ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-lbhtlabe89
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{BFF0275E-06C4-4172-BDA2-BB4FF4468C92}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 2360	4484	msedge.exe	85
PID 4484 wrote to memory of 4956	4484	msedge.exe	86
PID 4484 wrote to memory of 3360	4484	msedge.exe	87
PID 4484 wrote to memory of 4956	4484	msedge.exe	86
PID 4484 wrote to memory of 4956	4484	msedge.exe	86
PID 4484 wrote to memory of 3480	4484	msedge.exe	88
PID 4484 wrote to memory of 3480	4484	msedge.exe	88
PID 4484 wrote to memory of 4168	4484	msedge.exe	89
PID 4484 wrote to memory of 4168	4484	msedge.exe	89
PID 4484 wrote to memory of 4168	4484	msedge.exe	89
PID 4484 wrote to memory of 2184	4484	msedge.exe	90
PID 4484 wrote to memory of 2184	4484	msedge.exe	90
PID 4484 wrote to memory of 2184	4484	msedge.exe	90
PID 4484 wrote to memory of 4784	4484	msedge.exe	92
PID 4484 wrote to memory of 4784	4484	msedge.exe	92
PID 4484 wrote to memory of 4784	4484	msedge.exe	92
PID 4484 wrote to memory of 3248	4484	msedge.exe	93
PID 4484 wrote to memory of 3248	4484	msedge.exe	93
PID 4484 wrote to memory of 3248	4484	msedge.exe	93
PID 4484 wrote to memory of 1256	4484	msedge.exe	98
PID 4484 wrote to memory of 1244	4484	msedge.exe	99
PID 4484 wrote to memory of 1256	4484	msedge.exe	98
PID 4484 wrote to memory of 1244	4484	msedge.exe	99
PID 4484 wrote to memory of 3124	4484	msedge.exe	104
PID 4484 wrote to memory of 2288	4484	msedge.exe	112
PID 4484 wrote to memory of 4280	4484	msedge.exe	113
PID 4484 wrote to memory of 2480	4484	msedge.exe	114
PID 4484 wrote to memory of 3796	4484	msedge.exe	122
PID 4484 wrote to memory of 3796	4484	msedge.exe	122
PID 4484 wrote to memory of 764	4484	msedge.exe	125
PID 4484 wrote to memory of 764	4484	msedge.exe	125
PID 4484 wrote to memory of 4280	4484	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ff952b6c188,0x7ff952b6c194,0x7ff952b6c1a0
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,962577390360027660,1955772328113931250,262144 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,17795289432489826292,6522441520862318500,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,18268992594032797698,2032390070357085418,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8506653448722073218,3125975100562726725,2097152 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3893309648196026616,14806129120382114545,2097152 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10477211804353238486,13384444266039824552,2097152 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,18036834682798141981,4935481382244782684,2097152 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,11823664533850544784,17237526306295000108,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,17529335478694899043,6256687195932929879,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15037849334055762451,11741154636397265326,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15037849334055762451,11741154636397265326,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,6657775834038418527,1019817160306482541,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,6628352446134370618,6008026729659025544,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,10214239910560603225,16033271002104321997,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,14107824249926048275,6517310390767435583,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=776,i,15763796576025096358,1267574105349140647,524288 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5300,i,11549822388434999819,8327038195913812810,262144 --field-trial-handle=2828,i,15730179889249728471,4491013196576370502,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a3bc04a37bb209f03e5785ecb8d3c6d3d96174b3083c9cd34629f25b1a327c01
