ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample261001-trytra1xhv
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5448	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{FD467D89-9102-470D-9EEB-32DEA6BA5A53}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1484	4768	msedge.exe	89
PID 4768 wrote to memory of 4140	4768	msedge.exe	91
PID 4768 wrote to memory of 5448	4768	msedge.exe	92
PID 4768 wrote to memory of 4140	4768	msedge.exe	91
PID 4768 wrote to memory of 4140	4768	msedge.exe	91
PID 4768 wrote to memory of 4348	4768	msedge.exe	93
PID 4768 wrote to memory of 4348	4768	msedge.exe	93
PID 4768 wrote to memory of 1392	4768	msedge.exe	95
PID 4768 wrote to memory of 1120	4768	msedge.exe	94
PID 4768 wrote to memory of 1392	4768	msedge.exe	95
PID 4768 wrote to memory of 1392	4768	msedge.exe	95
PID 4768 wrote to memory of 1120	4768	msedge.exe	94
PID 4768 wrote to memory of 1120	4768	msedge.exe	94
PID 4768 wrote to memory of 3260	4768	msedge.exe	96
PID 4768 wrote to memory of 5724	4768	msedge.exe	97
PID 4768 wrote to memory of 3260	4768	msedge.exe	96
PID 4768 wrote to memory of 3260	4768	msedge.exe	96
PID 4768 wrote to memory of 5724	4768	msedge.exe	97
PID 4768 wrote to memory of 5724	4768	msedge.exe	97
PID 4768 wrote to memory of 3656	4768	msedge.exe	99
PID 4768 wrote to memory of 3656	4768	msedge.exe	99
PID 4768 wrote to memory of 1788	4768	msedge.exe	100
PID 4768 wrote to memory of 1788	4768	msedge.exe	100
PID 4768 wrote to memory of 2188	4768	msedge.exe	102
PID 4768 wrote to memory of 1260	4768	msedge.exe	106
PID 4768 wrote to memory of 5308	4768	msedge.exe	107
PID 4768 wrote to memory of 4472	4768	msedge.exe	108
PID 4768 wrote to memory of 4908	4768	msedge.exe	109
PID 4768 wrote to memory of 4908	4768	msedge.exe	109
PID 4768 wrote to memory of 5232	4768	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fffc512c188,0x7fffc512c194,0x7fffc512c1a0
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,17419870982191256256,5192829792372492788,262144 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,17749739412049532621,17193317270899977144,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,4914130888667196878,17711011992829728831,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:13
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,7158717459153698029,16089119548089877330,2097152 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,12810282479188287561,2374848289321879983,2097152 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,11943099261060338855,3905299030498734896,2097152 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,5696617624278547659,2853401283384717253,2097152 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:9
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,13291074765037354465,15394483431541202837,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,3262479650211510054,11753224949436706722,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,10727357515327289077,13407775390201183405,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,10727357515327289077,13407775390201183405,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,10125237242337699970,3371533274421444191,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,10585465716339856487,3756005708499509174,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,16319051251397443806,7295123403670595947,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,17934425998008716920,578414605066677195,524288 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3304,i,13598196338569770266,1511355877302923094,262144 --field-trial-handle=2436,i,9546968993843363629,8493831597114864943,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9ef8ac6b15e6d5e6c692b8a5849e3658a365cb60f72700abe6052bc23ebaf351
