ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-xt892sgc46
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{EA7D5323-6CBB-4FDA-943E-8712D83CB416}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4484	4764	msedge.exe	86
PID 4764 wrote to memory of 3876	4764	msedge.exe	87
PID 4764 wrote to memory of 3772	4764	msedge.exe	88
PID 4764 wrote to memory of 3772	4764	msedge.exe	88
PID 4764 wrote to memory of 3772	4764	msedge.exe	88
PID 4764 wrote to memory of 4032	4764	msedge.exe	89
PID 4764 wrote to memory of 4032	4764	msedge.exe	89
PID 4764 wrote to memory of 1720	4764	msedge.exe	91
PID 4764 wrote to memory of 3808	4764	msedge.exe	92
PID 4764 wrote to memory of 1720	4764	msedge.exe	91
PID 4764 wrote to memory of 1720	4764	msedge.exe	91
PID 4764 wrote to memory of 3808	4764	msedge.exe	92
PID 4764 wrote to memory of 3808	4764	msedge.exe	92
PID 4764 wrote to memory of 4496	4764	msedge.exe	93
PID 4764 wrote to memory of 920	4764	msedge.exe	94
PID 4764 wrote to memory of 4496	4764	msedge.exe	93
PID 4764 wrote to memory of 4496	4764	msedge.exe	93
PID 4764 wrote to memory of 920	4764	msedge.exe	94
PID 4764 wrote to memory of 920	4764	msedge.exe	94
PID 4764 wrote to memory of 5032	4764	msedge.exe	99
PID 4764 wrote to memory of 3304	4764	msedge.exe	100
PID 4764 wrote to memory of 5032	4764	msedge.exe	99
PID 4764 wrote to memory of 3304	4764	msedge.exe	100
PID 4764 wrote to memory of 3684	4764	msedge.exe	104
PID 4764 wrote to memory of 3816	4764	msedge.exe	112
PID 4764 wrote to memory of 4812	4764	msedge.exe	113
PID 4764 wrote to memory of 3712	4764	msedge.exe	114
PID 4764 wrote to memory of 2236	4764	msedge.exe	116
PID 4764 wrote to memory of 2236	4764	msedge.exe	116
PID 4764 wrote to memory of 3924	4764	msedge.exe	124
PID 4764 wrote to memory of 3924	4764	msedge.exe	124
PID 4764 wrote to memory of 2780	4764	msedge.exe	127
PID 4764 wrote to memory of 2780	4764	msedge.exe	127
PID 4764 wrote to memory of 3272	4764	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x2f8,0x7fff50a6c188,0x7fff50a6c194,0x7fff50a6c1a0
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,16591058259449076226,2138919563228970637,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7511348563558287548,14894608538298195839,262144 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,16333091559826595610,14932704523532620954,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,141613083756212696,1069300698757396871,2097152 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,8156077208382145096,11308727282572113227,2097152 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,16985243999483921935,5355570125423428977,2097152 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,7627937176595207398,13662042816758121451,2097152 