ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-sffy5avtes
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3432	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{507EA890-C039-46D4-AE9D-E76752FF4093}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2960	4136	msedge.exe	88
PID 4136 wrote to memory of 3432	4136	msedge.exe	91
PID 4136 wrote to memory of 4616	4136	msedge.exe	92
PID 4136 wrote to memory of 4616	4136	msedge.exe	92
PID 4136 wrote to memory of 1120	4136	msedge.exe	93
PID 4136 wrote to memory of 1120	4136	msedge.exe	93
PID 4136 wrote to memory of 1120	4136	msedge.exe	93
PID 4136 wrote to memory of 5912	4136	msedge.exe	94
PID 4136 wrote to memory of 5912	4136	msedge.exe	94
PID 4136 wrote to memory of 5912	4136	msedge.exe	94
PID 4136 wrote to memory of 4408	4136	msedge.exe	95
PID 4136 wrote to memory of 4408	4136	msedge.exe	95
PID 4136 wrote to memory of 4408	4136	msedge.exe	95
PID 4136 wrote to memory of 4412	4136	msedge.exe	96
PID 4136 wrote to memory of 4544	4136	msedge.exe	97
PID 4136 wrote to memory of 4412	4136	msedge.exe	96
PID 4136 wrote to memory of 4412	4136	msedge.exe	96
PID 4136 wrote to memory of 4544	4136	msedge.exe	97
PID 4136 wrote to memory of 4544	4136	msedge.exe	97
PID 4136 wrote to memory of 5960	4136	msedge.exe	99
PID 4136 wrote to memory of 664	4136	msedge.exe	100
PID 4136 wrote to memory of 5960	4136	msedge.exe	99
PID 4136 wrote to memory of 664	4136	msedge.exe	100
PID 4136 wrote to memory of 1376	4136	msedge.exe	102
PID 4136 wrote to memory of 5760	4136	msedge.exe	106
PID 4136 wrote to memory of 3012	4136	msedge.exe	107
PID 4136 wrote to memory of 4932	4136	msedge.exe	108
PID 4136 wrote to memory of 1548	4136	msedge.exe	109
PID 4136 wrote to memory of 1548	4136	msedge.exe	109
PID 4136 wrote to memory of 5088	4136	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffa184fc188,0x7ffa184fc194,0x7ffa184fc1a0
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14079427881962996573,2380230826058286715,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,17523841208138896227,6127077718970073477,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,2339118126382913576,3632129440269854022,262144 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,14509067718829852234,12587064804360648257,2097152 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,1475258315310004022,1951217829017441028,2097152 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,12897630117804769342,2710857472260358331,2097152 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,7721266410009492728,7825716579784964746,2097152 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:9
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,7958940242539885713,15371999023476377626,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,7616333398434678698,12017937450393717703,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,13578008473362383064,7388005383934141146,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,13578008473362383064,7388005383934141146,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,2101548858237639289,4817842315315267372,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,7420567141952881803,1227786623601042969,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,16455084624283462419,8721489878797895806,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,4249782147339568546,3837882384838125538,524288 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,11689947474015067999,382142065935912309,262144 --field-trial-handle=2544,i,14760667805076915734,1525201769653473304,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1322e1d04e6d463c5d11fd648bd798079763362e7fa50d79b48d396d79a49a9f
