ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-mtjpaa1bpd
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4524	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{ABBEEFEC-0823-40EB-A6C2-ACB20389B8E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1684	3124	msedge.exe	86
PID 3124 wrote to memory of 4048	3124	msedge.exe	87
PID 3124 wrote to memory of 4524	3124	msedge.exe	88
PID 3124 wrote to memory of 4048	3124	msedge.exe	87
PID 3124 wrote to memory of 4048	3124	msedge.exe	87
PID 3124 wrote to memory of 2108	3124	msedge.exe	90
PID 3124 wrote to memory of 2108	3124	msedge.exe	90
PID 3124 wrote to memory of 3948	3124	msedge.exe	91
PID 3124 wrote to memory of 3948	3124	msedge.exe	91
PID 3124 wrote to memory of 3948	3124	msedge.exe	91
PID 3124 wrote to memory of 4040	3124	msedge.exe	92
PID 3124 wrote to memory of 4040	3124	msedge.exe	92
PID 3124 wrote to memory of 4040	3124	msedge.exe	92
PID 3124 wrote to memory of 3044	3124	msedge.exe	93
PID 3124 wrote to memory of 1048	3124	msedge.exe	94
PID 3124 wrote to memory of 3044	3124	msedge.exe	93
PID 3124 wrote to memory of 3044	3124	msedge.exe	93
PID 3124 wrote to memory of 1048	3124	msedge.exe	94
PID 3124 wrote to memory of 1048	3124	msedge.exe	94
PID 3124 wrote to memory of 3236	3124	msedge.exe	99
PID 3124 wrote to memory of 2548	3124	msedge.exe	100
PID 3124 wrote to memory of 3236	3124	msedge.exe	99
PID 3124 wrote to memory of 2548	3124	msedge.exe	100
PID 3124 wrote to memory of 2932	3124	msedge.exe	102
PID 3124 wrote to memory of 2440	3124	msedge.exe	112
PID 3124 wrote to memory of 2076	3124	msedge.exe	113
PID 3124 wrote to memory of 1432	3124	msedge.exe	114
PID 3124 wrote to memory of 4308	3124	msedge.exe	123
PID 3124 wrote to memory of 4308	3124	msedge.exe	123
PID 3124 wrote to memory of 852	3124	msedge.exe	124
PID 3124 wrote to memory of 852	3124	msedge.exe	124
PID 3124 wrote to memory of 4860	3124	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffa3011c188,0x7ffa3011c194,0x7ffa3011c1a0
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1792,i,15420083479864057052,2870525913911961144,262144 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,5186573262780354520,6825164154565799855,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,3642235562739213966,4778321441793707341,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,3671604873276487054,1538996211161658595,2097152 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,15052507597396282030,9654366561219375239,2097152 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,10202586839320427637,12176525930711183321,2097152 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14986415129112731696,10694443278368533411,2097152 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,5282761730990152295,5520366066199409797,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6433834464907880860,11596978992296621849,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,5720669824078049378,4575624036635695814,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,5720669824078049378,4575624036635695814,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,43313972634536482,12372673402765450356,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,10469837979201255488,18185246939824321092,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,684122146159659084,14322250686353044592,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,5201952947990432431,5578964517204641416,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,13183349537604037723,5056257522262756973,524288 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,13390840439211744974,7837753868574347099,262144 --field-trial-handle=2284,i,189578952275329197,7557934531807931019,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 54507fc248ed4d3a5f668abf4191ee6ebbe7903959c71b0c76cc7d8acb379f22
