ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-mxvkys1dld
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{4B3C4C8A-A70F-4721-9FFB-DA159F0CC79F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4324	864	msedge.exe	84
PID 864 wrote to memory of 5060	864	msedge.exe	85
PID 864 wrote to memory of 1320	864	msedge.exe	86
PID 864 wrote to memory of 5060	864	msedge.exe	85
PID 864 wrote to memory of 5060	864	msedge.exe	85
PID 864 wrote to memory of 4836	864	msedge.exe	87
PID 864 wrote to memory of 4836	864	msedge.exe	87
PID 864 wrote to memory of 2204	864	msedge.exe	88
PID 864 wrote to memory of 4688	864	msedge.exe	89
PID 864 wrote to memory of 2204	864	msedge.exe	88
PID 864 wrote to memory of 2204	864	msedge.exe	88
PID 864 wrote to memory of 4688	864	msedge.exe	89
PID 864 wrote to memory of 4688	864	msedge.exe	89
PID 864 wrote to memory of 684	864	msedge.exe	92
PID 864 wrote to memory of 684	864	msedge.exe	92
PID 864 wrote to memory of 684	864	msedge.exe	92
PID 864 wrote to memory of 3568	864	msedge.exe	91
PID 864 wrote to memory of 3568	864	msedge.exe	91
PID 864 wrote to memory of 3568	864	msedge.exe	91
PID 864 wrote to memory of 2132	864	msedge.exe	98
PID 864 wrote to memory of 2132	864	msedge.exe	98
PID 864 wrote to memory of 1964	864	msedge.exe	97
PID 864 wrote to memory of 1964	864	msedge.exe	97
PID 864 wrote to memory of 4124	864	msedge.exe	102
PID 864 wrote to memory of 808	864	msedge.exe	112
PID 864 wrote to memory of 3620	864	msedge.exe	113
PID 864 wrote to memory of 3616	864	msedge.exe	114
PID 864 wrote to memory of 4240	864	msedge.exe	122
PID 864 wrote to memory of 4240	864	msedge.exe	122
PID 864 wrote to memory of 4704	864	msedge.exe	123
PID 864 wrote to memory of 4704	864	msedge.exe	123
PID 864 wrote to memory of 4660	864	msedge.exe	126
PID 864 wrote to memory of 4660	864	msedge.exe	126
PID 864 wrote to memory of 4784	864	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffac293c188,0x7ffac293c194,0x7ffac293c1a0
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,2018879310359891623,14959564403263483271,262144 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,12827570477988800171,543355513672784458,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,9734280703513774844,17362863279881244803,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2776866929536938598,4403783020041992032,2097152 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4629076137243470205,11828326864490912573,2097152 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,7169903280002703388,8463015339592137104,2097152 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,7095625011528090296,16501578166433448046,2097152 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:2
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,13967162491292971172,4555989011388478248,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,2318962286556755890,11251172932343644437,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6807277682188682503,13080900644669320259,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6807277682188682503,13080900644669320259,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,1140425034808342034,6716056879047445196,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,16370358036030137979,18161905153628818691,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,4240242925296441126,7511178356365157885,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,8224524506026750829,14768766680408252225,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6810667848915948751,14987783809445114137,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,10935909312939125686,10156148612174009797,524288 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5900,i,11170952878458069834,14735087554976621839,262144 --field-trial-handle=2080,i,9013981464576875722,14338514383307542193,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 293B
