553416107611628855,524288 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5188,i,12155163000531262427,11015348861141120683,262144 --field-trial-handle=2620,i,5410320209518181854,5133300626778691866,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9b63917e4088f55a6f3f37aafcab32483098c4d2b61bb0629f8b945a0f020334
MD5 7aa3555846294be5957b5612af31939e
SHA1 45c52a8c438adf70aa2a80c4c5d23b42b75a5dcd
SHA512 95f6e21e591f2d4359e3b5f2d5478f92453f428fefc8d85790a8dbf1466e5130138249480a0089a615f57f95c6278a1d634cf78e441e27015b947ba38306f6de
TLSH
T1C761D6802287837EFB73607441CE11CF3E3458C9188B2F21C0E5E578B88F765A31911B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a43a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a43a.TMP
Size 3KB
SHA256 eeb211d195bc181de0a88349dcee8bd5bef7c17ddb8d3bef71047622d4e32d9c
MD5 4380a1db7cd54db882d52f74703e158d
SHA1 f281a49448c7a71cc20f1baabb57ce93f3e94498
SHA512 ac0619ec710c5d44dd4f3f2487c2583cfd27c3e35bbf80c8a7a8f75740ee14402d1eead435fe3b4a7123f778bbd91a596c23d51c46adb3779c59e22ea0aab419
TLSH
T1DD61A5812287837EF7B7647481DE11CF3E3558C9188B2F22C4E5D578B88F755A35911B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 aa699bceca4e8719e48e3040c9a8b7c24ae026cf709cdc3621ee57e031cd8a1a
MD5 84c5926129f2a99b23b4efb6ec4997f1
SHA1 6de617232732e4a4bfc9d5776218c89a5cd17ad9
SHA512 f97f103f6bb639d714f238e45fdae6bcbcd93b861645bcc54eaac318aaf99b3d5d81af4fe2857e87f414832f8f0f933a15bedd427a6afc4580f605aac046107a
TLSH
T1E3117DF3C3D585AE890156F06A28AE1BCE1D0605431C7C1985D8EF67D3F3475E10259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b3379817cfbeda7c6dcdb9063dedc4625a2b431a7d88b53f8dd6bdd8b0fa477f
MD5 64cfb5ca7b6fe86254ca4d79ae698bdb
SHA1 cb37ba8c369fb495c688ab222358edeec2d6d8ad
SHA512 409800c23cb59fbb86aa3466ce4c642bed83744d99310ed816b5a458615e146b28ec2622cf6275990e8dfa17b6e3efc935142c50b10e6343116ea643e04af7b5
SSDEEP 192:sxZ/RKWe/fjsgzIdpdtHW6+WNGYgU4eIgrJ:sxZ/Xe/fjsgsjHbGk9
TLSH
T1ED12B8526E28A97B8CCBD20DBB15BF53E6F9503291901E48E6FCC61C05E7ACD121781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 810cf1184ad4f1fd88836be3c5c751788f97f129f73ff0e3bfc148160e15d41e
MD5 bc2944dce386180df1e98c795fab5900
SHA1 8c5b48e441040ba8ce61a36acc314ba90bd156a1
SHA512 50764712476a63c88d80d9cae1c8e1cd63a17042a5ebae111be15c2935e0ba3d2ccc3d6a2feaed3f2eba7639154f55b8be31cf067dd90d3b855e74509c58258b
SSDEEP 192:sxZ/RKWe/fjsfzIdpHtHW6+WNGYgf4eIg5mJ:sxZ/Xe/fjsfsNHbGpo
TLSH
T15A22C8526E28A97B8CCBD20DBB15BF53E6F9503291901E48A6FCC61C05E7ACD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c303ab83e3687928ac089bcc9722cafeec81a76e21c7ea783e8e498a712ab391
MD5 5834f41be55de0beac5815b550df59dd
SHA1 ea4d41bd86359a06b936dd4292fcac78e98a6722
SHA512 77961f98b735135107f35959864d09832d8305dd978ec4756f04a754b5c75dc854273bea82d84f7761d9cbc341f309556eea97a070c06a5d5e2d985d9dabbe25
SSDEEP 192:sxZ/RKWe/fjsfzIdpdtHW6+WNGYgq4eIg5mJ:sxZ/Xe/fjsfsjHbGSo
TLSH
T1E622D8526E28A97B8CCBD20DBB15BF53E6F9503291911E48E6FCC61C05E7ACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 63a5c0b68bfec110728639aa3424f85181c0b21eeeffef2d9b2784c8b3faae7a
MD5 f0f372bba5cec8cf35c88292c58acb58
SHA1 87cbe44ef97c685e1df7a88f8d2b80c38c2dbdfa
SHA512 3ebd70bcb6e233ecce2444b1ed7419527fc91b06483069edef495a57554e6764a7989db799001cdb222ad90357486cd8bcc01552033ca91b18b523d4e2ecb5ff
SSDEEP 192:sxZ/RKWe/fjsczIdpdtHW6+WNGYgU4eIg5EJ:sxZ/Xe/fjscsjHbGka
TLSH
T17222C7526E28A97B8CCBD20DBB15BF53E6F9503291901E48E6FC861C05E7ACD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4cc6fa7627b61b4a48eb734d36a1fa712fbfe57ec7c0f2c833dee82d973b4bcb
MD5 9b86864536d7c0fced9280c7c1319480
SHA1 e70697b161cbdbe12081196cfcd688708827ee0d
SHA512 03789fb3561984f824ccb40bddfa9d135b052aa642f89d75765b2280b12c5ad614ab1f630d23f268ff22bfd6bfd63e3ebef3f811d62f6a976173bbb925ed07af
