ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-xyn5nsxtas
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{FC1123BD-77B9-460D-A414-4D6AF29F898E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
176	msedge.exe
176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4688	1308	msedge.exe	85
PID 1308 wrote to memory of 2652	1308	msedge.exe	86
PID 1308 wrote to memory of 4884	1308	msedge.exe	87
PID 1308 wrote to memory of 4884	1308	msedge.exe	87
PID 1308 wrote to memory of 4884	1308	msedge.exe	87
PID 1308 wrote to memory of 1516	1308	msedge.exe	88
PID 1308 wrote to memory of 1516	1308	msedge.exe	88
PID 1308 wrote to memory of 4496	1308	msedge.exe	90
PID 1308 wrote to memory of 4496	1308	msedge.exe	90
PID 1308 wrote to memory of 4496	1308	msedge.exe	90
PID 1308 wrote to memory of 2072	1308	msedge.exe	91
PID 1308 wrote to memory of 2072	1308	msedge.exe	91
PID 1308 wrote to memory of 2072	1308	msedge.exe	91
PID 1308 wrote to memory of 3240	1308	msedge.exe	92
PID 1308 wrote to memory of 2864	1308	msedge.exe	93
PID 1308 wrote to memory of 3240	1308	msedge.exe	92
PID 1308 wrote to memory of 3240	1308	msedge.exe	92
PID 1308 wrote to memory of 2864	1308	msedge.exe	93
PID 1308 wrote to memory of 2864	1308	msedge.exe	93
PID 1308 wrote to memory of 3584	1308	msedge.exe	99
PID 1308 wrote to memory of 3584	1308	msedge.exe	99
PID 1308 wrote to memory of 4940	1308	msedge.exe	100
PID 1308 wrote to memory of 4940	1308	msedge.exe	100
PID 1308 wrote to memory of 1952	1308	msedge.exe	104
PID 1308 wrote to memory of 4896	1308	msedge.exe	111
PID 1308 wrote to memory of 2208	1308	msedge.exe	112
PID 1308 wrote to memory of 2564	1308	msedge.exe	113
PID 1308 wrote to memory of 1336	1308	msedge.exe	122
PID 1308 wrote to memory of 1336	1308	msedge.exe	122
PID 1308 wrote to memory of 176	1308	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffbe741c188,0x7ffbe741c194,0x7ffbe741c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14023112976685722320,16714722508899911394,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,16570896425445022123,6962293212525743443,262144 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,9426345445741569880,2347198575082074217,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,4355182138112971247,2923438253830208502,2097152 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,1303306299520916267,2930652443649401798,2097152 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,10221347185476396175,10626977855399228305,2097152 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,10214275331674815231,8951287619738094315,2097152 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,7417806564749890720,5188048485206861442,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,13400978689656928531,24752733092589216,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,2936814027132580553,10441953869573951603,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,2936814027132580553,10441953869573951603,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14814095450993912676,17854417217039747385,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,4260755056425412121,14525036021641963238,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,7167090287355448888,18251485813035522532,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9101121559439358542,8109469084028404993,524288 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5444,i,14688720014344300186,11188769225113788169,262144 --field-trial-handle=2116,i,10754307995856687603,2499377755196299442,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3bbe5786e302158db6e622f1eae15f0e886f14a0134321ba7bc26e5ccc663599
