ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-m63ypazvcw
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1472	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{194C52F7-3F76-4B98-B497-BEF5AB68A571}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4708	2860	msedge.exe	89
PID 2860 wrote to memory of 1472	2860	msedge.exe	90
PID 2860 wrote to memory of 4364	2860	msedge.exe	91
PID 2860 wrote to memory of 4364	2860	msedge.exe	91
PID 2860 wrote to memory of 4364	2860	msedge.exe	91
PID 2860 wrote to memory of 3824	2860	msedge.exe	92
PID 2860 wrote to memory of 3824	2860	msedge.exe	92
PID 2860 wrote to memory of 2564	2860	msedge.exe	94
PID 2860 wrote to memory of 2424	2860	msedge.exe	95
PID 2860 wrote to memory of 2564	2860	msedge.exe	94
PID 2860 wrote to memory of 2564	2860	msedge.exe	94
PID 2860 wrote to memory of 2424	2860	msedge.exe	95
PID 2860 wrote to memory of 2424	2860	msedge.exe	95
PID 2860 wrote to memory of 5920	2860	msedge.exe	96
PID 2860 wrote to memory of 5920	2860	msedge.exe	96
PID 2860 wrote to memory of 5920	2860	msedge.exe	96
PID 2860 wrote to memory of 108	2860	msedge.exe	97
PID 2860 wrote to memory of 108	2860	msedge.exe	97
PID 2860 wrote to memory of 108	2860	msedge.exe	97
PID 2860 wrote to memory of 5272	2860	msedge.exe	99
PID 2860 wrote to memory of 5272	2860	msedge.exe	99
PID 2860 wrote to memory of 1184	2860	msedge.exe	100
PID 2860 wrote to memory of 1184	2860	msedge.exe	100
PID 2860 wrote to memory of 2640	2860	msedge.exe	102
PID 2860 wrote to memory of 5240	2860	msedge.exe	106
PID 2860 wrote to memory of 5288	2860	msedge.exe	107
PID 2860 wrote to memory of 2108	2860	msedge.exe	108
PID 2860 wrote to memory of 2532	2860	msedge.exe	109
PID 2860 wrote to memory of 2532	2860	msedge.exe	109
PID 2860 wrote to memory of 1904	2860	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc3ac4c188,0x7ffc3ac4c194,0x7ffc3ac4c1a0
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,3069128630186931594,4966419267187436275,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,12299220672570717082,6750941916639169086,262144 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,1397460535322185773,9692380376893610370,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,6416541960799513652,6493957777588139268,2097152 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,8067456170857225475,14742142964354752670,2097152 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,3008370482467869625,3655016365336237884,2097152 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,13529287913672887171,5853671755183910605,2097152 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,2368499922613102477,15097108916621174877,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,2267069146945211871,14503554521377731969,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14314046900741789281,3000680773769544818,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14314046900741789281,3000680773769544818,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,15810141954467537513,14079500081922172456,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9205850194890364093,3112504154705381071,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9181678068291149762,7176883795392525687,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11445539506837497994,10261452838497606534,524288 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6472,i,12903953585335414226,16683155517752174565,262144 --field-trial-handle=2332,i,7951818508897848843,10254730322721631157,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9eacc8274afd3c38e7dc901486d539bedde75e6caf287edcfe575c6d5eb62e3e