MD5 d79b7dc562f26f5b259aa76b4917e757
SHA1 a4d1b06c2d66023908e520a390fdea2fb2553995
SHA512 b52b4a2f8f84fca6d423f1c12a776c2fd5aa183c3238d1e9e2218df1031efcc7db1b4e599d2f8df771b64ab06ec32f1ae2d5f2c6e0c12ddd77ac367bcaa3de3c
TLSH
T13F51524197608491FFE8B1BB51DE12FF3E746580D5831E721B98D8BE9F6A31740010E8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 261b47bff18d4f2372f555bd02b7f7aaff83ecef918cf9dbf8de698574161b4f
MD5 b116b988d2cad2d34faa79cb7501250d
SHA1 d2db8979b8970a833ef8d7784498503535c93ba6
SHA512 4216bcc84ca3932492456ad76ca13e3c9e19b18b67a55b69d38e7912d73115080497d5f1487251a5333f61ee77b75c72e38e81952244fb8ba0595f453027592c
TLSH
T144117DB3C3D595AE890157F0AA24AE2BCE1D0906421C7D1989D4EF27D3F3075E40259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d25f668d701d5c7c8090d24cc735e1f6b69b66d378ea16aa54a879ab1fdf9279
MD5 87702e1b1b5864a53ee3d1222d0b344a
SHA1 97f2e449ccc9b4ab1ac497095abfa39059b24e91
SHA512 9628a8081046010dbb19232adc94a4415cd1a54d9e610be55e13ee9b48b59cab4dbd0af40431b0045a408e54e07b76c0bdc45ebac3ae6e2c5258c3d05c274f7a
SSDEEP 192:sxZJeRR4CWIF/fodsyJeWIdpdJAHW6+WNGYrb8lKfaCIgrJ:sxZJeRWdIF/fodsyJeXnAHbGZlkaC9
TLSH
T17F22B8566E38A57B8CC7D30DBB25BF53D6F95032A1941E48AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 68ab15989b86278dd86438bd9724117cb3e196661e52c2ee8e2b32afb6989005
MD5 0eac33beb57239f4c2ce87d596347bb2
SHA1 be5fae6aa861b57a922359fa2cfc60901768212c
SHA512 7a9300f88be33c052b338549af227f55639ab2cabeb91c26cf2a3c3896c62283c35d3d3ec9b351afe93fde48fa6a65699db1f6c2aa7e80a393db5894ca25f137
SSDEEP 192:sxZJeRR4CWIF/fodsh0JeWIdpHJAHW6+WNGYrJ68lKfaCIg5CJ:sxZJeRWdIF/fods6JeXpAHbGYZlkaCc
TLSH
T19822C9566E78A97B8CC7D30DBB15BF53E6F9503295901E48AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1e8b2747246ab68bf203b6c61453dac44013114ddc2d495c42dcc30b83808f4f
MD5 b764e41f59160ee9fc8877e955b83202
SHA1 11e524022b13b4364ae73b51841bd25a9629187f
SHA512 c31f0b826fa845aef38679e383b4347c7b929e7756a0555e47ce27d25943097c329300ab2af3e4cb1c774ae8a3bd85a88e2e4cf968aca5f2d4c7658742cb35ff
SSDEEP 192:sxZJeRR4CWIF/fodsh0JeWIdpdJAHW6+WNGYr+8lKfaCIg5CJ:sxZJeRWdIF/fods6JeXnAHbGilkaCc
TLSH
T14222B8566E78A97B8CC7D30DBB15BF53E6F95032A1941E48A6FC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2c1dc6fd95ae31bd54a02f0fbfe0c0a65b0a6e77d02fa96a6c3d244a4e74b1b8
MD5 6646d88f8e19caee2e82471b2edef099
SHA1 ce9a50b6a6d197edd65861c7a1b1a89f7696ded4
SHA512 c8aa244f8c7295512e80677222e368f3045f5c2085e7a9b747d3d6b80676ccedf5d20b9fd335a7e3d55b6033e29bd222bc91afc9fef4f7ff5564d6ecf6b24bb5
SSDEEP 192:sxZJeRR4CWIF/fods7JeWIdpdJAHW6+WNGYrb8lKfaCIg5QJ:sxZJeRWdIF/fods7JeXnAHbGZlkaCu
TLSH
T14822C7566E78A97B8CC7D30DBB15BF53D6F95032A1941E48AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ffdee95854eb8961e1c453a37dba33ae045b665f170830056ba89a1ce0a3c643
MD5 b88c7fc6f08e634ceed0774ea3658ea5
SHA1 5e2c36e8bfd60ccc413131dcca77bd80e9535bdb
SHA512 ee7c1aa58e8768ecb3409cd06bb1f59edb3d520be137f8f54b62aca9695ea6f15c6a2d08809cce734828ec2a1bd3d967091f2d66da4871e316a961e4024ce41c
SSDEEP 768:bKID2y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbISroRDJ:bKID2y4J/DWvbtBhu1jajiLm0bIJdJ
TLSH
T131C2FB3B644CCA7E4FC00A9DED5E6F973E9802C79A948D4047FA954C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 95c7296a030c26b95f01f455d92f395e81dfeea00aef2779ffd65f0aea6715b8
MD5 b0f6828c18a717ca9c2f7cee8a991035
SHA1 2c163c1f63021f9bcd767de54182d393daa3731c
