ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261001-pjqqysbf64
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{660B8D75-A2A7-44F8-9A59-1F3ABBDBA6F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	msedge.exe
748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3536	4860	msedge.exe	87
PID 4860 wrote to memory of 2296	4860	msedge.exe	88
PID 4860 wrote to memory of 2488	4860	msedge.exe	89
PID 4860 wrote to memory of 2488	4860	msedge.exe	89
PID 4860 wrote to memory of 2488	4860	msedge.exe	89
PID 4860 wrote to memory of 4948	4860	msedge.exe	90
PID 4860 wrote to memory of 4948	4860	msedge.exe	90
PID 4860 wrote to memory of 2120	4860	msedge.exe	91
PID 4860 wrote to memory of 2120	4860	msedge.exe	91
PID 4860 wrote to memory of 2912	4860	msedge.exe	92
PID 4860 wrote to memory of 2120	4860	msedge.exe	91
PID 4860 wrote to memory of 2912	4860	msedge.exe	92
PID 4860 wrote to memory of 2912	4860	msedge.exe	92
PID 4860 wrote to memory of 3348	4860	msedge.exe	93
PID 4860 wrote to memory of 3348	4860	msedge.exe	93
PID 4860 wrote to memory of 3348	4860	msedge.exe	93
PID 4860 wrote to memory of 1280	4860	msedge.exe	94
PID 4860 wrote to memory of 1280	4860	msedge.exe	94
PID 4860 wrote to memory of 1280	4860	msedge.exe	94
PID 4860 wrote to memory of 4720	4860	msedge.exe	101
PID 4860 wrote to memory of 4720	4860	msedge.exe	101
PID 4860 wrote to memory of 3904	4860	msedge.exe	102
PID 4860 wrote to memory of 3904	4860	msedge.exe	102
PID 4860 wrote to memory of 4208	4860	msedge.exe	106
PID 4860 wrote to memory of 1116	4860	msedge.exe	113
PID 4860 wrote to memory of 3352	4860	msedge.exe	114
PID 4860 wrote to memory of 2120	4860	msedge.exe	115
PID 4860 wrote to memory of 832	4860	msedge.exe	124
PID 4860 wrote to memory of 832	4860	msedge.exe	124
PID 4860 wrote to memory of 748	4860	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffadf66c188,0x7ffadf66c194,0x7ffadf66c1a0
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,290936576087782581,449653138922167017,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,3862358591420894236,5798150912245769414,262144 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,15836365151796056513,11377315782132084138,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2776,i,15087097082591116815,14046398957494028783,2097152 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5845341579702240452,2415555131437996075,2097152 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,3356077840353292404,16435453242398116335,2097152 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,4553690637905142593,3197713692364943204,2097152 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,12217940312701173522,10226724606095110528,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4710135084227241413,3875109481366347749,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,6936094829714772392,2026532658108053364,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,6936094829714772392,2026532658108053364,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,1809685818469422536,15403654141078604745,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,11935018521760278456,13521630020245173893,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,3795815804861002218,14272329008705151857,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,14261335109666520024,13750824566649436070,524288 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5768,i,4750167265423574436,1051388355759782664,262144 --field-trial-handle=2332,i,17895782789834679264,2892019509927607410,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fe4fae4217413698dd7be429d262c789ab51648babb60772bc62f69e95503926