MD5 ae51f93efe7da54494683699e1670781
SHA1 0a783bb3f2c8f20a4ec7abbe0e4638bd4eced2cf
SHA512 871a05f43976cdc9c65157fadc58b9b6ac1fcf905317190bce0aff6fe468edb605e6d8e192fcf550c5d63c52ffd37dda49167c963defff51a828827289050cfa
TLSH
T11D61B84056C34170FFE82DF382DCBCC3BBF8869998BB1F05725AE97558E2F2A8444244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599987.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599987.TMP
Size 3KB
SHA256 99a82df9837e293417a726f6deb9c668de66ae1ce11dfe4bc13a836c969ac97c
MD5 5b408d7356235a2a098c622866731648
SHA1 65d642b6898020d798eee1a048a58def94d1f0e4
SHA512 5840ab64948094f2656691febbb8f916efa36f2884fc319affd2387654d723dcdee0dfea76a69cccb47879be4a79331e72c30fc3d9c6e4d93d696459a7cd249a
TLSH
T13461CB4056C34174FFE82DF386DC7CC3BBF8869994BB1F05725AD97558D1F268444244
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cdc2dc0f4992270c8145b7d11d72fd3c77f814f91cd0aae470751bedd5c4f8a5
MD5 16e7073164ad8b403f32ad254dc5a265
SHA1 4f75418812cc5968f3be06192ccba34bb48c075e
SHA512 ccbe03ba4ee786d50cf2001a23ef7910970a95855e67f5a619aefe3a049fbb557cbd354dfb46b04d57a905858dc5a823a3b20c4df893089b6c27255746470596
TLSH
T1DD419BF3C3E8866E890156F0AB18BE1BCE1D0915532C3D5AC9E4AE1B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1ff162bb81d5cad799c0ea1adc7796486b6dbbab8cb05b28fe35654dfa61f749
MD5 e3443cf2c6a9750cd720cb68cd0c18b7
SHA1 1edeb9de900e3017c74ed13beaa5b341f1335a9e
SHA512 80d3f90be6415723465cdf89c38df166a7345c0eb2d577f539c2b4c002471b5a69b4595113b0a6cadeb7be164543d9b942e8d00d3c005b1d0e6bb9b690d97a90
SSDEEP 192:sxRIRubb/fssCXDzoA8p42/g6+WNIYFIy+GtIgIJ:sxRIOb/fssCXyb/5IGDs
TLSH
T1BF229615AE68A97B8CCBD60DFBA57F53D2F91032A1D51E48A6FC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d5f9e40ec523dbaae47b4a7424d872afa564970ac9ecb1e67df7cc95a8e678dd
MD5 e02c7bfccc292b9b60623325d835a2ef
SHA1 480a1a2874ff623f88be487a4c6721d8626c53f9
SHA512 7287f64b44a403b29f96da432ac1b1ac0ce34e207bb533ca479b4c806c085b52142b18d17321dff37673756fb039d643d3c2f4ee064e130e032ee83e0615b99c
SSDEEP 192:sxRPRubb/fssxXDzoA8p42/g6+WNIYFWy+GtIgDdJ:sxRPOb/fssxXyb/5IAD7
TLSH
T10332A615AD68A97B8CCBE60DFB957F53E2F91032A1D51E48A6FC861C04F76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 422accf409239db080ac9e137f5e148d55d48791dbeea68ef7d5cd3cc6af2b5a
MD5 0862f54a9c1bfc1240f10b60c11ffd3a
SHA1 0592512fa2ea235e5ededdb85bd2a5c96c933d3e
SHA512 6cb76ea12a6e5817938fbc75fc526c77f14e6c32386afe806a250848e59fd519a1ac014d49d7ff3f8d4c33dda6dd25e47a72a013f2b5d51008f3055aaac48495
SSDEEP 192:sxRPRubb/fss7XDzoA8p42/g6+WNIYFIy+GtIgDLJ:sxRPOb/fss7Xyb/5IGDR
TLSH
T15C32A715AD68A97B8CCBD60DFB957F53D2F91032A1D51E48A6FC861C04F76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 d4c1ec34b33be028a4be319d4d095632fc9dc21ad9e0b8079eca368d7d45d14e