SHA256 85d6943763291d0e3adca3d0b151309432cb758c5f438eb4a6fee7b327d8ee95
MD5 f2c352133a394f64a1d83005ae65dba7
SHA1 32419afb071ea2c33c114d9377239104683afebb
SHA512 f467e53dd99c8b877aeaf5c3a171e539cc9308dbb630344f9bcc36b26b53aa78b9cc08997f582584bc4abd74e08d0b0f82b3093e7173524808bf16e78985c92b
TLSH
T176E0C249C9D0CB2A9344E5CB8524EF0DC284370EA7C86F1E4B08D888718B498B5BA6E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 413a310001922656c81e87adc7ae45d53a5fcd17a1d01b0a51cd285c012a8e01
MD5 06517dd7913bcdc619335b87b7ae991c
SHA1 d4270773632de1f24bed8fbdf442a0d36b384d62
SHA512 8d096b2dd3b36555ace66455aed29852868138b2bbb67dff07f873a12683f6433e6661e50418367b9c84574db15931cfc8cbd02b4005a6fcedf6060bbe9ee03b
TLSH
T1C9617364DD604459FFB803BA89CC3D8B353779A054B39F2A087CD6FAD87A39499891C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597853.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597853.TMP
Size 3KB
SHA256 dfcf136afb667a7eeb0cda793946e723f42a07483098124bff498bab1405a2cc
MD5 5120d39e8a16227fced7721218b2b2eb
SHA1 1964459faf368d150e18a72401a29cc3fda93c25
SHA512 79670a7d49f2ecd2cfb177ba774031436edebc5beb230a4b1f7a8f89fa9f693a2061253ed25bb2bc4c8b686617af44279bf50cd158ea1537f35a7d3f102c5914
TLSH
T176617464DD604459FFB403BA89CC3D8B353779E054739F2A087CD6FAD87639499891C4
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a308c306bbad6074bdb5122bf733e7879ccd382131c405c1a1138f64f2008ebe
MD5 89c9d5f43cfa3db051455178ace09be6
SHA1 f19a54369540a0ad9248be3a7a48a5084671596d
SHA512 4ced8dbbb3d8a520192300730bcb5e401a905fd501b2d84a001f6048057b1ef4d998e4acf6040590385079818b930f4ff0c3cb351a4acde1a7a422624598cfba
TLSH
T1D11190F3C7D595AE890116F06A24AE2BDE1D0506435C7C1AC5D4EF2BD3E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4e1d65336598a863b988d9fffe2d5806f2ed8f8df9b3209cd47eb108280a3aab
MD5 c60dfdb8d911833d988a6f1605854948
SHA1 1d7989a9941f978425c2a466cf716b5c248cb476
SHA512 35de0905773373483be259c52cc70cd3a8d2699e01ac2b2aa0b4c3b91d3ebc5a02ff7195adc25b19ef243301b1c1da07b4a78bff48cd6d5b4f7f2b11d5054aa2
SSDEEP 192:sxZpRXWx/fWs3OdsIdpHJHW6+WNGYai5yIg5NJ:sxZpwx/fWs3Od1pHbGbN
TLSH
T13822C6526E68697B8CCBD60DFB15BF53E6F9503261901E4CABFC8A1C05E6BDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7ee3fed512122fd2d51ef788b61ffafddaa0d39f046ccb653314fea43fdb03e9
MD5 ddcd15d6c0101f2b90ad872ded53c721
SHA1 81cbed6dca14f0cf9224c685fd781c39a48333c4
SHA512 45fc82fddd9ea94bf3bc08bf4874cb712a9f8d23281930e5bff8cd081bf3a8d6724ef3b5ed8dab77bdfe3c972a9cd9e9484e4b5f1b46dae7bd1cf145aae5b498
SSDEEP 192:sxZpRXWx/fWs3OdsIdpdJHW6+WNGYam5yIg5NJ:sxZpwx/fWs3Od1DHbGnN
TLSH
T12422C6516E28A97B8CCBD60DBB257F53E6F9503261911E4CABFC8A1C05E6BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 69dcf68d3135ceed84c03ca6b04f2d1d21aaa3deff6685f39de8def6cc460d9a
MD5 41407aa100bf575148d9e10d122687a2
SHA1 0564df42db6390a61738ddf0e3ebc8b04b43d23f
SHA512 b5c331ea015408ec035b8181dc2026bb204d98ee7cd825c5a9548821da1a229f4c928962d4a644ae8fc472eb67f9b2e74a992039cc604a950f6f72b8aeb39b58
SSDEEP 192:sxZpRXWx/fWs7dsIdpdJHW6+WNGYaQ5yIg5vJ:sxZpwx/fWs7d1DHbGVL
TLSH
T1C522C7516E28A97B8CCBD21DFB25BF53E6F9503261901E4CAAFC861C04E6BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6bd3a5746bcbc157192cdfc2ed725c6023924cbe98adb28f055ee99b1fff58a9
MD5 4fe9c34393a2aae4d18c96d494f8f96a
SHA1 e9463938a3b115769fea94f174f0fda821d02beb
SHA512 b7e5c6187aa898dcb56e7c1a4bcfcf605fc36bacc8fa5f137316bd72c81d9ca06df31206a53f7b6ac2058a2b4f69d7c2b397b01a1ff494fe033c51455e97e28f
SSDEEP 192:sxZpRXWx/fWs2dsIdpdJHW6+WNGYaQ5yIgrJ:sxZpwx/fWs2d1DHbGV9