MD5 4414d51f5c87caa371f042870fda703f
SHA1 ebbe16ccbf7052c2ccdecd76427e099bfeebe90f
SHA512 e258e06cc79e23709c1a9c40e7ecedd7f2eb41ac2566515469d24100afc7e5ce670131ba044f8b1ae71343a120b9259e4fd3183b2f6b730adbe96194434dda92
TLSH
T168512B4126A0636CF7EC307081FA92A736B48EB2619FCE76E394F47A9D46384F15502C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594126.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594126.TMP
Size 2KB
SHA256 0cbcfa4f13fe423212472553eed04f1f67d66239f91eeb74507ccba1cf20571f
MD5 799a2e191b045dde84f72e63430bb908
SHA1 7d78a88ce490d1593df071b36090ed72f0579336
SHA512 d0e46fdfcae85a91882fe9ca60df44ddcfc663eab404a14ce98624359433437148fb459ac5e672704f12d2e1051378c0bb5de7bfa76e102c7fbbad36c55faca9
TLSH
T1BF511B4126A0636CF7EC307081FA93A736B48EB2619FCE76E794F4BA9D46384F15502C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5811e0a36291126500e7ea870c1453468962b97af31b28e4575639626078d2e7
MD5 1bc48b79c240d9a2eaf919c65f9b0f30
SHA1 3ce20f4cfbaa1dac684d9f8e622e8d74b477c727
SHA512 f38598b200c3cc60b7e58b5b08392d50b18f4e0599d778e15529b562f8f9544e6fa9b848ee286f46f5aa74fedc64f760ca1fe3b17fbed5cff8c917b9d6f34d70
TLSH
T197117DB3C3D595AE890516F05A24EE1BDE2D0606821C7C1989D4EF2B93E3475E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0e9075938731cbc0fe84f9c80bc77a0a694baa41cad9b32f9d7ef6f4078eebb0
MD5 315fde5d7b3ba5a48b7a8219f140c006
SHA1 80f5c04a7bad8af0075ff3c5cc6082d3d0870963
SHA512 f97f6136642f026a66d1192c0e41c5d4dad9736dc052247ca48c3209eeb61239d741dc51c1e65cb5da440b910b524e330e06540208b8cb2121180da7f1ee1d7b
SSDEEP 192:sxZ4RXWk/fxsBsIdpdflHW6+WNGYrb5AIgrJ:sxZ4wk/fxsB1/HbGF9
TLSH
T17512B7526E28A47B8CC7D20DBB15BF53E6F9503291D51E58AAFC961C04E7ADE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 81a0f6fecbd6dc7e33be65f72494f3f7b2e36ae857cd4036d25abcb216c1983a
MD5 fa036e52324e3ef06a2b6d08928767e5
SHA1 215f758632b69cf90d47189940c14fdcf36f51c0
SHA512 86340518fb1182041d99f40da528818295c6203fcee9a08369f555886d57cf540963cd7c3a9fa932356e7209b01a3772bc321de8875469c0c1f61b9a46fcef61
SSDEEP 192:sxZ4RXWk/fxsSsIdpHflHW6+WNGYrX5AIg5iJ:sxZ4wk/fxsS1dHbGjs
TLSH
T1E022B8526E28A97B8CC7E20DBB15BF53E6F9503251911E58ABFC861C05E7ADE230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 69368d990dd55e8a06bce79bd89e114629e57bff1a86098f7b18ddb6a5e4b87c
MD5 8d0a87b558fe1fbe2b94bbae0df62274
SHA1 11ea5a89185c7ad908e7632937517c3adde2433d
SHA512 d10d8adf73b9bd540815a37587a2f7f586e5f4ca49ebed50046e4b69591fe5f1540ff281f6162d0b3d3ee2f7410c7d6aa067e7a6467874b6a6cbbb6b7b7d48ee
SSDEEP 192:sxZ4RXWk/fxsSsIdpdflHW6+WNGYrw5AIg5iJ:sxZ4wk/fxsS1/HbGas
TLSH
T18D22C7526E28A97B8CC7E20DBB15BF53E6F9503251911E58ABFC861C04E7ADE230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8aa3381e0ebe601aeb5babd1efc2ba3cee2849a79ada03a935ec35c7b6b35918
MD5 34d71a6ccb1f9c6b9d7df33a52571279
SHA1 645aae021914e91371d944bf57291fe96200ffef
SHA512 507ea483100291f7f8cd06b096aff226cc28509e5afccff8a1bbe9873bf0fef3f957ff100a5a3692d9661d1a6afeb46ac6e1bedaf45fef92e8b7deb077c2f20f
SSDEEP 192:sxZ4RXWk/fxsksIdpdflHW6+WNGYrb5AIg5wJ:sxZ4wk/fxsk1/HbGF+
TLSH
T16622C7526E28A47B8CC7D20DBB15BF53E6F9503291D51E58AAFC961C04E7ADE230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6c5a677a6aa789513fedba0ee0903f86a455c41187f643d1f5efe02736d3e462
MD5 2daa517a1e1278f44cbad8fb9ab87c2a
SHA1 5343cee714b0caf0662486f0638cc9b4e8004fc9
SHA512 ed150f7e9f9fda9bde1cfdd9835f629aff3e905f36453c87e2214242073486d6525ec8b791009e4e7a832c9c8bc49fff9d14cffae95e4c1686bcf723aa5902c3
SSDEEP 768:P8y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbkroRi6:P8y4J/DWvbtBhu1jajiLm0bvc6