MD5 f3dd563475b5b27a7cdee3f435cd7b98
SHA1 a02289d32a372b211bbda908be233822948f8e72
SHA512 dae4b120735ba08d5d9905068beec3602b59bf96323b84955bd864898c277148e80797fe338ce559bdcd230f23ed0520ea087a1bacbd9fd2f8a6e6c7525765f0
TLSH
T1FA513CB1B63089DEF7480230B6D15C9F363106C0748B1FD217A8EBBCF95A3AE40AC218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a917.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a917.TMP
Size 3KB
SHA256 3d4214ae633b9dd2c10edd1489efaf0b82352162fd127c2672f875061c437384
MD5 c8626ec4e195b47b40d3e6d945bb2862
SHA1 62fe97d1fbd9103032e8aa0e85090c01d970eb90
SHA512 119dba720c1d1c139e4d77ec4479c9cb56452b73722c5bd4b4c22fcebe9713d2b71a1aea197691f76bc702f6c04f94faea0c03c62ae6611334c0c15ee4223e25
TLSH
T11D513CB1B63049DDF7480230B6D15C9F363106C0748B2FD217A8EBBCF95A3AE40AC218
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 305c1e61920fa7580d8c5288a3d2d3942fe4b39e9ae117a35586b7be7bd68579
MD5 57ca6bf1c1189040d5d8380bfecb9b38
SHA1 8afe48d4395ad1dd777725079d7ad2c8ba9fff34
SHA512 b233665ad8689b9c8282b785353a8b44c4747a1f361afbb89ee7496a55f97ee8004f26639bf3eb534c1402513a6dfb6ed719c93368a4338dca747d56c1bf2fa6
TLSH
T11741C0F3C3E4867E891156F4AB14AE2BCE1D0915831C3C5AC9D4AF2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b1f30b953c6e151a321bbe1954be87510a5262a1c46b55eb54ef9e74dff64fcf
MD5 b121939151b95788537f523be0cfdcf7
SHA1 623cadf17ab0e23ba100065cc3b7f6e1a9ae6f99
SHA512 fa33cf64afc488cfc72c491977a72b17151fbac20e59a1c135a04ef897dd55f6b83d559ff6c9b13429769159e3e84ccb827f9a410fab5ae9c64f058dd74d5832
SSDEEP 192:sxRxRhb5/fjsFGqzoA8p43/g6+WNIYi0awGxIgDdJ:sxRxb5/fjsFGnC/5IHT
TLSH
T16032B755AD28A97B8CCBE20DFB65BF53D2F9603260911E48B6FC861C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b69229d4be0e346d09e6639e4b469b8d7630a98a3e366cfe3a7337d43354717e
MD5 6416008877c65787536d27457f844d05
SHA1 a48ce47b4ce8868c3831d7d32f712be2f7d20982
SHA512 229c01a465fbe7a7f6bc419b68defb31ac3d4fc9bd579ccb39b2626af8bcf054ba8b5083c9ab6991ca4b2e07c6e608a39f752e29d60e24e28c045214232f9ee4
SSDEEP 192:sxRxRhb5/fjsKGqzoA8p43/g6+WNIYiVawGxIgDLJ:sxRxb5/fjsKGnC/5Io5
TLSH
T19332B655AD28A97B8CCBD21DFB65BF53D2F96032A0911E48A6FC861C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5c7bb109df876f1b6d575b1950a4f1f82940f850e1a1c6e0b1a7ec679d1902ea
MD5 774b259034817799f5c3c35ac3a14a0f
SHA1 f627ed82eed1763b03290d26b442530f2536d8e6
SHA512 b6b5e97c5500d35381549abda3c013b5459be0b6edeaf6a0c1182e73cc6413a9782ab415543e1e960a12f8ff9a3953a8891e6f6ba7a72b7d013240451bee4994
SSDEEP 192:sxRGRhb5/fjsxGqzoA8p43/g6+WNIYiVawGxIgIJ:sxRGb5/fjsxGnC/5Ios
TLSH
T1F922A655AD28A97B8CCBD21DFB25BF53D2F9603261911E48F6FC861C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cd5a14eaa198f3dbaf3097c0b0abe2ed5791f04a6e028aad322d15ad28e364e9
MD5 1e14cc68379c7e4c02534253de3ca3dd
SHA1 a3b56c16fe47410906fd4ae321c9ac250da85eab
SHA512 14924e0e9cf2a61c0995b9b16d879b6480d557f968c492b6d7827890024aabd0f66df4c5969f588b369eb524853d75944a9f840a2c27273854c750bbdeeedcfa
SSDEEP 384:XLMDmVifCtgvdFfnvKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVC69lLRRzrohZ6:XIDmVoWgvHfnv8F1+UoAYDCx9Tuqh0V8
TLSH
