ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-tpem4azdna
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3896	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{0D331B32-AB16-4200-9FE3-070702CB9071}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1264	4800	msedge.exe	84
PID 4800 wrote to memory of 3896	4800	msedge.exe	85
PID 4800 wrote to memory of 3884	4800	msedge.exe	86
PID 4800 wrote to memory of 3884	4800	msedge.exe	86
PID 4800 wrote to memory of 3884	4800	msedge.exe	86
PID 4800 wrote to memory of 4056	4800	msedge.exe	87
PID 4800 wrote to memory of 4056	4800	msedge.exe	87
PID 4800 wrote to memory of 1072	4800	msedge.exe	88
PID 4800 wrote to memory of 1008	4800	msedge.exe	89
PID 4800 wrote to memory of 1072	4800	msedge.exe	88
PID 4800 wrote to memory of 1072	4800	msedge.exe	88
PID 4800 wrote to memory of 1008	4800	msedge.exe	89
PID 4800 wrote to memory of 1008	4800	msedge.exe	89
PID 4800 wrote to memory of 928	4800	msedge.exe	90
PID 4800 wrote to memory of 4616	4800	msedge.exe	91
PID 4800 wrote to memory of 928	4800	msedge.exe	90
PID 4800 wrote to memory of 928	4800	msedge.exe	90
PID 4800 wrote to memory of 4616	4800	msedge.exe	91
PID 4800 wrote to memory of 4616	4800	msedge.exe	91
PID 4800 wrote to memory of 3364	4800	msedge.exe	101
PID 4800 wrote to memory of 3364	4800	msedge.exe	101
PID 4800 wrote to memory of 2904	4800	msedge.exe	102
PID 4800 wrote to memory of 2904	4800	msedge.exe	102
PID 4800 wrote to memory of 2208	4800	msedge.exe	105
PID 4800 wrote to memory of 4536	4800	msedge.exe	111
PID 4800 wrote to memory of 2356	4800	msedge.exe	112
PID 4800 wrote to memory of 1652	4800	msedge.exe	113
PID 4800 wrote to memory of 3332	4800	msedge.exe	122
PID 4800 wrote to memory of 3332	4800	msedge.exe	122
PID 4800 wrote to memory of 4828	4800	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffd14bac188,0x7ffd14bac194,0x7ffd14bac1a0
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,3094421230824255156,13304381820530499678,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,14524905097492047525,7471818046855036083,262144 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,3571404008907858995,14008113659570859910,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15993613995156257159,2498066865499703092,2097152 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8471333436666179424,9887656927189925499,2097152 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,6909250021497612262,7495966958873701388,2097152 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,14237524496414256169,17712334721415131202,2097152 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,17446273832341421182,17758098761340461162,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10887673170372075805,4107705977420843121,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15415546126806321917,13532541536137932420,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15415546126806321917,13532541536137932420,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,13165597412087428208,14700932091259502779,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,14795500025488426433,12980895228218642516,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,11144791260046167945,14174760188465682793,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,3733826766359450307,6049138650535111634,524288 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,16649486567169613677,643138990903893801,262144 --field-trial-handle=2340,i,11339490194694501594,18060292342805896682,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

7bfee7dc-f5eb-4bcf-811a-7135a08f0ef0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7bfee7dc-f5eb-4bcf-811a-7135a08f0ef0.tmp