MD5 bdd84cc73be89c6febdd55cba30f678f
SHA1 bb079029271aad1c01246defcfdfa3f2af90b886
SHA512 5097909b603ab225c2ed10d20926b58428c53dbaefe3c945a501c93fc1cd9ce5090dde9403c9158ff23ad612900ba11739035f4b76c7638a310c1238a6c4037f
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRnOro+PW:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0VA
TLSH
T195B2D92F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a327b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a327b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f3360bcc75c2423a2316db41f2fd00a122c31a31439724a90ed1182a8b07e76d
MD5 0544437eaa0b2ad6ae09adefcb426882
SHA1 46a377feecedce113f9241b00b87492459a936fd
SHA512 50a727861abd5b2383e42302665c24acd3b95148b564cbf40540ababdd32ac9268223eb6584efe7692783471332a52a5a66b219dede01c165b3950d96087a37f
SSDEEP 768:9Rc3e5vdbEf9cG8lyEMbxyJugQVTJ7vvmeXp4YGHzY:9Rc3ov0TmyEmxyJJq17vH4YUzY
TLSH
T18DF2BF319CA58CB388F7D687B646B783AFF441A394C91B8494DD9B1E019B6BD1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8c2c141784f5a9467dbeda15bfe1a10965713e347640db5256e41d58501d2ab9
MD5 4fd5ae13bb4cf3eef1294ff8358dd66f
SHA1 1daeadffb1e54903e15847ab25ae64b3c6bc8b41
SHA512 54c524ad42b47d35196f0a7755144e8f7e3e161c56b065ca08fddcc31268fd88d0931b5192add29fab9716b86aec5f0b0247e3fe23aec8e70dd63351419feca0
SSDEEP 768:H/UxvxjgC+yc3Z5vebEf9cG86yEMbxyJugQVTJ7vvmeXp4YGHIG:6Zj3+yc3Hv3TryEmxyJJq17vH4YUIG
TLSH
T13113C031A8A99C7388F7D646724AA7C7EFF045A354C62A9845DD5F0E028B3AC1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5763c11bf1e56326d5da4c9f98630ebee4a0d64d003f572738966a44a13dac49
MD5 23e884ffff127974737ff5134c853861
SHA1 6248e304f483412c2e68c3b413184ca0f2e81c9c
SHA512 1409f3684b489bbfde26047ca9c13b7f7173c483e55fcbd44cf9dfbdd4cd0555e39b6c8544babdd2b8bff537ce6913d7eb680c1227ce560405ba0a1c751c02ff
SSDEEP 768:bRc3Z5vdbEf9cG8lyEMbxyJugQVTJ7vvmeXp4YGHzY:bRc3Hv0TmyEmxyJJq17vH4YUzY
TLSH
T1ADF2BF319CA58CB388F7D686B646B783AFF441A394C91B8494DC5B1E019B6BD1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 2b2d05c985ce0c8cadede77bc006e767975bc33a1b8f2fbd2de2dd3b891b79d7
MD5 b568fc6953dc65f54173acf589ffdb7e
SHA1 7497d2748ff91272a1d89076e1a0cdc63edb2726
SHA512 fe85bd435dc888cee7d14995d2fc92047627963aec4c0b9c762dcfb2d2cca8cc34bbc35477eeaeded532f62d417c73be81f92910b192ad49cc201db6a2df9116
SSDEEP 768:MFQZc3/wg+5vdbEf9cG8FyEMbxyJugQVTJ7vvmeXp4YGHzY:/Zc3Wv0T2yEmxyJJq17vH4YUzY
TLSH
T101F2AF329C94C8B79DB78B86B656B642EFF041A3C8D96A94D5CC9E1E015B2EC1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 5d80c8ced00856a1e56f7172ce340bd0d42428ea488b368ef83e430e07647594
MD5 c3628a2e8e138e436d5b3ff4c789b120
SHA1 e6dceb8ab4f586a71b7532cf18ce1b5a64b41400
SHA512 26aaf0bcf61f99f80e7db6f1325b2396d9a2df078f01dd0d43d50168b92ab71c421bad90e17be85f0546ee2ee849bc075e9ff2dc6c2eaded91fc16bdb58f9233
SSDEEP 768:p/UxvxjgC+k3GAf9cGCyEMbxyJugQVTJ7vvmevHSHtBk:cZj3+k3TTCyEmxyJJq17v1Sbk
TLSH
T17103CF35ACA55C7388F792853649E787EFF506B398C62BA885DC5F0E028B2BC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d102265e-0f08-47f3-ab7d-39874a25105f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d102265e-0f08-47f3-ab7d-39874a25105f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download