MD5 ac1af26545e0df57290681bb0292f929
SHA1 ad5865b9f6ffd89566c9ae7ac058c2752b636fc5
SHA512 5c382aeed04c8a3fb79b08a49a1cecdc16235f2579aeb36a7f4d22cbdab216731d12c7329843c0d9e93f33a8d4967fe01be98f931999e88f8400d30cc73dd1eb
TLSH
T1816183E8915A5091F39C40F376F7088F3E32B64AD9A31D3EA767D6E4BB097B4E1A1040
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c5da752556d7c2171854b89847f1191df1f4016965abe956be799045a043fc9b
MD5 c32b32170d8e647d9af02c623efbc40b
SHA1 483f3ce12db9da583623ae47b67ac5da136134d3
SHA512 3e8628db29ae073a0daab0fc396a686a6b33cf46ecd48ff81205d276b3b08c7d9e67dd2d4bf4f934ebfd7144caa566f95a6528998ad44aa7f6c08f0913849c4f
TLSH
T1D3117DB3C3D585AEC90116F05A24EE2BDE1D0906422C7C69D9E4EF2793F3076D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7bcb3d364ffd345e6afd12843481145971665291ccc09eb4f2d8c0da8672a98f
MD5 91018ae64e9a0e6a91796feeef4f851f
SHA1 3945b064efee298ce3af815f4c61b372a99a064f
SHA512 1744013a7016c444052eb209f6fb309ccaa81983e4e2c67f05b4f27360989b13a16bb33cef1b4398ff0bca5a10bdd69d6e0438c8183c0ea3c44e5355874b8cb3
SSDEEP 192:sxZHRFWJ/fOsl8IdpdfHW6+WNGY3R2RIgrJ:sxZHqJ/fOsllRHbGB9
TLSH
T1E322C7516E38A97B8CCBD21DBB257F53E6F95032A1D41E48BAFC951C05EAACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6a39e0314d2f05194ad19a15a30b878ed61aaf0dcf2d262551bfac4b521ce89a
MD5 5afa4ceb8faef5757dfece5405a61a6c
SHA1 4f257fa7329ae2353cbcfebcdbae7b81fbeb846c
SHA512 4d23686fcad8e8c3e36ae711ccf3c21c5ca776ba1b3e97419d09daac1db761e6855ec142df8e5a1adc44d4ff71fe25e84518d69ef9796e0ec91d992ad3d6780f
SSDEEP 192:sxZHRFWJ/fOsGd8IdpHfHW6+WNGY3M2RIg5mJ:sxZHqJ/fOsGdl/HbGGs
TLSH
T11C22D8516E38697B8CCBE61DBB15BF43E2F9503261941E48AAFC861C05EBACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9ea585f92105a4d10ce2310bb4daa9b3e87078bdd5c49049c685599a3806ffa4
MD5 21237070c5f5be52b8feced00c8b2ed2
SHA1 0d7b84c38d42e11d69a02753c19470263809b6ec
SHA512 3b85fd56c910b13e283e793e6a49119fac502b1ee2b251fad00e4183c4914e531b942f5e3a41da4e20c965075ea92638ebe99b504c104c6a14b85bc11e531892
SSDEEP 192:sxZHRFWJ/fOsGd8IdpdfHW6+WNGY392RIg5mJ:sxZHqJ/fOsGdlRHbG1s
TLSH
T17A22C7516E3869BB8CCBE60DBB557F43E6F9503261951E48AAFC861C05EBACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 26063c3bfd2bb03444277b73db23d1bf51b274dd5cc9a9f0afd77b3552876ca7
MD5 cefe1a73b507ff0e304ab46170adda9c
SHA1 44bc3441a2852637e5096ba18f4bb575f12b7688
SHA512 2260307728fb066bfab2ed28701347afd1976237dfb5ce552e339894dbdf1592817a469be2b461c5a3034abc7e2f56ec701dcbcaedfe8b3a08cf8bce39352374
SSDEEP 192:sxZHRFWJ/fOsf8IdpdfHW6+WNGY3R2RIg5EJ:sxZHqJ/fOsflRHbGB+
TLSH
T1B922B7516E38697B8CCBD21DBB55BF43E6F95032A1D41E48AAFC951C05EBACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3df0a8b85a8a677211c1a264ee15500f14d6461c9d76b11e650b135571311172
MD5 cdd113b94e7ba5169af863e07ffaf73f
SHA1 0f766d4f4b7b52c34626984fb97906e6452dfa1c
SHA512 c09abb9d3e280fabebe6c0476d57afa20e1a06140c226c8cc7de93f5efc553e2dafc86eaf9f6afa342492fa6ce2f6d546ad692352c516325f19755daf2049760
SSDEEP 768:OC30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72xrolZM/2:OC30AbSWvS2l9u1jaLmLZ12KS2
TLSH
T161C2DA3B640CCA7E4FC01A9DDC6AAF9B6F9C02C796648D4447FA944C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8d4c540621844c883773d4e2e3ba93f9de80d54f38d681da5cc20e7fd7977248
MD5 a554e523381a9c9d80dcee5b8428a30c
SHA1 a7cb9bb18fbce3feac06bd5c21d770d056807f25