Size 27KB
SHA256 5469c8f6c352728e12bd71f549b4a3dcc9ff879a24bea5a340e5f0c04486a9b9
MD5 8082a51b43a86e06ef7861266b45074b
SHA1 8cf07d7269322bf67942c83da81041a1fbb87608
SHA512 8ebd04aea521fc15a26927812e59a5f29c4b99f0d16a5078884fc333a62838dc3fcf21ef317ed4e3dbdddf65df38db5fd8e332d97988c75e8da0fa4c6048f8ec
SSDEEP 768:Y1yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3/roOZnJ:Y1yQRbrWvvlpZu1jaXKLf33sOZnJ
TLSH
T162C2FA3B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6c165690c5bb244fe8f51195edbcde0b19eba7ce8327464a1d5896c6a868ea52
MD5 13e0c1811f3679e396f5d1d8b1024d03
SHA1 fafdc6b6fdcb2c560921ec6f32d3d90f21c179a5
SHA512 196423c4bbcc03505c1e4831bdcf013e995fc2e526a7bb086c256bce3ac82e5e7968b6999b5bced2b1c5d31b9d237b85d25859751f320e0de6e37b493bbf1022
TLSH
T1C9618082A74343ADFBAB603181D928CF3E35554A419B2F2AC5E4D234B8CF344AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591f36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591f36.TMP
Size 3KB
SHA256 d21c04039a9d5d307b268bd33fa018772af69b4cd96b00771d16c571fa55ab05
MD5 cd1313033d0fcb6ce04b58164062cc3e
SHA1 256c164e2dd60c058abccf419f456d1b33ddcaa1
SHA512 6b744efe80cb58879b0e7a5d6461cd0c34dd317e492b151e28b31b2470c93b5411833a997126fde7f1360d87ff2d44ef0c5004217de10e6f1e275a3081996175
TLSH
T106619282A74343ACFB6B603181D928CF3E31554A418B2F2AC5E4D234B8CF344AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 9442618cc373e7c3d4591488856f2514306f3f497c0566c2b3c7c6f368f0bb4e
MD5 06d2e33a6bedb93e9defc72336af27aa
SHA1 721b990268af3c85ee8dfd668e283f6e80aaec53
SHA512 291963201c84ceaaf28f83f918e48243c057a4b9c133446a450819019916ad3b8ee36027d3569ad29beb0f5adafaa3ea5607a5a3d80eea4a1bc55a341f034bf9
TLSH
T1BD117DF3C3E585AE891516F09A24AE1BCE1D0505421C7C5999D4EF2BD3E3075D00259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 42e1d3701c3421e0a47c8d7dd38f7eeb55a830e31c11c7c678fab133c72c92d5
MD5 d6a0cde16f273a136f66a670f0f8c786
SHA1 0dc60a5edf06a18bfd16f3a6c4e040019bf83898
SHA512 87aab8509b10aeb722962f1ab2760a78187755fc1b1b6c88d98247dda6a58bce572eaf6d0c455e0d538b94e02b49d95d618bd9fcaacfc5dda40925dc0404bb27
SSDEEP 192:sxZ0R3Wc/fYszTIJIdpdTHW6+WNGYaQtEIgrJ:sxZ0kc/fYszTIClHbG79
TLSH
T1A612D8116E68A97B8CC7D20DBB25BF53D6F9103251D51E88E6FC961C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 217628f52a6724f514c60677cde97e810fa60db11c07b26446219a1f34774e8a
MD5 04116de8a4846574f99b641c063bbc79
SHA1 b671fa1b304ab2bcefd59a509369ff6a357a12ca
SHA512 0d068ba662cef22ff745f6bae54f601ed5a4d775e5fb60fcba0f685e92deee5d61dbe3e9f6387f1a4f9df3516343659a86276e2c7067ab8c56eeff9c4588f804
SSDEEP 192:sxZ0R3Wc/fYsgTIJIdpHTHW6+WNGYaUtEIg5zJ:sxZ0kc/fYsgTICzHbGf7
TLSH
T1AD22D712AE68A97B8CC7D20DBA55BF53E6F9503251D51E88E6FC861C05E7ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d3bbe01552be99ae073a7c1a0ed27a0de98b4b9932362f308971fd31d5b1606d
MD5 4d96ef27a76a158582c8cc70ef8ae1f8
SHA1 4cb756a7ab1e3274dcaa5de954450a307df4d7e9
SHA512 b182ac6cdf7fe089a9e3d31c7a421b375b6d60efcdc1572baa30903521db7b4e970ff35fee0504310aed117da6222ebb5f787b4e7e38c58129969e3b0493083d
SSDEEP 192:sxZ0R3Wc/fYsgTIJIdpdTHW6+WNGYaPtEIg5zJ:sxZ0kc/fYsgTIClHbGW7
TLSH
T13022C611AE68A97B8CCBD20DBA55BF53E6F9503251D51E88A6FC861C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 62bf9cc53346596edac842251b04ad6f17cb3ab044d996ca2eb1a055bfddcaef
MD5 2a1128726cbc8c5dd0228aa3672beb24
SHA1 438460d30a77dee6e3747f9d74dbaf48e2f66b6f
SHA512 7c69e9e12441434d235245a829b666aa049e59d24b13e6214898cf03db3a1cd937964e9cc366b4cdd8a47331102c6d27a15f94a1adbc9737d6d7b5abe934830c
SSDEEP 192:sxZ0R3Wc/fYs8TIJIdpdTHW6+WNGYaQtEIg5JJ:sxZ0kc/fYs8TIClHbG7V
TLSH
T1A722D811AE68A97B8CCBD20DBB55BF53D6F9103251D51E88E6FC961C09E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ad47449a7335c6405fa679276b7b131175e2be3708a3545bfb917e53652592ad
