ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-nhdvbstblb
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{108843EA-B5D4-45B0-8679-E8F8BF104B5A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1308	1620	msedge.exe	87
PID 1620 wrote to memory of 464	1620	msedge.exe	88
PID 1620 wrote to memory of 3828	1620	msedge.exe	89
PID 1620 wrote to memory of 3828	1620	msedge.exe	89
PID 1620 wrote to memory of 3828	1620	msedge.exe	89
PID 1620 wrote to memory of 3648	1620	msedge.exe	91
PID 1620 wrote to memory of 3648	1620	msedge.exe	91
PID 1620 wrote to memory of 3900	1620	msedge.exe	92
PID 1620 wrote to memory of 4324	1620	msedge.exe	93
PID 1620 wrote to memory of 3900	1620	msedge.exe	92
PID 1620 wrote to memory of 3900	1620	msedge.exe	92
PID 1620 wrote to memory of 4324	1620	msedge.exe	93
PID 1620 wrote to memory of 4324	1620	msedge.exe	93
PID 1620 wrote to memory of 784	1620	msedge.exe	95
PID 1620 wrote to memory of 784	1620	msedge.exe	95
PID 1620 wrote to memory of 784	1620	msedge.exe	95
PID 1620 wrote to memory of 3504	1620	msedge.exe	96
PID 1620 wrote to memory of 3504	1620	msedge.exe	96
PID 1620 wrote to memory of 3504	1620	msedge.exe	96
PID 1620 wrote to memory of 2984	1620	msedge.exe	104
PID 1620 wrote to memory of 2984	1620	msedge.exe	104
PID 1620 wrote to memory of 3988	1620	msedge.exe	105
PID 1620 wrote to memory of 3988	1620	msedge.exe	105
PID 1620 wrote to memory of 4044	1620	msedge.exe	107
PID 1620 wrote to memory of 3996	1620	msedge.exe	115
PID 1620 wrote to memory of 1632	1620	msedge.exe	116
PID 1620 wrote to memory of 2460	1620	msedge.exe	117
PID 1620 wrote to memory of 3188	1620	msedge.exe	120
PID 1620 wrote to memory of 3188	1620	msedge.exe	120
PID 1620 wrote to memory of 452	1620	msedge.exe	121
PID 1620 wrote to memory of 452	1620	msedge.exe	121
PID 1620 wrote to memory of 2984	1620	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x288,0x7ff91a6ac188,0x7ff91a6ac194,0x7ff91a6ac1a0
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,15762604528983960697,3686880371561546754,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,11344522516609653085,6050756605671752291,262144 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,10352859595609179471,18025196415489794622,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4616699569519249450,15527718703706763435,2097152 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5064322866102435698,14005690400311280838,2097152 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,11377591728207321847,16744190976740332280,2097152 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,5901525241530691706,8989906768296334603,2097152 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,16013127579947469891,9166852827362051706,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,1335059005079800289,5712965130126980944,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11472576411443259494,267654312795876749,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11472576411443259494,267654312795876749,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,13480335367625706721,10902206471480038225,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,501160649126598636,15717265116524939306,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,10240396509243202190,12177563853388512036,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,4958153688412531169,17079482359732428803,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,7335696096772718940,5117046541736158658,524288 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,2372537761868026738,14826118412329300898,262144 --field-trial-handle=2320,i,2898351927646761897,13746999469954456607,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b692d64d50c0c69ef90ad6ff12a25421cfc7dbf4a645bfda339034b43aa9e10b