MD5 f84484b0b5c4edcce586bbe329a956d6
SHA1 4a84bb672a8a0d41367b472217886092775a8830
SHA512 418e6c0f9980cb1ee6a359fb9b57c0a191f3b75192a9bc9ed424b2f799f6eb7803b76adbeaa9b710e4f65140fa5dd49c45d5b701e1a077600ae71c5bc0fd6bf9
TLSH
T1A551ED40E0458056F7E80B3071D938ABF6353DBDA683AD122858C5F58E5E77A9E353F4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d613.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d613.TMP
Size 2KB
SHA256 aabf9ca7c9a51dbb53c93f6dd160da8d49796e09cdb862413aa07d7172d523ba
MD5 d1918bf57291f62b337904ab1ef5950a
SHA1 4434f00b946fb56d84f6d8b404121de7a829b63d
SHA512 f3011d0bd39dbfa8581d4f04ad7dff521d859ac94bddef74f14aa9fdb13b0b03465d74e5003e08916176f815249f1da59e8a58885c80ebc664846695f6d0c8be
TLSH
T1AD51DB40E0458055F7E80B30B1D938ABF6353DBDA683AD122858C5F58E5E77A9E363F4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e48f4589-3cd6-42fc-9ae6-0fd42013063f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e48f4589-3cd6-42fc-9ae6-0fd42013063f.tmp
Size 2KB
SHA256 6dd3208ba06bef4b59789ac9bc606d14989aae53b4aeab1187d3aa77240d642a
MD5 1a1fa20c73800163697fc71b5fac3638
SHA1 534141a9421bb272a35bbd9599325b32c6a0656c
SHA512 e7fd7866dfc7d2252287ded813bbf912a1da2a0c3c57d0c29c05808edd60ace9869b3b3a6b34dc36729b661024a128ba4b62a42dfb95df1df66461cc539fad10
TLSH
T1FE41AFF7C3E8867D890156F4AB186E1BCE2D0955832C3C5AC8D4AF2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6169de2ea85af94aa696807607aa0b5c077b55e4ac06e982f5755c8cd2163181
MD5 73495285aaca05eac0070159c82666fc
SHA1 51247fee145aabcd2f73d57f4c436d90dfa22b71
SHA512 95403afff569845fc8087d0a57559e519f99d699592fc3d359df9429615749a2a25bcc55066cb9a680be5cebd7078b8ee78de5aa37461a3d0cfd44503ddd9c90
SSDEEP 192:sxRwNRybYY/f2HsbK7x//KzoA8p49/g6+WNIYDRLGWIgD7J:sxRwNeYY/f2Hsb6ZH4/5I4x
TLSH
T13932B815AE68B97B8CC7E21DBB55BF13D7F9503260941E48B6FC8A1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 94cc33c14f83dc2c2c870b8f9af51bf3daf059be6ef8fa7362a6a62ee3f299d0
MD5 f9f25fc5824a91adf1776a8ba66f54f8
SHA1 b07cdf9310cb967b0a36ac1df875124e8dae394b
SHA512 3bda266777c6580ba94bcdfc03266a1c8a0eb2cff5d2402aa3470ca44578e4f545d28367e22c94ff9413fc02cdf03555b4a22367194fd72ed00f32d89c2756c0
SSDEEP 192:sxRFNRybYY/f2HsDK7x//KzoA8p49/g6+WNIYDFLGWIgIJ:sxRFNeYY/f2HsD6ZH4/5IKs
TLSH
T17732B715AE68B97B4CC7E21DBB55BF53D6FD5032A0941E48F6FC8A1C04E6ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e305c6c43e47a2c7c22abb840ed06a43bc6a84395a0b6e84e0fbddc4f250ecf7
MD5 8928ce63a6ba7879c93ce3461ad88c03
SHA1 3a10ec94375081cc32325db6d0f2e66226e77ba2
SHA512 8774524e2687d8fa8b62f9b4e0802563d501de80b0899a08c94b0791e60ef8a3b3ecee5f9262fb5f9c7b94d5f83999b0cc48db9068df820812dd5cf7c8da1186
SSDEEP 192:sxRwNRybYY/f2HsNK7x//KzoA8p49/g6+WNIYDFLGWIgD1J:sxRwNeYY/f2HsN6ZH4/5IKz
TLSH
T15432B715AE68B97B4CC7E21DBB55BF53D6FD5032A0941E48B6FC8A1C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 5ce18ebab7d86d0048115f591ebeae031e94e356a7d198a8ad03fbf3ccfc338c