MD5 9b4902804253749b75e656266f72e5c8
SHA1 d5d8a87459ff23a1ec276808a71250a1fe69e3a9
SHA512 fbe6f1d60260af453ae983488ede1661ae29381f3479e13b5b2cd9f3c096947fc0a9b97608c4e8ffffd34313bf9c47af6cd57161f9cd7d05ff7db69e00aa137f
SSDEEP 48:K0b7b+b/bbblbdbdb+bbNbgblISb7b+K9bL1bJb+xbTbuYbIbZbrbfyLNsh9P7/d:KsAAK9aCK+wKvaoXeKwgG29qKG8n
TLSH
T1EBB1A011317B0350387D399C94A49A6F568132B37454EF2B7B7900BA8E6BE085EFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

115f79c3-bd40-4568-9958-7381fa84ed72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\115f79c3-bd40-4568-9958-7381fa84ed72.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1673467ce9fd09b2684cfe5505c05f76902560e1984ca32c33a8534df7ed6929
MD5 b0227cd08553b42ccfef58b115dd6fd9
SHA1 f6312f1eb8f5a69c62d4166441fcbe04732f99f9
SHA512 103e15ac20cd9986c6972bdbd26bc66247a54f4adec3b3db78f8ec75565314e201fe312572395bae65c966434040c3a67882c7ef625cb21ee436fcc5c25b6425
SSDEEP 384:4ZcIhsNNbX4Y6Dp5u8iGlsxwiztgOIwZOyfHo1:GhFrkGl2wizXs2i
TLSH
T12C828D3258B86CBB6CE7E615F54B72179FB88067A7C86F8498DC672D01EB598030BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 12b4609e2a1409c074a711ae600779c58968a7d04f9ca7c43eba8f5afbf90d3f
MD5 9e42c8355543cff0804c415cdf1ae0ae
SHA1 56fab5aecef3bbd88bea2583f6a23f1e4286b8e3
SHA512 fa8100feb2c23a1595c22055e683178313df5341f07b12b88508b5f04543430bc15d1a47767f78d748bbd3594fca92270a3ceebf77cd8450508921bd65f13315
SSDEEP 384:diFiZcImzsNX8TUNTUlIl2X4Y6Dp5u8iGlsKwiztgOIwZOyfHo1:UFQW2wgrrkGlDwizXs2i
TLSH
T1D3A27C3358A89CBFADE79B45F54B32138EB84067D6C5AB94E6DC661C01EB5D8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85615164848e6a1e943cf254e65eadd1e654a237b3083a4afa534fbffddb41d6
MD5 b6eee8da98e9ec824081da5c96413fff
SHA1 aa035489d0754ec8822923deb30dba1144cdb1f1
SHA512 8131127cb87a85c0454655db64b6ee91b0387eaa15b8ad32ef4080a0f64cf35652f84208c7dfa6cf6174c4f82c24038f5d853ae6625e1376d903bb8d61206d64
SSDEEP 192:SONs6iDCQmiUye+Hq5u88PGquhMSqwWVmU6:SONs6/KHq5u8iGlCwvU6
TLSH
T1E902F9386C787CBB9DE3AE15B58777279FA4013BE6941B84DAE8162C01E769C1703933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0daca85722eb4077563fd042395b0a43c03d976be7ccc04a48f207e01b2a84b0
MD5 215ace1d3288a34ea7e16db14159a000
SHA1 99e5b77fe029bf69e5e2461c06279f2dcf5aa708
SHA512 664e9f0e5e552e07828dcc25be61c8da6e72467d5771d2d249362aade036553fe0bd6d027bbbdc97bd3ff50530c39dddb49e51be958ada365a61264372d7f33f
SSDEEP 384:GZcIhsNN2X4Y6Dp5u8iGlsxwiztgOIwZOyfHo1:UharkGl2wizXs2i
TLSH
T118828D3258B86C7B6CE7E645F54772179FB88067A7C86F8494DC672D01EB598030BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 628e48a52cd796e45f420bf22fa7744d3cba4d07ddc7888056dc20133a249d3a
MD5 b56d303edacf08a7337c2b5d3b965461
SHA1 51b6316177b07490c77332d72ba13b5c8d8343a0
SHA512 2a3abdd98ae9fa8123f674dc539c4a5d05ec40f27c8b84bb5894eea42ea5edfb5cc13e72554faff91aa317390b33717b4b1d52261a5dbd482b5c8d4854fd3cc9
SSDEEP 192:SONg6iDfQmiUyW+Rq5u88PGquh635uZwEq4zU6:SONg6gsRq5u8iGlswwizU6
TLSH
T135120A3568787C7B6DD3A961F44736139EA8413BEBC86F84D9DC262C01EB69C170B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0c37b1-2414-4269-b21c-83dbf82e2118.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0c37b1-2414-4269-b21c-83dbf82e2118.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 44bb40220538711fde4f737097b1b2feb4c4515ab96eac7dcf85cb35da95f8ff
MD5 423be99d9e49fd6c3997a8690dfbcb85
SHA1 6d4444bc1ce1279fdb34818cf763b3cea7cf9f87
SHA512 9c4122bb113d67c52efd9ec978292b14fcc514147219c0d288a2451920f0e7425bd36be3067315261976578b052a3cd5a13fa848814dc6c7313d26074c2a1074
TLSH
T13D410958B6EE1158B3B77E5A9BF6A86D487ABC372E0AD05D00110D4E4977B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download