MD5 f26ed32f5e333e60664a6c60a6e82f36
SHA1 09c8df80f0f3610c611361b70ec942048a96fca6
SHA512 f58ab305ade3c49370a25c3ab1effbf4f37103e19dde6fbe9d1fdb9c4aab960f5db62a1ac028b1c0bede42c300a792c508585ea094c3fc8a1312e155bedb0ea3
TLSH
T16F51F9A0BAE0C041F7B483B561CD3EB73232E96841731E6111B8D9FBDB227684A863D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8b082ea1eee3c201cdb53e83806f50a41d1a040db10a4abe428886a94518294a
MD5 d7b8b946ed59332c04ed9810b9b59262
SHA1 324c1e366b2235ea62aedeec8ac6a4ca4ba21d1b
SHA512 3c8010c805d83c789f01642c7cfe481e77e4a4382976a4b061a8b44bdde403fd9bbf8d7c94ee458a4d90c109da1f6ac18a149c03661a52338de5ec9557b9f0fe
TLSH
T1F4117DF7C3D595AE8D0156F05A24AE2BCE2D0505421C7C1A85D4EF2793E3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b98ec7d807fe0146062437304c3471bf9949e5536765ddae8e164efbfbe420eb
MD5 02fb2e5d9b2b8e091b040b7af4348c47
SHA1 c2aa524fb613279553256e7e2aa32ec397504e0b
SHA512 8f354f6d586aa5278fd7b821fdd9b2c93d05f4b93668b1b3fdd36eeed08df9840ad9f22a6e407d0c7337fb98a8976eb672f02bcf039cca944638007b0d2543d0
SSDEEP 192:sxZJRNW3/fes00YIdpdwHW6+WNGYgUf+iIgrJ:sxZJe3/fes3pyHbGMp9
TLSH
T1C822B7516E38A97B8CCBD20DBB15BF53D6F95032A1951E58EAFC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0b94596dfa168ccbc2c5ccc9316f06d574f6c244d1ad2c1835e57706d5da238e
MD5 2b1cc60fbe340f42669ad61f20de5484
SHA1 3ae82841cd92ff7194a28a268f1c0d5fb9421620
SHA512 e1161ba995cee0c4a5c033e851db1ed3e6b98ab0c062e9f44bb5c6410a2a68262576c8de4a8e15e854baa41e589cfd27302e911dc9dc531746d7f9cc8b002cf4
SSDEEP 192:sxZJRNW3/fesMu0YIdpdwHW6+WNGYgYf+iIg5XJ:sxZJe3/fesMFpyHbGgpf
TLSH
T18722C7516E28A97B8CCBD20DBB15BF53E6F9507291911E48AAFCC61C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 528c0df1c924600104c554d4467dc03c911e508689f088bce64a9b7e5477984d
MD5 917ddc550f633abf456106475b908eb0
SHA1 358539dd77591d72fffa03305ef20561a5627e70
SHA512 2e44e78359601ca45f987abb5f795dda3620e1a42c2d5fbb49d91d58f731193b0abcd7dd6d2280a1f9a05209aa1561456c034efb7ea7d92567cf3d2ea2b84d56
SSDEEP 192:sxZJRNW3/fesMu0YIdpHwHW6+WNGYgmf+iIg5XJ:sxZJe3/fesMFpQHbGupf
TLSH
T10B22C8516E28A97B8CCBD20DBB15BF53E6F9507251911E48AAFCC61C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 62c95c5ac933a0662ad44bcafbdc07e74a66a855aafaa5da17787a95df808e33
MD5 de00b66314075cf1eb4506aab329bc55
SHA1 5db5df4f4fef820cac4e7c823079a766c18b329d
SHA512 841c04da5e3c3baf49765f040371a9cef41f0c61f464a72df9d596705a1e468ceb1005168e49b0d670423ddeeb89a15ab8b0c2b49f5557cf7ffa7c26ce83b1d6
SSDEEP 192:sxZJRNW3/fesX0YIdpdwHW6+WNGYgUf+iIg59J:sxZJe3/fesEpyHbGMpJ
TLSH
T1C122B7516E38A97B8CCBD20DBB15BF53D6F9507291951E48AAFC861C04E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 65677324e7629368059a229b454336c59bb3eea284891d2a9fa98f7b7ccf011b
MD5 ca6cf5f7fcf4e533561606b92c031eb6
SHA1 f4ff28c75bc4530f6670f016050151b0999daa90
SHA512 6b87e74e292b359c6aed6077efe23d51f0f57a2996f625503049c05a0f6548914bbb7a202fc5eef1606fb22ffc9459b9a3c2df660d54d39e21030e017fa97be0
SSDEEP 768:UJichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzBroLYq:UJichfPWvPZplu1jan+LKgz6sq
TLSH
T19AC2E97B644CCB7E4FC01A9DDD1A6F977E9802C7AA588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5208d53c24e9ab730a5f36c869758ef72ed174b70d95fb81d6aca579f7c00e7b
MD5 5bb0da5d6bbf9c1b76384eff5cdb315a
