ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261001-mx374axeqa
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{C6CD1DB5-6E35-429B-9098-EB4ED1D9ED82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4008	672	msedge.exe	86
PID 672 wrote to memory of 2332	672	msedge.exe	87
PID 672 wrote to memory of 2612	672	msedge.exe	88
PID 672 wrote to memory of 2612	672	msedge.exe	88
PID 672 wrote to memory of 1416	672	msedge.exe	89
PID 672 wrote to memory of 1416	672	msedge.exe	89
PID 672 wrote to memory of 1416	672	msedge.exe	89
PID 672 wrote to memory of 4408	672	msedge.exe	90
PID 672 wrote to memory of 4800	672	msedge.exe	91
PID 672 wrote to memory of 4408	672	msedge.exe	90
PID 672 wrote to memory of 4408	672	msedge.exe	90
PID 672 wrote to memory of 4800	672	msedge.exe	91
PID 672 wrote to memory of 4800	672	msedge.exe	91
PID 672 wrote to memory of 2452	672	msedge.exe	93
PID 672 wrote to memory of 3544	672	msedge.exe	94
PID 672 wrote to memory of 2452	672	msedge.exe	93
PID 672 wrote to memory of 2452	672	msedge.exe	93
PID 672 wrote to memory of 3544	672	msedge.exe	94
PID 672 wrote to memory of 3544	672	msedge.exe	94
PID 672 wrote to memory of 4916	672	msedge.exe	100
PID 672 wrote to memory of 4916	672	msedge.exe	100
PID 672 wrote to memory of 1348	672	msedge.exe	101
PID 672 wrote to memory of 1348	672	msedge.exe	101
PID 672 wrote to memory of 4852	672	msedge.exe	105
PID 672 wrote to memory of 900	672	msedge.exe	112
PID 672 wrote to memory of 896	672	msedge.exe	113
PID 672 wrote to memory of 2280	672	msedge.exe	114
PID 672 wrote to memory of 780	672	msedge.exe	122
PID 672 wrote to memory of 780	672	msedge.exe	122
PID 672 wrote to memory of 4088	672	msedge.exe	123
PID 672 wrote to memory of 4088	672	msedge.exe	123
PID 672 wrote to memory of 4276	672	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffec6e6c188,0x7ffec6e6c194,0x7ffec6e6c1a0
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15684843531865828165,6172367626920668188,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,5372175162585628165,1700687370708856323,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,465105571053674424,1581251768380333503,262144 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,11677564302341244143,1743815990248718072,2097152 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,7922421027910446369,1512797574220685909,2097152 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,7861018643004129862,9104319477966487907,2097152 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,2675298244926681372,15098709737325213364,2097152 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,11980602611565149013,888270627333105738,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,11615628230813166553,5788023425766161430,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12084499411322252469,14059361649138307073,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12084499411322252469,14059361649138307073,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8638988779431739400,2435103885595746913,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,11017365666823907681,12439921276107079948,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,14942078559254092034,4968989159913938492,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,3727765379963721090,3678247534943800609,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5987036005290093154,10615901705710399531,524288 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,16089459036092142693,4531248566836841543,262144 --field-trial-handle=2500,i,8169679317901444886,6534680580479808005,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 880d3a9fd9ccad99e459bd53c9132a613d3a013b053921e37648e10c0f5b2772