MD5 d5e1833a363640a7451d9f798a9c9646
SHA1 1d6c682d0adffaca542155b6edb511217bd1db4d
SHA512 0813ccafcff73c55ec0bb460944a3261c4082b118cfa8d2fb1c500130d39221561a67bf8637e317a4617a707d76d2193d3944547f279b233a2c8f14e80735590
TLSH
T14A61D6802287837EF773647441CE11CF3E3458C9188B2F21C0E5E578B88F765A31811B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a488.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a488.TMP
Size 3KB
SHA256 56d49a473e42542ef83426f8346ee10d6bdb70a04b5aa37e7cdea2296fd88129
MD5 0d41982f9505480b5dad3f8caecb254e
SHA1 42b0d2d1bab28c5cf2c090e0633fd52412230012
SHA512 3f53a693893ac8d1a9e9fdb1f93e9db8e2b3ec17c13c8d5ad12c861d725d0ab67ec1482520520c02f97b44341673a09539b69cf30daa5645f5588f22d6c50df7
TLSH
T1DB61A5812287837EF7B7647481DE11CF3E3558C9188B2F22C4E5E578B88F755A35911B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 65ff60e8105d18f03edb7d84a143927445d9a173ebe58fbeeb2d79da06bdc625
MD5 d550c4e9f6a5212798bf79869fa7da60
SHA1 17b5b2ffbf1b83aec37d0665cc4e73a2a5f928f6
SHA512 119e68d5210aa1dd4a3fee7c7c97bdbd66f1cb100b3883d3a36e5da0d0e62a0b5835272638c2defcc41b4124e81b60b2c485ede4129762da6eb43989ae20ddd6
TLSH
T1FC117DB3C3D585AEC90156F06A28AE2BCE1D0905431C7C19C9D4EF2B93F3075E00169B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0f5f3902c6a7d91c0efb98e41ce114163a0fc288473e93d26a35df69eecf46a3
MD5 fbc661215bfad1c9e8526a4e03b0aec7
SHA1 c92557cd28787b23610605f4640ae6f3ec5e5787
SHA512 4cb35244d1d0571e25fd8cd4ffe76a6e1dde060ffa89dfafd4e58b5cde19ae3e482c6abc4cb0326f8b24acdae3d46c1951c1a2a04199e455a0cc7b2b2864f9dc
SSDEEP 192:sxZ2RxW0/fBsWh2bbIdpdMHW6+WNGYgUICIgrJ:sxZ2y0/fBs22bEOHbGc9
TLSH
T13412B7526E28A97B8CCBD20DBB15BF53E6F9507251941E48EAFC861C05E7ADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b5b149305ff7f0901260dfae74cc5501d2e098cf09667e1eb752ab48c01dbc5f
MD5 915829b725df9ea3df44bad0c74cc5e4
SHA1 cc680aae7da22a390a374534734a9b5911847bb2
SHA512 0c72e815c3c7e595bf701797003c2b7db87b61e55cf46667f7eaaad944b4a75f4d33f9e7637e081fe9524731a92b6df5d90fae52daaae9104c251b82d16e82f6
SSDEEP 192:sxZ2RxW0/fBs5hybbIdpHMHW6+WNGYg8tICIg5hsJ:sxZ2y0/fBsDybEsHbGCdfQ
TLSH
T11F22B7526E28697B8CCBD21DBB15BF53E6F9507251901E48AAFCC61C05E7ADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6623224f4578305aa7d818c8de9cd0c13bac464fe565b7ee44746f6a0ea9abf6
MD5 42be974d2f937e53a905a5c3cf991eff
SHA1 f469bde8a0b971ba596bf902bbe9f6e7105aac94
SHA512 d0c3c7ac5bd6312c8d139e32ccbce860823bb099c7c66af6b55bfe9f8ece9817ae3ded3cdf109539462028beed2ae0af7a2ae852ae8ec17a221b5ada48d83ce6
SSDEEP 192:sxZ2RxW0/fBs5hybbIdpdMHW6+WNGYgHeICIg5hsJ:sxZ2y0/fBsDybEOHbGVkfQ
TLSH
T16422C7526E28697B8CCBD20DBB15BF53E6F9507251911E48AAFCC61C05E7ADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c0a97424768e4f6a2a1546cb0e27de72fc494b0ce65d6934cf3f754040c93470
MD5 1424f48d0154fcddc603a87db588e9a9
SHA1 3a2e2a87ede2d47486ce7408c328159e71948cf5
SHA512 3d441be19ad6e699fe4e9f52f44dfc554d717e1a8186513e2865a7e87f9f86de6b80c35feec96a45e08fb5e180dd806752e0a7f657a4432db4686aad56858a6c
SSDEEP 192:sxZ2RxW0/fBs5h2bbIdpdMHW6+WNGYgUICIg5hGJ:sxZ2y0/fBsD2bEOHbGcfS
TLSH
T13A22B7526E38A97B8CCBD21DBB15BF53E6F9107251941E48AAFC861C05E7ADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c550c447b418dac2839bd414e50e74940e9a82163d7c074fad17a6b2c699dca4
MD5 36aa568364537c7eeab907227f0eac97
SHA1 79ee72dc722809304829d7dc71509ffdc60f392d
