ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-qhmhksytht
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{1AA96455-D4EC-4AFF-AABE-DB4C6FDA84E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5492	msedge.exe
5492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1588	5116	msedge.exe	86
PID 5116 wrote to memory of 688	5116	msedge.exe	89
PID 5116 wrote to memory of 2124	5116	msedge.exe	90
PID 5116 wrote to memory of 2124	5116	msedge.exe	90
PID 5116 wrote to memory of 2124	5116	msedge.exe	90
PID 5116 wrote to memory of 2600	5116	msedge.exe	92
PID 5116 wrote to memory of 2600	5116	msedge.exe	92
PID 5116 wrote to memory of 1184	5116	msedge.exe	93
PID 5116 wrote to memory of 3204	5116	msedge.exe	94
PID 5116 wrote to memory of 1184	5116	msedge.exe	93
PID 5116 wrote to memory of 1184	5116	msedge.exe	93
PID 5116 wrote to memory of 3204	5116	msedge.exe	94
PID 5116 wrote to memory of 3204	5116	msedge.exe	94
PID 5116 wrote to memory of 3944	5116	msedge.exe	95
PID 5116 wrote to memory of 3944	5116	msedge.exe	95
PID 5116 wrote to memory of 3944	5116	msedge.exe	95
PID 5116 wrote to memory of 224	5116	msedge.exe	96
PID 5116 wrote to memory of 224	5116	msedge.exe	96
PID 5116 wrote to memory of 224	5116	msedge.exe	96
PID 5116 wrote to memory of 4384	5116	msedge.exe	101
PID 5116 wrote to memory of 4712	5116	msedge.exe	102
PID 5116 wrote to memory of 4384	5116	msedge.exe	101
PID 5116 wrote to memory of 4712	5116	msedge.exe	102
PID 5116 wrote to memory of 3572	5116	msedge.exe	104
PID 5116 wrote to memory of 5712	5116	msedge.exe	117
PID 5116 wrote to memory of 5720	5116	msedge.exe	118
PID 5116 wrote to memory of 5728	5116	msedge.exe	119
PID 5116 wrote to memory of 2672	5116	msedge.exe	122
PID 5116 wrote to memory of 2672	5116	msedge.exe	122
PID 5116 wrote to memory of 5492	5116	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffaacdec188,0x7ffaacdec194,0x7ffaacdec1a0
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,16660290989882225819,18248422651483929135,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,17664009357333127522,11886979581929108166,262144 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,7520897516838796021,2126767380462566656,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,327658011114481292,8418519735839762042,2097152 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13054306017965722015,3052306095303739890,2097152 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,8083623642011672032,4407366432868799654,2097152 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,12784080391127254652,8407638071407353536,2097152 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,13402424863401106141,1019211626558341070,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,7311359403011771851,16081900607618158524,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,2352863760618644551,18359419166230558192,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,2352863760618644551,18359419166230558192,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,9869119420313634191,14986205119381791127,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14678476497810858646,2931079429620101263,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,8423716484541602843,9772402843680524273,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,13164431336945930720,14539490982905011991,524288 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,5838345953869072340,9997587385888932954,262144 --field-trial-handle=2264,i,11414918976778722826,2868508842481751802,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