SHA512 d3e7049d30862c706553f33e2faac4bc293f3f5f761b5e785f899d1467baeea19b1b6835de18ab4442c2ddc5bf98ac1207eb240c392a7feda64a37a839ae861e
SSDEEP 48:KIDI1Ks04jyLJ4FZDHb0bni/ISx0K9x1b0xZkYij5pyLOpEIGM81bAHIISg1K9EG:KIDCKs0+aaYKTCK2pOKKQM6nOKwcP
TLSH
T11991D25630FB061038BD698D85B5876E124232B37518EA2F7FBC40A95E2FE054EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac621df9-b6a3-43f1-bed3-e367f291a5b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ac621df9-b6a3-43f1-bed3-e367f291a5b0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 24df4be03f27dbad90439b0b2ad89c0a2d2519d0a2b375e70a1a70a2fd674710
MD5 ead95fc65b42a0f179e528c5e2eb36ea
SHA1 81bbcb58341142316dbcad56e97efdf320408dc9
SHA512 a5cde86781c3d90ae268bfc072aebb19cc9c07c5e0f741d6988fad22051d15db7a6e9d0bacc430580795098d5ffa62fdd07f3019557c25eea0d13dcdc9bca147
SSDEEP 384:6ZcIhsNDvqmmurZXjCnSK+TQHX58EjORABj9iZtgOIwZOyl+2noNA:4hqy7udjuSK+TuaIOWj9iZXsD2n2A
TLSH
T1BF828C3299B89C775CF7A244F58A32039FB85027E6C5AF84C5EC6B1D01DA2AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b127e9373ef9dac9677568d2ac6fcfe85494dac314fb7573533595b179892b7
MD5 6869740f81598ccbd52e6cafee9772c1
SHA1 d63ed116fffa749f98d0142ca014a551557cd018
SHA512 72b9fbc67be1f9d066a87692152f5438201aac640e9f5869c3c22b3d1d41bf08647d6d38d837cdcbcd9e94993ef3e107b7d558acc8a654dd10b0232c5f6af4d7
SSDEEP 192:1ONl6wlDgQmiUyJGJ2W4X58gZjOKSAwDliVNU6:1ONl6kgqu2W4X58EjORAkiHU6
TLSH
T12F02E735B9687C7B8EF3AE49F58B26139FA5106BE5512F84CAE81A2D00D765C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cea267a87091c7260f0bd54fce8b95cf67036f876fedb06ed7ed4d3688c32101
MD5 8da9cf641b8f03ee8b1206bfad116071
SHA1 59523369445f1f6338c405f9aee3c19c6989781c
SHA512 0a0d76079253948069b904b8de0b023fc8cd8079781f6fdee8b552f867027f137812a19df77af65f8f37f4e5e98b80c7e27b55ea8357c7ba60d63bb63b184790
SSDEEP 384:pZcIhsNDvVmmurZXjCnSK+TQHX58EjORABj9iZtgOIwZOyl+2noNA:hhqt7udjuSK+TuaIOWj9iZXsD2n2A
TLSH
T1A7828C3299B89C775CF7A244F58A32039FB85027E2C5AF84C5EC6B1D01DA6AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2901bf4d10ce20355eab217d28c665a2818228a6af1eff35c2c47d4168d2eaa8
MD5 eba230700559ef8de838bf13c0c5448d
SHA1 2260baa5ffbd0fdf7261d77daf839a5f8869b60c
SHA512 c250194278a8854c9a41d3be70068491acbc468c4ded63bb1e80291248699498f6a41ecb1fd52a6f19f3dab2bb84a0791635b3e6e109af14fe3a67ec3419c6b8
SSDEEP 384:IiFiZcIozsNDR8TUNTUlIlVmmurZXjCnSK+TQHX58EjORABjWiZtgOIwZOyl+2np:TFQUqRwgn7udjuSK+TuaIOWjWiZXsD2p
TLSH
T1B2A26B7389E88D7BADFB9744F68A3203CFB84067D585EB94D2DC9A1D01971AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8bb54134715f69e367b3800503fb564ccf3a4c424d928705eaee814f90b04f5c
MD5 44048076a5e06a0f3498ca7a53c6f7d7
SHA1 8046b2d23ff9b3963ee144c6a25edb8ac6e464e7
SHA512 5d6cb4e359defbcce8ce10c594748720dddde18f3dd684907370337bdf695037ca41a0c11013b982ab161e844067040cf2a3e2513c9f1c4be240e75a79d8d942
SSDEEP 192:1ON3e6wlDipQmiUyJ5J2TQ4X58gZjOKSABj9veiXqqU6:1ON3e6kiHqr2TQ4X58EjORABjciZU6
TLSH
T103121936F9A8AC3B4DE2A144F58731039FA95127E785BF90C6DC2A2D01DF66C230B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c91a35a-51d6-4d36-91cf-623110a75047.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1c91a35a-51d6-4d36-91cf-623110a75047.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 056427893faa8cc577e905a03e9e3ee6585bc1cdd1c7253bcfb0c21520b3ad4a
MD5 1c435e4086ea29c68dfb9c0f1019fa8b
SHA1 8c523ee1c2c8bb7abf0ec6ed176a2837346f4587
SHA512 611bd43c8d08de87164c932942a58cf684c8a6d4fbb9e284ba7d1320e891c2029934f57b904ddb2181369934b9b60721567151e2d3687152665d0a6c6eb08da3
TLSH
T12141F858B6E91148B3B77E5A9BF7686D847FB9372F0AD05E00110D4F0A66B40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download