MD5 3dc77254a93c3f4a38fd60d3d1c1bbd2
SHA1 6a74d6a5d428c9aa11a5f72fe60d8d6ba6f77249
SHA512 8cc45f247ba4add807ed2db3f993e252bfd949aface2a23ef26676129fd9cbf90fbc6f11a485d48b46f183d8c0597ac0083539bc48e34c2a0ecefe135db1395c
TLSH
T1A25193834A634D85F359C17EDCF15A87363089E1C3E31F4110A8C6F89A77B308B84876
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e2fa8c94257d94b72fa01ed1e97d655d51c65e6a46f07a10dc7f436ae15c9bb9
MD5 5180ea4adf9199867abb11e8d8e67a5a
SHA1 8963c06e80de52a46f8ef1d4e177dfa1766bb8b7
SHA512 dbcb9a4f0c11279b5f34ddfdde4bfdcb44de890061b300a9e04c8c6b2907c16e182451c88dcd7c8fb162f1d06ae813144771c24910a2777d33a075f43327e6a4
TLSH
T193117AB3C3E595AE891557F05A28EE2BCE2D0A16421C7C1989D4EF2B93E3075E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a8719088e1fd47dcb7f1677a478e36bab47160abe93dc52570e7e6de3e8c799a
MD5 b3cbdd20185b9d008b327aa8f88261a6
SHA1 4f081cdcb7d063e27b53e581bbe8ba535365c096
SHA512 f03fb8eff655898f553c746eee212121d4f93e1013cafa323eb9b5a506558c45fc7a9ed1d6c4f359911fdc4fc48dde451d2ab3df2c47e201cc1595fdbb9648ec
SSDEEP 192:sxZlyRSWE/fRsSWPIdpdKHW6+WNGYYBabUnIgrJ:sxZorE/fRsSWgAHbGfLn9
TLSH
T11422A6116E28A57B8CCBE20DFA55BF53E6F9503261941E48EAFCD61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 590e585c25bd1ce83d8b404361563cd93f746c7eeaa7b99da8c9e8ed14b04a3f
MD5 aad41c2c07524bbfbf5f4ef22802cd75
SHA1 deee62032e35daef7e26438cbe5af6cbb6204173
SHA512 e98b39a759ebe20151c9e98b11fc2e03c17f444910a3ccd551ee3a9e76725abdd8dc1cb8b7f470b728598c8304ed75b0b110c20b98c43a1866409873e17a0908
SSDEEP 192:sxZlyRSWE/fRs9WPIdpHKHW6+WNGYYB4bUnIg5SJ:sxZorE/fRs9WgqHbGf1ns
TLSH
T16C22A8516E28697B8CCBE20DFA55BF53E6F9503261941E48E6FCD61C05E7ACD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4e0bb803831a4215e5f5f2a4c686ea9d7ccf945ca0539ac9f46c319ea1589e82
MD5 c0aad9db0a95bb337bac4cc465b981c9
SHA1 75520ebb8c85251694b52cbaf085871f2ba8f3c5
SHA512 41890cbffcad74e5a6b4f089667a67df1d1419ececdaa820485a9e49a356926a362ff81d1e9ddcbf1061f9bf8735d8764762c270c4ae05726a955a9456c2eef1
SSDEEP 192:sxZlyRSWE/fRs9WPIdpdKHW6+WNGYYBrbUnIg5SJ:sxZorE/fRs9WgAHbGfkns
TLSH
T1A322A7516E28697B8CCBE20DFA55BF53E6F9503261941E48E6FCD61C05E7ACD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ab386224eb631ec2337a3ab01caf2ec96cd6ea2aacadf45f76a669ecb88ad0e3
MD5 a4d70f12d065cdc23366e72062ebcd24
SHA1 c44fe526f8b2502f5cf5dfe38babd5d73c96adc6
SHA512 55deafe0b701a86e30cbd4a22d51ec876dc2741713a1dfec95224ed07f9391a4e3890e452ee5e26db279f2a863667a5df081ddd3ac711c9784e23d7667482d57
SSDEEP 192:sxZlyRSWE/fRshWPIdpdKHW6+WNGYYBabUnIg5gJ:sxZorE/fRshWgAHbGfLn+
TLSH
T12B22A6116E38A57B8CCBE20DFA55BF53E6F9503261941E48EAFC961C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d237d6aefeba03e772013a8c6dcbef75dfc60db48110ecafb42a44def1c8edcb
MD5 d1a5e7cfb3940cb0f2e6dcbcafb25951
SHA1 72784604fa43ef614bd2c8399dbb19247e40668c
SHA512 01144b9e385ebb65825aed86d7317a6250891e7b14ead495f6542d58e85acd0fb7025fb26fcc19f6863c536add1fc1f7f9de06f29762dee40c1f40dd0fbd037e
SSDEEP 48:Kg6lI064I5bkjUISs5K9Q1K5xipYb8IKyLdcRtfLPwbD2jISlwK9l1Hwx1gYmnnC:KsZmKKkaKGkKDSwnCK8A6n
TLSH
T158914F15327F420039BE35C882B49A6B064135B77018E96FFFA98191CE6FE146DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adc93682-ffa8-4303-bda5-36bb08d396b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\adc93682-ffa8-4303-bda5-36bb08d396b0.tmp
Size 27KB
SHA256 7b44c2c2332d17f82dfc10f4749c195642765a3a24c4437ed408b37c5b045af8
MD5 3f82277ff91415941cd6687fa49296e8
SHA1 e3960137c4d3acec04a25163b8dc8067e3c3cb2d