SHA1 bc0263a51a849032305aa81e2e0acedde657ad8b
SHA512 281cf5ec65f3c2e1027fd4960135ef036c7cb0659f940d75be2d9dd926ac30a3376a1f9f7d7112d7c6af7bfc96e692e24eb54d8a9698533ed0c49a69dfe0a5c7
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyL4N4s4h494P474/4gb4T4m4zIS414gp:KEIQKFW6WruKAs3bWKQMi+BiK64G
TLSH
T1AEC1E14130BB064638BD254C90A5872E424235B3316DF6BBFF7D48A28A6BE441DFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c518d41-2617-4dc5-8dc1-478c47b48874.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1c518d41-2617-4dc5-8dc1-478c47b48874.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c92526682d33a6ad6886a84a3f254e412f399f2db6c9e4dafc1eee21d0fb2be7
MD5 6d0a1dcc510359174fcc643a922ab757
SHA1 cbe6a0c3c4411509807a29c841399c0af5ac5c69
SHA512 2eaf4dadd206eaea53e032a7db255fabf0d8729eef8435f3db8b1a8f102b1bc5593b5cc91dc4d345d0f5351dd140f54eab8b3046433ae08c05d4e444aac0fdeb
SSDEEP 384:PZcIhsN8UYWSpCF55DFlBGYX5EDtOxlL/OrtgOIwZOyiLSoX:HhRpq/3GYuDtOTL/OrXstew
TLSH
T104826C729DB89C771CEBA185F44A36038FB4902BE6C5AF54D5EC6B1C01EE698130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6648f98c7d1b441878385d4ddf4c717d3b683acdc119be071d067456b6edbd35
MD5 9202326b46af3016aaf3c02f1feaa8ee
SHA1 98393f9dffd82c864db007afd39093df945d0a5d
SHA512 671ac23708f2c9ec1c1268c0f97637832e8cf76accb8f713f52119a361c6e2d6dd74793b93ef998b10ca1f531bddd8a6a93428ea8df8a307d92175587d1f4842
SSDEEP 384:FiFiZcIJzsN98TUNTUlIl9WSpCF55DFlBGYX5EDtOxlL3OrtgOIwZOyiLSoX:MFQpYwg5pq/3GYuDtOTL3OrXstew
TLSH
T199A26C739DB8DC7B6CEB9A85F54A32038FB48067D5C5EB94E2DC6A1C019A5DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 205679fff696840404b56dbd035c9f2df523b0670ff7c8d2bbb324fbcb5cce5e
MD5 5a601a4a02778d9528574dee1e540fc3
SHA1 f70af0958664955ef113367c88efa4bede3534fe
SHA512 8e87835e657c96888ee22df5908b99f04515aa63c1ab042847407428540ef8b2bea847181c2b24935a0ed2cb723e51099a3096e724741bcf8d249f1e449e58f2
SSDEEP 192:LJON46DphmqQmiUyw7q8wGYX59ezSCtORX/kk7OMnU6:lON4619DRwGYX5EDtOxnOGU6
TLSH
T1CF02E735ADB8BCBB8DE36E45F48B37139FA5112BAA946F44D6D81E1C01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7cf1f9e6585d9dc18b6bd4603e8d2ad78bf3bbffb381ab21e50263ce7e3d1bec
MD5 d9495f33e3e1ba0ab028a6de01fe31d5
SHA1 dcfe1f20e9852632ac083fc6f8023bfde57abfff
SHA512 906f530098526374cbf93f570561b3ce045a4206fe14d3c3c9669db203edb527508ec048ff7eb4a53462c5d53a2a39c359f485914bd76f1ebd2e68e4f09f9c7f
SSDEEP 384:/ZcIhsN8U9WSpCF55DFlBGYX5EDtOxlL/OrtgOIwZOyiLSoX:Xh4pq/3GYuDtOTL/OrXstew
TLSH
T1FC827D729DB89C771CEBA185F44A36038FB4902BE6C9AF54D5EC6B1C01DE698130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1801743cbbc08b755c24980069b8c176c71e49daef1a17661d47263f95f9ee01
MD5 c975a7571461352a453f6076f1be40c2
SHA1 c74635bd03d15558775b88771aaf0e9eb6240f13
SHA512 9b07523e79385bd8bedbd71cb0e4f0efb60d1ccd53fe18de5caca3d35db2eb258ffb1d0accd42b1324c4e4a48a2f50a0413b70fd38abc7cffe75ee3e5dc4905a
SSDEEP 192:LJON+6Dph7qQmiUyr7XwGYX59ezSCtORXlL7kIIOEq5PU6:lON+61cKXwGYX5EDtOxlLcOrU6
TLSH
T11B120A36ADB8AC7B0DD26551F44736139FA5512BEA84BF50D5DC2A1C01EF69C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b39fe8396dba780cde8ddb70908998b72a793828840e0b1b1af1b9e41d15f004
MD5 e51e3079058d40459e278852f8cc116f
SHA1 efcfb06a56c7318e276868f23a9c381b57f69375
SHA512 4bfb2033746f3eda3a492aba21f39fa9cd9579a348abfce4052929eac3e3ddb7b78b5ad24dcd678521993ffe63afc643c6b574695dbbeb95c052ed19e9514912
TLSH
T1AC41D85DBAFA1148B3B77F5AABF6A86E087A7C772E46D05D10110D4E0A67A40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download