TLSH
T1A912B7516E28A97B8CCBD21DFB25BF53E6F9503261911E4CAAFC861C04E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8c950be4e3adbc50bb927018995cc9e73c4d3bc5e4fdd2526d139b810077f6ac
MD5 73621df25b8ef0200b23299f8ba8a44a
SHA1 a0bc06e889237050f47f4180a40d9a7fc7c200e4
SHA512 533185f754a0c0182fc45b6a43385a400ec9be2bfce7e0dacb958befafb19da469ef4acbedea6b4d35e784cb417324534530432b5043613e86559a358db7014e
SSDEEP 768:/MyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3oro+ZaI:/MyQRbrWvvlpZu1jaXKLf33T+ZaI
TLSH
T1BFC2F92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1816534f-486c-4c22-a224-0715088914ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1816534f-486c-4c22-a224-0715088914ac.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6d7c185442616e3a1c31e75616c713a6156a309aeadddb6687d8ef16ca106c73
MD5 bcac6a8b26d108baf2948d2590558923
SHA1 5fa2b40300a7e2d22432949c3a1d43d7d3dead6d
SHA512 990fb56fce9d16a32787dd6a431c89f6d29771d24aeb35ad2eb76c6e18269a60853045116b2394718edbedcdab66503871b0e15922c90027b20210e5d067684d
SSDEEP 384:riFiZcIIzsNH8TUNTUlIl0Y8NIZp5u8iArJatgOIwZOyNon:GFQ0Gwg/1kAVaXswU
TLSH
T16FA25C7348A8987FADFB9E51FA4A32038FB44177D6C4AB9496DD961C01DB2E8130BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3d603a3e17cab595350684b0ed2317a6d9f067639ce85475ac97055024f74993
MD5 2f9c4bafa1c23d7630c6b6125c077338
SHA1 a3832dea6a9fdca0840019fd6c28701f5340714d
SHA512 ae41b6f38dfc6662ec1934284550cff2115149c862de820b35b97563b5d3132d6e0b2a9940ac6faf39c05a21fd57c4a93df2d9b8b4be40282f0fceec5086e106
SSDEEP 384:OZcIhsN9rY8NIZp5u8iAr4atgOIwZOyNon:shp1kAEaXswU
TLSH
T100826D7258B85C7B6DEBE911F98B36034FB88537A7C49B8495ED971C01EA2E8130BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bec470947df80627811ed4a1f00ea3815b9271d98545759e3919a1c8f74d1008
MD5 474bbfea8e868f9ed0035d0c7b2b8284
SHA1 e12d47d0d6d298de6f9f3f535765d99a0dd51d97
SHA512 b763b7356ae95949c75b61e68db20865041bd6df45fc82f20614ee657dd7e3f96d7dea44cf068b80e5102fa1bf95369ed82dcb5c6f076007ba58e32caa8664fc
SSDEEP 192:SONa6iDCQmiUydOHq5u88Ppuh3Sq3uTx9bU6:SONa6/hHq5u8iAv+rbU6
TLSH
T11E02F939AC693C7B9EF3AD15B58737175FA4013FE6942B84DAE81A2C41E729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2516cbb6257ddc2444fcada9c3e24e90422be76ca231eade1b747e8ed15778a3
MD5 0c5e7665f81f644938d6a1e8d64f6bbf
SHA1 7555a8f3d156685fef98d910749d6998a0e3830d
SHA512 96ddd6cf974174c8bea59eb5ce150fd6b689d71fbec3c1bc9ded6245b30b83d7c7d453e0abcaf11542b3c98125d20f11d9735f8eb89488a9d2958ceb61422ca4
SSDEEP 384:mZcIhsN90Y8NIZp5u8iAr4atgOIwZOyNon:0hW1kAEaXswU
TLSH
T1A7827D7258B85C7B6DEBE911FA8732034FB48537A7C49B8495ED971C01EA2E8130BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63f17312fca041c450295f3683b6324714a6bb8e53ab3e6690b202d9d9463682
MD5 e4eb829c999fd762b7e3853588ac27f6
SHA1 b75dc4b8e91a160cacaefb75d912846d30f92e4f
SHA512 3074272205977235b4f2fbdf0296f653f4d65f9fcc8d2558b41d4a595324f72ee835678a2c718450f8c28d718a759f7a6c2ae16da59252b8f7b2653eb5622336
SSDEEP 192:SONA6iDaQmiUyoObq5u88PpuhdJIzuZ33rqOOU6:SONA6D+bq5u8iArraU6
TLSH
T11712193668786C6B6DD3A965F58736135FA4422BE7887F84D5DC162C01EF3AC130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4bac2d4-72ed-4783-b176-de70f5fc2ed2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a4bac2d4-72ed-4783-b176-de70f5fc2ed2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da9468c05bcf654fcf7bc58a57fd8a79fe740848660d6a623e4abad11b69ff31
MD5 4e73928e031be99586a998a44658b686
SHA1 b15e07e60370317f6a680f7e67c4019844cb5b1d
SHA512 0363d3732c717025cdd557b0987091445b680238720d4c50ddf5d9df3b6a32c3814904d069e0986ad7e42e09c3e6590b54f3854ff79eb6674600cfc2c03917bf
TLSH
T17541F658A6ED1044B3B76F5AABF6A86E887EBD372F06C55E10120E4F4622F04D861737
MD5 SHA1 SHA512 TLSH

Submit Download