SHA512 4ca2c31c3bca4d8b8a9e291b9d5a0e7b63558b614126b356397f48b1ef939e965870ad2e150a676a73648931cca5fc1547b8b4971ffd99a618a0478c3a21a7dd
SSDEEP 768:2nyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXxropRO6:2nyYR7jWv3NpBu1ja/CL8OXKl
TLSH
T1AFC2E92B644DCB7E4FC01E9DDC5A6FDB2E9802C7A6548D4047FA944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75188e33-b37d-447d-9090-67aa18895c9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75188e33-b37d-447d-9090-67aa18895c9a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 58b3ef3a47cedc0799f98b30748682171e455d424ebf7e9ae09c734ab383ce72
MD5 0fb0c3abba663f4e875494ad3d850324
SHA1 63addc8b23ada6a7fb12662ccab8282a75e55eab
SHA512 a72f7f663201ddc48710565434495d3009eb5198d225396e7b19432ce0b1e63aba8b9d3f7dc6827581030f44ac83e3609f4b9ee8e407f75bc402a004d8fae7aa
SSDEEP 384:tZcIhsN6jPO9UitU9QX5+DtP8gXC2ftgOIwZOyFLgoV:1hdkUPqkDlC2fXsmcu
TLSH
T10F828E32ACBC5C7B5DFBA584F04732039FB4A467D6C9AB84D5ED6F1C01995A8130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 1a6b1a6cfd7d5b165e8a450905224b54a07e32d2edfad853ba5c4e244127b7da
MD5 5bdff13f9c62d14a55f752389d8ac508
SHA1 1c096f4367d40941a99cf06bd98cc09a3b865a5d
SHA512 2d24d80a8160a0023924b19e5422f03050e2f58d594bd55d67c1ea4d017dce1aada7ecbb8d467237f163d6b1bc69aa751c12cba45f547cb7e779c228b3b8560d
SSDEEP 384:uiFiZcI/zsNC8TUNTUlIl2PO9UitU9QX5+DtP8gXO2ftgOIwZOyFLgoV:FFQ7PwgkkUPqkDlO2fXsmcu
TLSH
T16CA27D339CA89C7FADFB9A84F54A32039FB450A7D5C5EB90E6DC5E1C009A1DC130AD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fa379208b6228296ac1f32d5744c6bb64ef98b0fc8c07939c05c1c6374a71d0f
MD5 93f9a088fc381a1f4fa4ef1f8742cb51
SHA1 f801f517bf72922efca79d2d1243153da73b6836
SHA512 6d0df9d899c038b18758c856fa044188e0f27f9a8556911cab067bdcb9c526716f741fb27b7723c8533e394c81b9ea822e41770e97d5405c311c618daffc334b
SSDEEP 192:EONX6nnHGQmiUyCXQYcX5hQDP1njzorBRGMcmUU6:EONX6nC1QNX5+DtP8yfU6
TLSH
T1F202CB35BCA86C7B8AF3AE45B4473713AFA5202BA5956BC4DAE81E1C00D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bc9e3acfb32ef5d85dd515cacb6c497f770351f16c9b9f1683ccd3411fbd56c9
MD5 092e4af5dc7baeebe8e08c50e97ee208
SHA1 1397c32e1cb7b2508658badf72eeb2c6314489e3
SHA512 93e600dc70117a538ef6c208a55597ff8d2d0f62f6abeb748176807db91afa762deef243dd08625e967ebcb8a16c38cdf2b55f4ae56e176d11d503e0ac07c0bb
SSDEEP 384:eZcIhsN62PO9UitU9QX5+DtP8gXC2ftgOIwZOyFLgoV:ch0kUPqkDlC2fXsmcu
TLSH
T1A7828E32ACBC5C7B5DFBA584F0473203AFB4A467D6C9AB84D5ED6F1C00995A8130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9fac17a46d96427fe53665929f02222b6cc8ad7144946b73f6f137bccfbb2ae1
MD5 4a90ce63ce86f93c279a587609eafd62
SHA1 5a5db26ee4c0247605f6020464d565b971d72628
SHA512 475f141664b55b6e62ba7799943d66a42d2072bb11bfa7b823a8a1b8e2a9ff732b8b33b253daa9e41d5e0a7e7cf8ed94f18b42b89add0c13faba44e610f6be9d
SSDEEP 192:EONz6nnH0QmiUyWXfYcX5hQDP1njzorBRcX1eWg3lrq5fU6:EONz6nkXfNX5+DtP8gXM2fU6
TLSH
T18E121C31B8A8AC7B5DE3A995B0873113AEA56127E6857BC0D6EC1F2C01DE66C1309D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d25cdf2-7d88-429d-abbf-91a40d741e7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d25cdf2-7d88-429d-abbf-91a40d741e7b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 978313d94a5451a3c0315b06d06aebf1519c76ee2a96fc58bda75810a4c90488
MD5 5ff55073ac99c96e5abf4ea7f3abd916
SHA1 8fb86b4b55928edafbdeb110b6c52647602eb33f
SHA512 f0544f16868d41d68e6944fb48abb3f1e9a8ce6c2815ef0e6234c1a17bd7857971fadfe914ac4beb5cdd0f6512b3e8d3a5c299c211a6bfe3a67031966a922c45
TLSH
T1F841E948AAE9110CB3B7AF56ABF6A86D583FBD772F17D45D00110D4F0A22B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download