T123B2DA2B640DC77F4F800A9DAC296FD77D9801CB9A588D4047FE994C02D77EA921A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 61d4e11d6bab4e9238ad8ff59659123b0c84c6ddd9361924d4827b31b3f955d7
MD5 d917275c1112dd587ff69a72da056480
SHA1 68469ac1b87512ffae6f073db27d1e4f67cd0b45
SHA512 48c811423318636826f6c9597004201e3c00933d84d6b70e9424b1f46816d12f231063f8daa4b9eb227226a40f86f0cc9c62b5a2a03761ded3d226dea7f28176
SSDEEP 48:KUoIvK1+cTyPfqT/dFF+/VolI+f+KlLNh+5HuQgRJyVtIBKes8VpidJzV:KUowK1+K64YKJmQ+tuKesWpidJzV
TLSH
T132912320317B1241397E3514A4E4AF6A124671A33474F97F7BEA14A28E6BE044DFDCEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

adf713aa-e7c1-44b3-af32-9367a304bfb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\adf713aa-e7c1-44b3-af32-9367a304bfb8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a4dc1e692ef9d09ab2e821f3cdaa0016442915369e08f3176efbcdd9a9598df4
MD5 ca585ffff025e1b6f75acfa70d7c2f19
SHA1 36d92e7e682b7e583d9b8b1f3f37fa7f9f3906e3
SHA512 6d56d2ea183fb362aa94844a80da005bc91e6933fbf578b3e2c6d3ab0ac259f46cbb47f0aeb91edff5d7a882690bd71ee29d58fb100e3bda425fa48f2a0b420f
SSDEEP 768:DP3HrNVcZ0rfZW2YohpYosBw4Ot5AEl94BHYjHsI2sAdf:DP3HhwBVa5AEncHYjP2sEf
TLSH
T171F2AE79DCA48A739CF6A7C5F60637066FF1D563A5815ED498DC6A0E0E8729E030BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e27d6f212a1d6458b1f25e609e05a18f5099bf7645aa610f7d8534a8b2fc2a44
MD5 a2db87ae142e7b4d4e3a826b8b08cb5e
SHA1 3cd7c908e390b2ce8a81f9204c1d9f9c41e4495e
SHA512 9963b081d52f4ee2008dc56dd1875be0dc105905056d488d49e8525871f085e9438c107aedf968ee407518fde0403a992969dc615c2b64f3a41450ef4039bfec
SSDEEP 768:D/UxvxjgC+636NVcZ0rfZW2YohpYoKBw4Ot5AEl94BHYjHsI2sAAb:WZj3+630+BVa5AEncHYjP2sBb
TLSH
T13A13C039EC645D639CF7A784B60A73479FF19963A5C26EE448DD2E0D0E8729D034B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 15d9e7171b9ffea2ba71815e37e5cf46a17c95927536eee16521e6b23f8dbfe8
MD5 80cbce1d341b1814600a52d3467e7e3d
SHA1 34fa0f263c357a58694deb45a0a2581b4f253da6
SHA512 d8b1c61e91bd12a47cda3f8fe07c9c7d9409ce3cd3cbca837014798c303b0dbad78a3d24c2ef057c25297766559352dc2dffbd12140b850465a18de8ca7570f8
SSDEEP 768:fP3grNVcZ0rfZW2YohpYosBw4Ot5AEl94BHYjHsI2sAdf:fP3ghwBVa5AEncHYjP2sEf
TLSH
T1F6F2BE79DCA48A779CF697C5F60637065FF1D563A5815EC498DC6A0E0E8729E030BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 467e746c87234376781393bf6e33e0d64bc840493fb26d27767994bca116880d
MD5 cf9d648fe42804bec68cffa07141d6f3
SHA1 fed28f812d083a79f5b7c4f1799f62998655a006
SHA512 4bf7bc6582cde9c28f1fe02bb33ca0205ba538489c4700a6ce592c2560393ad830e89c1aa147968538bbf0123e162dde396826f11e6b71d864c00671eee4d218
SSDEEP 768:MFQ93Hwg/rNVcZ0rfZW2YohpYojBw4Ot5AEl94BHYjHsI2sAdf:/93VhPBVa5AEncHYjP2sEf
TLSH
T14703AE76DCA48A779CFA9BC5FA0A33069FF19163D981AAD4E9CC690D094719E034BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a807f2f37348027455c232b23abfa366b333b7b3dae6589f94006523153dc006
MD5 8d8ae4b200728c17f7afabf4bdeb366d
SHA1 2f525de6912725dcd704960b221d81f6390b5a3b
SHA512 e0f14e518de2a962c48668be078da0ef33f06245584159e59c5958eb649f92a8bb2a70808accfa2da32c797402ca292032360e338b48491b31d22ef55457b2ff
SSDEEP 768:z/UxvxjgC+b3IScZ0rfZW2YohBBw4Ot5AEl94BHYj/mAFTN/:GZj3+b3nBVa5AEncHYjuAFB/
TLSH
T1D803BF39DCA59933CCF6A785770B3387AEF19463A5C16ED489DC2D1E0A8725D130B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1060a857-303a-4a8f-a65e-97dac2595ac6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1060a857-303a-4a8f-a65e-97dac2595ac6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download