MD5 8b2af587c3601b45f5b163bcdfd0b9e4
SHA1 db9f2af1e63f229225f32dc1c9b8e1ebd51e4000
SHA512 5558e22329107a0a5431c672e07d713d4af40de9162c7361adba0cd3ff7d04165dfeccbda94861373c731115b56e33a1f3521b35089a8b7a699d2958b67388ad
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R91roTyv:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0V0
TLSH
T1BBB2D92B600CC77E4F804AADAC1A6F977D5802C796988D4047FE995C03C77FBA12A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ea5f6803-9e01-44e8-82c9-25d159200909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ea5f6803-9e01-44e8-82c9-25d159200909.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0e88b26a56275eff9547fac8403fe00dcbdcdf81edf2876c9e7c4adaff76db4a
MD5 f057fec6b299cd5e7a50036217af60ae
SHA1 2aa3e4ed26c311c5a3782a1d4099026ae09a5928
SHA512 62b5fa18351188dbdcc07249acd2f7c35f290f4ea8cef55b00177500ac3d18c6ae4a7a312e4fa80f224c5c712a4af4f1ab167f8c9c1ebc4c8ca51853db201795
SSDEEP 768:Fs3LHyEybNbFmtMOeRFZD1fTos7Rj/4YGHxg:Fs3LN5Y1fT/Rz4YUxg
TLSH
T176F2BF36B8E49D778CF5E285E1463A0B7FF481538ACD5A8444DCAF0E049BEAD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 223c35839972266a4cd78598af3264cb7289e4ab64e6a259027d25e6dea65817
MD5 e650ab03bb710619600ec347149b6546
SHA1 db1acc92a9d3d95a8538df773c18f87da4344b57
SHA512 2e38d98585afb63366c66374b0267c1cc06a0898f21cbf60e89521cc478affa384652b10e3251fac565f3399f68925ab6ba1e08feadb34fc98707debd4d8550c
SSDEEP 768:q/UxvxjgC+x3uHkEybNbFmt2OeRFZD1fTos7Rj/oh3:vZj3+x38XHY1fT/Rzoh3
TLSH
T16703BF3AB8D4AC338CF2E250B24A774BBFF4556389C9599809ED5E0E05CBBAD1307C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e50f50399ebd08f4de2df5cb59cc0eda6faca14a2ea8ac33d3c78be45cf5bac7
MD5 b3925cb73ed3bc1b35af96fc6190bd64
SHA1 065fc95a16b4c3edc524041f5c61b883d89b518c
SHA512 4ff7c625656a69d1bce2ca82ddc6ba0cee59eec7da5cbd110ccca9a41204c437c976b24d026e31da1cf8501147ffa65ad634ebdaf2b0db4382545ba718dd9360
SSDEEP 768:qs3uHyEybNbFmtMOeRFZD1fTos7Rj/4YGHxg:qs38N5Y1fT/Rz4YUxg
TLSH
T12BF2AF36B8E49D778CF5E285E1467A0B7FF481938ACD5A8454DC6F0F049BEA91307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a7cb3e0c0aa8cf2e57a972099dfe7c47814fe7d2ca5a5bdc02da8514c2f0a5a5
MD5 246d98e16d2e00e1a09846b8e224bb67
SHA1 77a114c532aa2676d36c7d85b30624670bc1cbcd
SHA512 e249069d183939e0885e669901546ef3fc384938a953492307328b0bc5a83a5ede89f5bbae7e6d2d5747e2a5ba666aab47c13b9f5bc93c838181d1f5b8408727
SSDEEP 768:/FQe3swgkHyEybNbFmtEOeRFZD1fTos7Rj/4YGHxg:Ce3pNxY1fT/Rz4YUxg
TLSH
T118F2AF37A8D4C9778CF9E785E14A360BAFF481A3C9CD958456DC9E0E009BAED1307C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 62d8e182b9f91c2f474d475636b0e5972eedbec52147444e0f8c137791b22e4f
MD5 64052696ba592d272562ffcb7d17fe31
SHA1 ce46de6783ee6e356661e2f96dd3f6b2d7e7e818
SHA512 84210c92395042b8e13c2805ac86303007eb977265c9d6f349028ef185611c28a87f1cd6ebc5996ac14074a2c5e9ffc5478d138492a2c87d675775a4a1a77462
SSDEEP 768:z/UxvxjgC+k34TSybNbFmt0OeRFZD1fTos7RzBl/+Pu:GZj3+k34upY1fT/RnKu
TLSH
T16503BF3AF8D46C338CF7E244720A764BBFF455B389C91A9805ED6E0E058B7AD1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7e8d541-bc62-4f00-b0bd-bae242c5c9e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f7e8d541-bc62-4f00-b0bd-bae242c5c9e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download