6c1ea197-c4ed-494c-9214-7b6b20992082.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c1ea197-c4ed-494c-9214-7b6b20992082.tmp
Size 27KB
SHA256 c3fd6f0b11f63b2718ba22889a6b7e3c253bd1629498aa6ab5a3f8c82779b07e
MD5 8299722c03e78ca6d096a9eff2773b0f
SHA1 0398196f20dbf2234e5be26b98f24aa615f68cd6
SHA512 53ad6beef2d0d3576381ac18594bcb0af245001a68a70ff89e5203201de808eb89febc50594f350db3be52c9ff1b5d36728b5abed830b4576b2d74731ca3f889
SSDEEP 768:IA30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72DrolZMZ:IA30AbSWvS2l9u1jaLmLZ12wi
TLSH
T1C9C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796548D4047FA944C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e16532732fa4a602ca24a517a5f23ad02d85c0e1fdace3e5fb1f024603907510
MD5 71f1ecf78d2c834b7a12081d14e49aaf
SHA1 6d9de55870ae80ec1a91e31915eea817af1a2ca2
SHA512 a3f2620098129e9760997892944ed6951de5ae93eae296554b0b0a686b43fe3f4cfd85a3821c71200c6a27599abc9becd245146280c8acdeb545f2948c97709a
TLSH
T14961418F46D9C867FBF895B296F5938236F866815B431DC131E4D879D82EB53F149200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594c90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594c90.TMP
Size 3KB
SHA256 ceb3d4838a54caa722bd579da938a0924a5aa1d74946a6ea15f14a495148fdb4
MD5 3780c7be77b3b2dd5676c941e2e29f0a
SHA1 26694411c0d8de6e45a1f71b1eacfed44ae72b31
SHA512 fbc0132fce8eff44bc03fc8e081b344a17990262b83a698307119126f1658bf28c4da2bc10d2e5075cb3fed79624caf45713cf6b87b542314cadbb685398469c
TLSH
T17F613E8F46D8C867FBF895B296F5938236F8A6825B435DC130E8D879D82EB53F149200
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 35e4e9d4659345316b72d84fb23145f92a8c66cea10549befd75a56d2d14257a
MD5 1aabeaf68a9e2d6b8cb9c4187d329fc9
SHA1 2486c583535d0c95488b364ff558b2119992c06a
SHA512 c20887808093e2910f1f2c728d5568289ff6bea47248eab2f2d780eb8443f9ce5e043bb6b2cec448c0f142a8d6b1bf4669f50f4b4e0a48c6a4f4051427aeee61
TLSH
T1D2117DF3C3D5C5AE890516F05A28EE2BCE2D0605421C7D1985D4EF2793E3075E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fe03275fb662b6b3fb2c2aca69db51fdc69679284dea9744590addf8f74c56e8
MD5 30f2c9e1eb1b4c0503d9bd66eb3b14a6
SHA1 1d672e09d2cfa24f739f6e130169e65a4975781c
SHA512 388d9145fc1da3817d000e8800d5558e0002a890ec645208411e2c894d771a91ead11cd34a720a5ba16c29f4147d7bd6e07b6a71e6f2084da8f399b2118c8174
SSDEEP 192:sxZHRwWU/fdsdFIdpdlHW6+WNGY3RNVIgrJ:sxZHBU/fdsd2zHbGm9
TLSH
T15212A7516E28A57B8CC7D31DBB65BF13E6F9503291D51E58EAFC861C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 11c95e5bdfaceed4eeccd05b8fcc51ce4c5c7bfc1714abb57ba72d46dad5db08
MD5 5219aebfd10d2615a08f9b6237e376fd
SHA1 c6b44a6733b177f5f5a26d22947a36d168b949e9
SHA512 3c8568525edbf8ca11a22863fb8703a1333ea802d36f8fcfde7581eaa8bb61dd9a5c7f8346d2de965cbc59f5ac38044579c75a919fe51cda9130041221ccb07c
SSDEEP 192:sxZHRwWU/fdsbFIdpHlHW6+WNGY3oNVIg5ZJ:sxZHBU/fdsb2FHbGfJ
TLSH
T1CD22C8516E28697B8CC7E31DBB25BF53E6F9503291D51E48A6FC861C05E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ad2287e6a1de3b1f19674b65469de758f622ed757e297cf1dfd3e950acfd1174
MD5 25d78c2daa31b7f6945597434695c122
SHA1 c827db2c2b1d43a9df603e91c0b74573bc0ee3b7
SHA512 cc119847a3ca8d1aba5d874c77a8498c93e77dd046927deeb7677794f87ea8b07edc32e4567594f81fb9ee3033ab799708b757385d0624130781d61eeca063dc
SSDEEP 192:sxZHRwWU/fdsTFIdpdlHW6+WNGY3RNVIg57J:sxZHBU/fdsT2zHbGmX
TLSH
T1E322B7516E28A97B8CC7D31DBB65BF13E6F9503191D51E48A6FC861C04E66CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a66843fe31609fb9ce19cca8aa8c9f03fbb541d8d07a965fceac8e6a0317257e
MD5 7d7328a8b76c9ea645747e3f693761b8