SHA512 2247bf637c3117c98cace8c702e0208e09d90f1cc964a134c7c32303288bafe6265e2234d5bce9b068b3757bb8f305b94246fb4e2d101d6a018aa3ac74c89078
SSDEEP 48:K0cLq2EGqTba5iISuTK9K1oTxMDYBSqLyLYH+CIyWXbOVOISaXK921sXxgHYd+aD:KYrCKYwx236KUYzdiKeES6z
TLSH
T1BE91EE45367B1280387E294CC579DB1E428131B33018EBBBBFBD15A15A2BE184EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cca6ce94-f90d-49b2-9a31-f34560d825bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cca6ce94-f90d-49b2-9a31-f34560d825bf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 397f77598503f414e5c319f68a85f6408a1bde49e8cd16dd5c94158cf9e30f43
MD5 28746a2dbd9b504038a92d3b374cf0e3
SHA1 a50eac250dbc16cea0e12858f586b531be32c0e1
SHA512 723ef594ae598444d70ebf80de58455686f2222e3ed30a9139500556c91878da74dcb536c5441ac5b5d73570c9573769817d961402c6b49ce453f49daddcee0f
SSDEEP 384:QZcIhsNjByyG+pupW0C9iX5FN3+HJoRVZh6DKhHxfoi:uhjWMGa1/RfYGHlZ
TLSH
T177828D3298785C7B59F6E542F4473A039FB88167E7882F84C9ECAB2D02EB5941307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 17b01ad027e99926702cdb4a64878526432a417c3a15cedec105b24144edc097
MD5 9860a21bd6f90114279de0a8c82f1c29
SHA1 326f85218e7551c04dbcb56d9fd992c22d9f4136
SHA512 6a1160ed3583aa6a1d7e1fb93b2dd1e1ac3125a6e9a2c1b6512e28101ff6d7f3c65c3e76bb1ca83574dce638dfc8c704e46fd362701d6352c5a336c8b80764bb
SSDEEP 384:GiFiZcI6zsN98TUNTUlIlYyyG+pupW0C9iX5FN3+HJLRVZh6DKhHxfoi:tFQSswgPWMGa1uRfYGHlZ
TLSH
T163A28F3358A89C7FADF6DB41F44A3603DFB441A7C688AE94D6DCAB1D01DB0981307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7e4af0082f4060ae6a5772a5f6d47552805207fce77a7f1d995a49df30fadab9
MD5 85f3b2db81204c9ac740f509d68204cb
SHA1 9c57278c7a0b23a8f104487bd342745f337705f2
SHA512 11dbc983010c5372cf61805bfbd3192564f1a46cee46214db7b85596130c208775dcff1ad9c1a3f64ff6815df600c2673c062ab1afba086f11882d4030360190
SSDEEP 192:LON46AmwprQmiUykd6siX5FN8Y+hJi80U6:LON46ipdt6siX5FN3+WdU6
TLSH
T1BF02FB35AD686C7B8EF3AE15B54B3B239FA5117BDA941F84CAE81B2C01D765C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 29d8fbc0cb08ca239aa005cba0d925696cde6e584d09c6fc56410b0f8eb71540
MD5 d5be04317edccfadff94924769dd9f6f
SHA1 ac663c96ac4b61d106e0f317a31c8e6982311d83
SHA512 b7dcfe6960a33ca3381469fae6e7d3bcd66d4708bfc3a6008b9afabe6b1593abd44a7458cb5c42b6b75f1e7bee9d38ea4d8b2ca4f585c21f41fe87841a2527ba
SSDEEP 384:TZcIhsNjYyyG+pupW0C9iX5FN3+HJoRVZh6DKhHxfoi:LhkWMGa1/RfYGHlZ
TLSH
T165828E32A8785C7B59F6E542F4473A039FB88167E7882F84C9ECAB2D02DB5941307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d724d9f8446d6156a858b5c2cddf018642735929dde0cabf80d7b85aa6ffc1aa
MD5 a8bcd673ee111a36fa20f5e2c7af314b
SHA1 a350f14eea31a4c358c907b197660a032060cf17
SHA512 66b91c35e1f7b47159c41eb100360fde1ccf73ebb0b29f5d60325283395c6daad15569de56ef6430448d9ae1bce5e4afabc24c4d492eca9dbe7f2057b7592d32
SSDEEP 192:LONm6AmwpaQmiUyLdesiX5FN8Y+HJU6JlR5qUU6:LONm6ipWsesiX5FN3+HJtRU6
TLSH
T1E3123C32A8786C7F5DD2A551F08735139FA4526BEB883F84C9EC272C06EF598530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eef5ab2f-7f75-4be0-a6ad-0937341ea5fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eef5ab2f-7f75-4be0-a6ad-0937341ea5fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eddf4b2e01a6550c5dc852bcb12a17e60a60b6458ac42b8ec0fbc8d95f3308db
MD5 23be746a177eb1b27a51fbbad80f6142
SHA1 89b7c47853fb2d194886330b362f59f56c39ff7a
SHA512 19b439d61c539253283a8b20420aa823061e076e315ae34fc6df36b26935d5b22b92407600ca5cc227de878619cf807deafd25fa396debf243a8bacd64efd3c0
TLSH
T18F41285CB6E91148F7B37F5A9BF6B86E487A78772E0AC46D00120E4F0A23A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download