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,10905182576744972215,8721740541536826152,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,4731708644032638233,2264735778824313605,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,6455766300424500222,11768562399389643329,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,6455766300424500222,11768562399389643329,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,6063597706854988638,167925960595876572,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,7692794596326128439,16236727687068098644,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,13029923774767932387,324412791665417079,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,1108171817717765841,9016092203648099265,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=904,i,7179399445437638312,8360350685920202935,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5526029294026887254,10594572342280905688,524288 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6096,i,4011631161371472496,2589038219773464322,262144 --field-trial-handle=2080,i,16169694688975534151,12539857387875324376,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6fbdc400829591fc3f2a3bce0efd67a865571ed51069384e49484345eb537bda
MD5 2936e91cf86d9212e1e41679acc82040
SHA1 49359fff67e4a03eead7b7193ba66b14c23a1f98
SHA512 80050e673f55d50ac910108275a6126b25b5756cf3dbe19a94b67d58670c752b5a1978ad99b244250ffcf54e6c5241beef23b45411ec2c620761f6e30949a7da
TLSH
T125E026C596CAC36EEA40745B4278CF8CE2C43B0BD3CC6E4E2B00898AB641840E7D26F1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7b126cae67ed25a43c6fe9cdd1c340c954cb4a9f7fd20d8850aee157ab71f7f9
MD5 7bab7ae0e16ec50f0e34e49b5ef4a66b
SHA1 76a315bf4559f3d4ce9d6188e8d84a714c174394
SHA512 757f3566b1e9923dadf270eeb7054e30c48406f874b3810bd19df8ef465350522e32c9fc6f30418ccc8d55a44f74cede5a5fa3000b2306e7637d2f9db2cf62db
TLSH
T197518384954DCBC0F3EA4CB146D9478BFF32318447A7BEA632A8DBBA5456764C2300D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e4e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590e4e.TMP
Size 2KB
SHA256 0a1788bc49c06db85ea065f54215384fb735bb801782402bba7ded3907778fbb
MD5 8ca9201d4d995055a70c91afe1dd4524
SHA1 6651c52fbb2262c3fef28c4b4f3262fc758ac47d
SHA512 f50ec3d53b042c3cc0371c0e12c91d78a0903f602c0e3876974f767ecccfb4ddf24c537c9dd4b204229bb3a67afc46859ffb7e1452f8ea37a3c9f1ec6ed4dd4a
TLSH
T146516585554DCBC0F3E64CB145D9478BFF32358447A7BEA632A8DB795456754C2300D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e16fa122ba099e2d692c244e9856f253245489264b66228dcfbb3866cb5c7fb4
MD5 577904bcbcd66518bf8c6f701a3d739d
SHA1 3520fdfdbaaaa7fae6912886eaf96b1405afcb16
SHA512 84e38922cbedcd6fa0a59e12c4068a7ed23b2fc38e2c90c605b93eaabf8629cf4fb5f94d18d3c497880ead89316ee6e2e1d66caacda404a62ad1a34febc325e4
TLSH
T1E7117DF3C7D585AE891116F0AA24AE1BCE2D0515821C7C59C5E4EF67D3E3075E00159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8f8027b5dd102634442d87867db5cd85db6ba13c87f809e9f13fc308d3c9d807
MD5 58913954c43d93a0a7b338e1b2fdfedd
SHA1 5f02e5fd1807657db555d1bf97d0c853b7ed5f2a