SSDEEP 768:u3ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzJrofth:u3ichfPWvPZplu1jan+LKgziFh
TLSH
T19CC2EA3B644CCB7E4FC01A9DDD166FDA7E9802C796688D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 414B
SHA256 0b0249038d887b86a814b144d1e2f208af7e24e791064f758a62c21c5dc0c9f7
MD5 8a672b79e2f3a58734fdaeb9fedbbfd0
SHA1 4854d2c856361f5a37993820664dc2309eda445f
SHA512 75a43fca3313c1edcf913313baf4793299226df9b894b85503208cdb2124a3a5d6d3c64e1b0a0357a47805540bb6477ef9531a522b6dc2b032ee638ad36456a0
TLSH
T101E04510303A2252257F6948A0DBBA1F41C53363B515EA2A7EF850E64A17E048DB9C99
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5940f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5940f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8bc171dd359eec2595fef9c5df2f7ba7cb3e1946376d1e9732bf1749ae452e3b
MD5 a496ae6d435335812471bc0fcd59a3c5
SHA1 88eeee87088ca78739e2e5ff51b2aa97369dc61f
SHA512 6f491a6cae3f066fb578b5505c43e6ea0cc4f50823eb3aa56f4e7d68adaed87d4733956a3a37e3529dcdf8b19c18e5eebdade46009c80e4e75e9873035c18a92
SSDEEP 384:EZcIhsNHFo5OYoFBGYX5EGQUFQ5tgOIwZOysoRon:ih5boXGYuGQ95XskRE
TLSH
T1B2828E3698B8ACBB5CE7A144F58B3A035FF89027A7D4AB8495ED571C01DA1D8131BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 94399cf5a687c0181fee3b6f143a5badd2e91aac850c055a8c15aed7e122937a
MD5 70b1f8d47fd1057e868df5097515b377
SHA1 f1f86cb9b3277ae3df462ea8ec12b8d10b11beed
SHA512 78d109c0caca876f6e2f61345bd31adf6625eeab09b2be80c20ea8d2a28334720dfda865524e14a5ee4cfcf7930feb7ca182b4e118df98df73d696182a0b0d25
SSDEEP 384:oiFiZcIuzsNZ8TUNTUlIlso5OYoFBGYX5EGQUFm5tgOIwZOysoRon:zFQuMwgNboXGYuGQF5XskRE
TLSH
T1EBA26C7388B8D9BFADFB9A44F54A36038FB44027D6D5EB90A6DD5A1C009B1D8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4cae2be0f00ace9d404c376a2b132dea99aab2e395f276b81b1ac41d60921a24
MD5 72df6f2b07547ac76ab9d4d237a7b43e
SHA1 5e8ddf9c00bf390749bc91d11b0c71b3027ad882
SHA512 5251af9568d930dc2c73aed872cec1c378fa03ce1179fad0959b9e5d86229fdefca13ae99f8016aa35d7224f131689a5c04a21eced54e51100d19fa90d74a867
SSDEEP 384:uZcIhsNHso5OYoFBGYX5EGQUFQ5tgOIwZOysoRon:Mh6boXGYuGQ95XskRE
TLSH
T1AC829D3188B8ACBB5CE7E144F58B3A035FF89027A7D4AB8495ED1B1C01DA1D8131BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88eeba2e6849f38b54009eb3c04bc5f0c852ac85493db14f9aa007f6cb9c7a3a
MD5 f88756a8453ccf8b0409dced0a0dfcc2
SHA1 56924b81527d576c645b2a680ca9df304e2eb19a
SHA512 83f0905a86dd100d653e3556e19e27ff57e4009d4e4718335736899341b80a47a7dd67d7b56ce749ab0794aabbae5db3609be6807d0a10091a2017a75d65abe8
SSDEEP 192:LJONC6DphmqQmiUyX4q8wGYX59ezHC6mEkk7CaU6:lONC6193RwGYX5EG69U6
TLSH
T11002D935EC787C7B4DE3AE45B54B2B135F98112BAB916F84D6E81A1C00D764C2307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d7e4fa7f4b406673d194564da6d31028a2d7d7de0fb2e904b005c522c1f6d01
MD5 6996b4d9f61ec99d859e8929a51d085c
SHA1 3ec5cb68b3e195aad104018132eef79ff733aa69
SHA512 04cbd8c4117c68d202864b8599802cea8bc7cbda479a3cc798730ef2aa57259a2d9368b51b624cdb5ffd026143011abdbe0248f94c32a0f67c9dc34fbd2a99b2
SSDEEP 192:LJON66DphBqQmiUysk43wGYX59ezHC6m4Une+8kII8q59U6:lON661Oxz3wGYX5EGQUF95U6
TLSH
T11F120935D8B8BC7B5DD3A495B48B39135FA85227EB847F8496DC1A1C01DF29C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6d7dc2c-fc91-40b1-8a54-8ea3e6048268.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b6d7dc2c-fc91-40b1-8a54-8ea3e6048268.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2a775ac086429cd3d2d8cc582f506e654189e59df82fdee6b5d14c4156985288
MD5 d798d9e1f727380ccb44cf1d777b63ca
SHA1 595fe5afbb23485bb6c9876654b3e1cb34a7f1c5
SHA512 9d57542f192e3506ca1c3a989551bc3581123c6c07074778a1437df484284f40f23eb8ce6579a8b06d7575031d31b18794406b53eeab154c16eb47bb6e690d83
TLSH
T10E411D58B6FA2158B3B76F09ABF7A86D447B7D772E06D49D10110D4F0A72B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download