SHA1 537d1e6bedf75f61b572b650021f93effdd2f29e
SHA512 901579daa8aa95024a8f731c4f9c2c5e7dbf50d2a533d6e9008d3a483cd24c7100ed8584f9bd862be8b39a94daa54e16a2a84b3db1edb005a0f9a33614844a25
SSDEEP 192:sxZHRwWU/fdsbFIdpdlHW6+WNGY3XNVIg5ZJ:sxZHBU/fdsb2zHbGSJ
TLSH
T15122B7516E28697B8CC7E30DBB65BF53E6F9503291D51E48A6FC8A1C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbb9121a-92bd-485d-be8f-6a012035dcb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cbb9121a-92bd-485d-be8f-6a012035dcb0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 cff766d6c9c4e4676ed5c328e360e447cc129b7906c50158434b7a188020dc6d
MD5 add0ff34392177bfcd8cd26650d68365
SHA1 6cce95081120e4153677f350acba556201f7c02e
SHA512 74524227ff5cf4be54f27650f43bf8f0512bdf6390081d7c9dc17b336cdeeb502f49f4469da3d3c408753ed294a4bca137bb83c4e781c0d0275d2aa986e68f67
SSDEEP 384:OiFiZcIbzsNK8TUNTUlIliPDPpuXuD9iX5F71sFq7ZyQ7tgOIwZOybDoN:lFQPDwgODNBa8SD7Xsi6
TLSH
T13CA27D7398A88C7F6DF7AB44F54A32139FB45067CAD4EA94E6ED5B1C01971D8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 219924112e7d040622b74cce0017d7b3617f47597f6edc3bb2da91029d906c30
MD5 d8d749d9b9a808e50bd4aa717c67297f
SHA1 48ae8441211e22419e4ede0cf1543051b104754b
SHA512 c6a446c35e490dcfe65483adf1d242e7389570708fe89ad06314b4351e1a1d9870d77ed07a920e5bdbf190721e208136bc8201540d252a692d628681d95d651c
SSDEEP 192:LON/6AmwprQmiUyU86siX5F7wksF+JiyQipU6:LON/6ipdQ6siX5F71sFryQiU6
TLSH
T19B02FA35BD786C7B8EF2AE45B14B37235FA5117BEA942F84C9E81B2C01D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e48d5df717390d71bd03d50a306d82fc671047be17fdc8927fa5eace84290ba
MD5 cb3a9080c97e44c66068e9cfa526386b
SHA1 f6f602cf75d02fdb8dc9fd2d251799024720939d
SHA512 74c826c78cf52e22ba583d1c9e068e07159ce97a998eb22690b676d42a0a6e50d514e983da2a871f184c712aaffc321935f17078a48ae3abf985ab024c1f655f
SSDEEP 192:LONj6AmwpKQmiUyC8RsiX5F7wksFqwKPeElRyQJqqU6:LONj6ipGqRsiX5F71sFq7DyQ7U6
TLSH
T16F122B32B8B86C7B4DE3A554F0473513AEA55267DB886F94D9EC2B2C02DB598530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f27fe7024c0d6f31381906107f4eda72a62f3984a34c4789095a6c306da7ebd6
MD5 67a882f10d14ed16ed9f940419501d64
SHA1 60557792feb53764908f1782e8bddffaaf0bc4a3
SHA512 d02b8fc46aa17ab7773d6e79810140498e130b82db50bda9301241af371842d2ec6bebd321aeea127533cbdfd858b2c05ea181b0eb0775256089d137e0a7dc80
SSDEEP 384:4ZcIhsNyjPDPpuXuD9iX5F71sFq7IyQ7tgOIwZOybDoN:GhtDNBa8tD7Xsi6
TLSH
T1DD828D72A8B85CBB5DE7E204B04B32139FB89067D7D8AF94D8FD672C01DA594030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 faaa68803a464edff51ed0ac578963faa7be1df88738806b9e61e5993d7e77fd
MD5 5eb6578870d093a74fb7bdb9de86b085
SHA1 dddbaa37eff06085a4799764273f19e1c629790d
SHA512 aa5b5850d6418e2c8c364399de3ba4596e02d912d5ed3ff140bfc4ede1e15a115f321cbe5576bd4a54d817eeae5dc20a3c476b2488ca0e50dbec5a1e19ee3cef
SSDEEP 384:KZcIhsNyiPDPpuXuD9iX5F71sFq7IyQ7tgOIwZOybDoN:ohSDNBa8tD7Xsi6
TLSH
T1EC828D72A8B85CBB5DE7E204B14B32139FB49027D7D8AF94D8FD6B2D01DA594030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6900022-081f-4547-af06-6aad362f803f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6900022-081f-4547-af06-6aad362f803f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 daf793f1b557ba2176c16ca36fc17731410b217c413bca691e20e54c9d43a74c
MD5 e9abfbbdbd7737352a1cb23e2f8daf06
SHA1 4ff3320b69b7267088057289851b4172cf899e3d
SHA512 f9775c93b99cbab4b1e3e1a038743ad32b23c12fae674d025678319eb01ab2834e7590630641555170db51f13d6e628fe159d416db7cdad81d864dfd0f1279b7
TLSH
T12A41285CA6EA1148B3B77E5AABF7B46E487A7D772E0AD45D10110E4F4622A00C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download