SHA512 ccb4e14fd975b201cf8bc6ad4ab91d7b421f5cf85f40fbf3e63abde78f38b922ad0f1aca102eeb1afc2a99d34a7db59e2a140b36fdeef11c44f32cd81caa5ed1
SSDEEP 192:sxZeR9WA/fHsRgoIdpdaHW6+WNGYYBaxOGIgrJ:sxZeWA/fHsRgZgHbGfx+9
TLSH
T14D12A6116E38A57B8CC7E20DBB55BF53E6F9503261D41E58EAFC861C05E6ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8ef6611fe27b9ed95c9e9bb7028b814cb766fd0a11c07635a3cae4e31b5f085d
MD5 3d0d5e7f174094414227991b01fa67ac
SHA1 3f98fa9c1a5d526da3d7928c17391bdca5dc0401
SHA512 d8d69a5b57ee10d0d099d5c4e2b1bc6568a35e0e1205fc88625c986a93ca0f072b8c17d4a910869d4ddce00d6d10584046b3d191b35db5b0d581aee07bf1037e
SSDEEP 192:sxZeR9WA/fHsaroIdpHaHW6+WNGYYBwhxOGIg5VJ:sxZeWA/fHsarZ6HbGfwy+5
TLSH
T12C22B8516E78A97B8CC7E60DBB55BF53E6F9503251D01E48AAFCC61C05EAACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8410d98c74b38c795c1d8df616afd5c3e04371de8fce9bca98cfbf1caa18d467
MD5 f8de976fa8ab69a29fe7ea7ef4b24940
SHA1 90a9a099474a355f94f00e44bc060e5005e0414f
SHA512 6a53a3cdd2de1aa29920bf602346cfa67a41382fc5668389d4b59ddb0caaf92c38d0b7e487b0adae94d21ad73e435c34ab822bad858764215941178ce1ec1ae3
SSDEEP 192:sxZeR9WA/fHsaroIdpdaHW6+WNGYYBrixOGIg5VJ:sxZeWA/fHsarZgHbGfrJ+5
TLSH
T18522B7516E38A97B8CC7E60DBB55BF53E6F9503251D11E48AAFCC61C05EAACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 834d4a52ccb047f1c6b1cd92a0d24b909c7d71f3cf0c37d3bcfefb463246b588
MD5 2c266ca565983ccc6a8d99adf85709c5
SHA1 a38ef6737833c2b87aac7ecab9fb5bc660eb5d2b
SHA512 f3acab52f626f3464a57d97568144a99a1f044961b45c8e6b5edecff15e31e6bb218497641d2d20784238debf97440d3aa832824a4bf7753510354c1d11ec88f
SSDEEP 192:sxZeR9WA/fHsagoIdpdaHW6+WNGYYBaxOGIg5HJ:sxZeWA/fHsagZgHbGfx+H
TLSH
T14422B7516E38A57B8CC7D20DBB55BF53E6F9503261D01E58EAFC861C05EAACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 92b08d015290800a142eb72eacc508a2eeece72ad4f6093550f209fe3b56cf04
MD5 3d9c6ce6e8dafdccaf3ad5e77b9e6f52
SHA1 4a278cec5c5f8122e967efc65ce8e30aaef00b11
SHA512 cea8e89989b88f47a37c937fd2700b5ad24335d278c6e574456cc671a9c33257f267057442698f25df2187ee88fb30f861a88a660c8c75e79a5849c0f7b1b427
SSDEEP 768:IFyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX2ropy4xa:IFyYR7jWv3NpBu1ja/CL8OXN8
TLSH
T1B1C2E93B644DCB7E4FC01A9DDC5A6F973E9802C7A6548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec53a1efea195ac887009116670fbe0418ba04397e195232991613c9fd03462f
MD5 fc23ed89431505176a2bc67c1c3183e1
SHA1 19ae1a598216ef552c4c9eb267c3c28355ffabb5
SHA512 dde20f5718dc34a360e6d6f8406fee5f4e06bb7d77aff4a72269f92ee705cf04f7b21bc893a949545a02a9c94562637c82f435385049459569b7515b2dbc7816
SSDEEP 96:KhrANJD1l1GBqIEh1KMEET1IeyMKHqeO/KKYUHoAKJ:GrANJD1lkBqFhHEETSDDxf
TLSH
T17A910251317B060838BE2A8D80B7871E52427273705CEABBFFBD40614A6AE485DFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a8c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a8c9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3d434a929b457929c6181a3469b197c914c5e4a1f2d2f921c6556f729abff93e