SHA512 a69b89d42da038acba9811488e5e297e55e2c4de7b44a5a2397e07cd391a09dc6061579eef54972c585483f0581f2b8024f66481c491e5d53862200aa927b9b1
SSDEEP 768:LcichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzcroC7x:LcichfPWvPZplu1jan+LKgzHkx
TLSH
T1E3C2F97B640CCB7E4FC01A9DDD1A6F977E9802C7AA588D4087FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48ec4bed-828f-458c-baae-fd750e6969d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\48ec4bed-828f-458c-baae-fd750e6969d5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4d1f988acae0f59d632c672d11a0dcd85a773c9b242f3d6f64903a13288527ea
MD5 c08df17f94333470206dd932528b0dd4
SHA1 a52f890a33d20cf7cc48620c7099651cbf45b232
SHA512 4785bc938568e10362dae87f9c38e66d8e9c15ed930c0db33cbb6b94657661135017484998adc537290fce9716e71f8e2e0c80d61f959462e64d73f430252452
SSDEEP 384:fZcIhsNTeR5uN4BGYX5EGQUFLdtgOIwZOy6SoK:3h7wiGYuGQidXsqV
TLSH
T1BE828D3298B86CBB5CE7A145F58B36039FB88127E7C4AF8495ED672C01DA198130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 67635663785af1540e0b552b81c917855a19d1999de735ecfe9e5375ef367312
MD5 49b1c39c39cd00d31f857d28fdcc8551
SHA1 2d2db5459ee60c0a3fde04c763754600d3144bff
SHA512 abc01b84426d867750e2df0b294d89f928a4c881e8d9606f67b0d3614297d801b2dbfdabf878603f9afbabdad7d515fe689bf255d31519ceb721923c14192550
SSDEEP 384:fiFiZcIvzsNt8TUNTUlIlXR5uN4BGYX5EGQUF3dtgOIwZOy6SoK:qFQL4wgDwiGYuGQgdXsqV
TLSH
T13CA26C3388F898BF6DFB9A44F54A32039FB84167D6C5EB94A6D95A1C009B1D8130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ebfc50d794e170ebc7df39fedf6491ef8848f250654629587c80c960c7f0902
MD5 b750df8fcf33dd18660c0c3643229203
SHA1 0d97fdce530450be21d6b8cf83cc5558afa19bd5
SHA512 009a589162e9d70e5e1e17237b6f8e968106d52bea4f6c2e2ddcbd445dabaf90466a79426608f3a603ef7aa141e5b79b077600e5b83f5b831ea54ee2b104a448
SSDEEP 192:LJONC6DphmqQmiUy5Aq8wGYX59ezHC6mEkk7/aU6:lONC619xRwGYX5EG6CU6
TLSH
T1B102E935ECB87CBB4DE3AE45B54B2B175FD8212BAB916F84D6E81A1C00D764C2307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b26356ec5fa8c10b4b08c51f76c18466095f01e7f1d059cb62f430deb8650ae6
MD5 fc80053838471225ba376bd5ab315d2e
SHA1 899f114776e320e3f1180d395264b35388f9cd88
SHA512 619a901ecf6fefac6b27cc751ac402592f065b62245c59bebc429e88390d399460d2706173d72698d6fbcae779eab5166688568c1cc73b0f28b71283745c318d
SSDEEP 384:wZcIhsNTXR5uN4BGYX5EGQUFLdtgOIwZOy6SoK:OhcwiGYuGQidXsqV
TLSH
T1D2827E3298B86CBB5CF7A145F58B36039FB88127E7C5AF8495ED671C01DA194130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a6e9e1e603a39b1a93f5ae01b8a0f06dbfc9345fc9ef0dd18f6282aec3e30fe1
MD5 bf9273c3a3e173c42baadfeedc0a5245
SHA1 59c0742d8664587735d1e4b3ee4a599c9f53c5af
SHA512 5650871033e6495deb134aa80236a29e989c0c752938e202fa59deca2f440b663e4971b7d0a460be1feee3602d4c37749019b62e9683da7f718c9508bb4dfedc
SSDEEP 192:LJONG6DphMqQmiUy/AIwGYX59ezHC6m4Une+dkIIpq5KU6:lONG6171IwGYX5EGQUFmdU6
TLSH
T1F112F935E8B8BC6B5DD3A451B44735135EA8522BEB85BF8095ED2A1C01DF29C230BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a988baa-ec72-4987-bfe2-0ac3c2dd9169.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a988baa-ec72-4987-bfe2-0ac3c2dd9169.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 83af403bb1fa3958568d14dccbed8eb001d3d556252eb41d7187081f61b1a2ce
MD5 316a93ba07522829a98cf58deec27c2d
SHA1 a94a3f5caff61a29c9f8287d4d95fbe10105a83d
SHA512 41e41fb9eaa591ec6abaae0402f8c2fb2159347175ecd4c280a71ea2731f58f3ad5c536bc68c350e46898e9f047d4f6cd47269df1492f18fdc1de2d31f8d9b9a
TLSH
T1CE41075CAAFD1154B3B7AE1A9BF7A85D487A79772F06D19E00110D4F0A26A00DCB2737
MD5 SHA1 SHA512 TLSH

Submit Download