TLSH
T102C2FB3B644CCA7E4FC00A9DED5E6FD73E9802C796948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 71487c932dee1722a63373135a47d414eaf8235b2c7e660cfb74ebcba15153eb
MD5 b6c1560ecdfc9fb50af33db791d2da12
SHA1 25d2212b1ff4fb0acf609855d8f7f9acf643e15d
SHA512 c70fe7ad5bdcc1346b921da44bfa8f85bddd5258149037282d93738edd1960907f20919f3cb4df9771c868efb8955a48776869f617658a4ec1171fe34772b26c
SSDEEP 96:KIDCKs0+aMgKdKO2T+K42BiKK86iGQKvK2:E5PjxJV/p
TLSH
T1BED1028530BF025439BE258881B49F1A624132B7751CE67BFFBC50619E2BE145DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59dbc0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59dbc0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c6a03ca460422285a8ac8e8610eadd4a109cbb4022558400d711135c0a255f45
MD5 246803fc65d9956db8b0415ca8001c25
SHA1 5f668388c68f23f8766af3f601df16aa6ac45852
SHA512 ee76455f5db8e769585e0129dd19895d7a4770b022d35bb105d97ccae71855594be5f2950221b8c8718847ff55dcc2aa4ed42ce3199b94f2672d2631aaafca1e
SSDEEP 384:5ZcIhsNMJhRZPHPHX58Ex8kJsXb+2sJVZh6DKhHm/ioj:RhNR/aBblsJfYGHLg
TLSH
T138828E32E87CAC7A5CF6E641F44636035FF9D013E2892B94D6EC6B1D00DA669230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0ac54fbdafea5e4208d21a86956a04d5db82b49972375f9a092e474736bd6ce
MD5 4e1d75a9cecc2c6e5735597d244283db
SHA1 d7a7b1a6e6e5fd9a9ba5d630a22a31cbfbc32d64
SHA512 2b7c08048fd165812e966ff576146b29e3659561b7d2ad9f62e31c909ffc7228ca53dc476df930d5d69ee218cae5dadef526db932a715f002447c916b796cbc9
SSDEEP 192:1ONg6wlDgQmiUys0W4X58gZdjzorkJIDlZIeU6:1ONg6kgEW4X58Ex8kJsJU6
TLSH
T1E102E735E9787C7B8EF2AE09F48627139FE5112BE6552F44DAE81A1D00D765C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b704d96dd00e64176b18030d789822142a321e8b5813bd7704177e79ca2835c5
MD5 90f84c3f25f88104d17d4c9a04bf23f8
SHA1 63e70c37f5563164cc76a396d91e800413b4f066
SHA512 9389699e345c34743a59a318e4fcc57b9e5b42d106dd53d792ef7147aaeb4784368e6d5d8ca91635e6b83967aa2123e9f195060b9f13969ffa69b278985847ed
SSDEEP 384:siFiZcIgzsNE8TUNTUlIlshRZPHPHX58Ex8kJsXb+2xJVZh6DKhHm/ioj:XFQ8Vwg2R/aBblxJfYGHLg
TLSH
T109A27C33D8A8DD7B9DF6DB81F54632038EF59063D689AB94E3DC5B1D009B198130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 dbe687b8f035ea251d9f578872210d845a995ce2531e1eff8a162a308aa52095
MD5 3cdc7706479021f545a16219fd8ae4e9
SHA1 093254793518a10cf306d7c8e9b11e445c7cac97
SHA512 1422c096399ac8f6a8f5e5767cc4d8bc45e97fb88240918f72ee56563174badea43d01252badbaebf83c7e040a15bb28d6bb8abb6b77516974960b926ec47b28
SSDEEP 384:XZcIhsNMshRZPHPHX58Ex8kJsXb+2sJVZh6DKhHm/ioj:fh8R/aBblsJfYGHLg
TLSH
T1B4827D32E87CAC7A58F6E641F44636035FF9D013E2896F94D6EC6B1D00DA669230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8400e0273149c71cf01487038063eae936d261604330d9ae25a181709d3c01a5
MD5 1d37dde74b45d816850b1e6cab828830
SHA1 ec7c6ddee658e774b18ffab1560b0b5516e2872b
SHA512 e08e035f194baa7a706b6bc33b92ee0a1342db09b48279ec7acdb729671f8ba4083d5a2b54d7c925db740fcd21a73a0b5b4c3bcc240cacbcaf6a7a806d9d2b54
SSDEEP 192:1ONl6wlDiQmiUyi0N4X58gZdjzorkJsXh7R+25veoqzrU6:1ONl6kecN4X58Ex8kJsXb+24JU6
TLSH
T117121935E468BC2B5DE2A545B08732039FE69117EB896F94D6EC1B2C01EF66C534EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9bdc3c09c3484c71eacc3970c4440f194c02511024fbdffbc4146af5ac27aeed
MD5 bd268728bff728750fde916deeb586bc
SHA1 875389ca93dc7cc66b44e184d524afd3605073d3
SHA512 87871f6ed8b3d9ff7ec0b8ebeb662012f224d316049004e066e109e4307579bbfc5e9b82191bf15412802d2d76f97c9282743914a1051a4c6a9dc7eac713a421
TLSH
T1C241E658A6FA0148B3B73F1AAFF7A56D847A79372F0AD55E00110E4F0A66A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download