MD5 1ed64088a18542fc0b8ead5882c996b3
SHA1 57c8a056046388c84d47467572710e8ba47e9f33
SHA512 401ec8a645b5a262ba66da1ab75eeb47dfc669438b30a1c98786fbc0b3775d16221aae194caabebabe4b72245eb79d52cc415023c28cc6d3f1c841c8af6c8c4f
SSDEEP 384:xZcIhsNVYgicK/0QX5+DtCM8l/+Xv8rjyHmXVZh6DKhH0log:ZhMi3kDY/u0rjMmXfYGH0lT
TLSH
T1D2829E32ACB46C775DF7A282F48635039FF45063D6886BC0C6FC6B1D00DEAA52316D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 06e995ef525903dfde6c947af1f8d2502637a6aa1b3aa552b4ef481354ec1696
MD5 25efa46e81e61e17b2045abe989242ed
SHA1 eb7685e58865ba3359e90b1d78f5b3840c963b08
SHA512 95dda2013820b6f3d406df24b4f29effe808c7b81b2e5157c04c2d42a820aac2298224d522fbaa52496d040b4a821aaef4ff1b808ec3c981798f1378931b233e
SSDEEP 384:T/iFiZcIxzsNv8TUNTUlIlPgicK/0QX5+DtCM8l/+Xv8r/yHmXVZh6DKhH0log:mFQBawgqi3kDY/u0r/MmXfYGH0lT
TLSH
T1A6A26D339CE4D87BADF69B85F54A3603DFF45063D584ABC0E7E85E1D009A5D8230AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8216fe5a540f3b77381473f967f1c223443d3abc622b77d641c88d53d927997a
MD5 c5b19d788339d4984d56089b8db17a75
SHA1 135b5541df8df5938d059d9a55e4387ecdf9fd53
SHA512 c4f07c916a069358853f2cf07323734176d34f1857b25f23873d67ff95ab86758e255ecc1bbcd09d20cae183acdf1358c0148a0275d134944fad2f23a2be7627
SSDEEP 192:EONq6nnHGQmiUyf5QYcX5hQDP1C8jzorqo/qMcyHZp4U6:EONq6nC+QNX5+DtCM8l/SyH8U6
TLSH
T17C02DB35ACB87CBB9EF36E46B48632139F94212BE5942B84DAF85E1C00D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ec0cb440bbf583b8b2d823bacf4d107e0e5a3e40bab22467d1f0b80f27a527ee
MD5 08dbde7fd9917d14cb5fa971d2b51e8b
SHA1 3e3fb21f30db10755e004b4b4738eca25d81faeb
SHA512 ad5e2001f2fb3bccfccc4c4fc5697347b52c960ee9e947dfaed9f64e5ee9adb16668a08dae7a440c24a335cb1e9fc432d4e5164b024f5b229b80b98d11545267
SSDEEP 384:UZcIhsNVPgicK/0QX5+DtCM8l/+Xv8rjyHmXVZh6DKhH0log:ShZi3kDY/u0rjMmXfYGH0lT
TLSH
T154829E32ACB46C775DF7A682B48635039FF45063D6886BC0D6FC6B1D00DAAA52316D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77bf93c8b41250fe366496fcc791f7c1205e03363442e3970ed83af2bc20ec9c
MD5 9222023de3cf6ff7c62719c0efb4988d
SHA1 3116ef69c48781e0ef8c864c4d4cb38c606c19a0
SHA512 de1cad7b9788fcee48ff2313e09e8019c4c27c0633bd030536424011e5cdb41ce9d09e5f8341e21d883865201413dd83d4ac6200fc3e96019cf02e10961cb5a4
SSDEEP 192:EON46nnH7QmiUyT5/UYcX5hQDP1C8jzorqo/+XEcFfErjg3yHVq5XU6:EON46nNI/UNX5+DtCM8l/+Xv8rYyHmX5
TLSH
T13B12FC31A8B8BC675EE36595748731539EA51127DA487BC0D6FC1E1C01DF66C230AD63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2dde3a3e1def5eb4077ede1c5879c2ac8a2d11226703067976cb72b3abe96801
MD5 ac0774e79ac0550ca925589ce3ddb1db
SHA1 1f1ea4ce4777869ef65c1ccb8cd4db7363658405
SHA512 251295b289e9632c8cafbec7c199fe99e059c5ed419c468583259d4f5242ede5a8855ef9d080c403f2ffefc119d74cdefa3d5eb4002682a54727e34f275c965b
TLSH
T14C410958F6F91148B3B76E4A9FF6A46D487FB9772F0A945E00000E8F0A22B41C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download