ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html
Size 116B
Sample260930-vwas6athph
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{CF40371D-A71B-48F3-972B-9EC3E38B70F4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4572	4736	msedge.exe	84
PID 4736 wrote to memory of 5320	4736	msedge.exe	85
PID 4736 wrote to memory of 3772	4736	msedge.exe	87
PID 4736 wrote to memory of 3772	4736	msedge.exe	87
PID 4736 wrote to memory of 3772	4736	msedge.exe	87
PID 4736 wrote to memory of 2104	4736	msedge.exe	88
PID 4736 wrote to memory of 2104	4736	msedge.exe	88
PID 4736 wrote to memory of 1504	4736	msedge.exe	89
PID 4736 wrote to memory of 3760	4736	msedge.exe	90
PID 4736 wrote to memory of 1504	4736	msedge.exe	89
PID 4736 wrote to memory of 1504	4736	msedge.exe	89
PID 4736 wrote to memory of 3760	4736	msedge.exe	90
PID 4736 wrote to memory of 3760	4736	msedge.exe	90
PID 4736 wrote to memory of 4856	4736	msedge.exe	97
PID 4736 wrote to memory of 4396	4736	msedge.exe	98
PID 4736 wrote to memory of 4856	4736	msedge.exe	97
PID 4736 wrote to memory of 4396	4736	msedge.exe	98
PID 4736 wrote to memory of 3440	4736	msedge.exe	100
PID 4736 wrote to memory of 3700	4736	msedge.exe	114
PID 4736 wrote to memory of 3412	4736	msedge.exe	115
PID 4736 wrote to memory of 5164	4736	msedge.exe	116
PID 4736 wrote to memory of 4236	4736	msedge.exe	126
PID 4736 wrote to memory of 4236	4736	msedge.exe	126
PID 4736 wrote to memory of 5516	4736	msedge.exe	129
PID 4736 wrote to memory of 5516	4736	msedge.exe	129
PID 4736 wrote to memory of 2808	4736	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\triage-report_10522-thomas_schuetz_AT_bwb-group_com\body.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9874fc188,0x7ff9874fc194,0x7ff9874fc1a0
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,12896724989230199696,5983603611593882098,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15423660556491611658,4104296762445404889,262144 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,13397872694574739799,17209857556661551888,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,12899519770985509409,9070616208653509829,2097152 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,864553573796741974,10309221503094488827,2097152 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,8666603973644633295,15792597741996165726,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,18203495559956385556,29976206999142754,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,7555964158996137103,395712741444251858,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,7555964158996137103,395712741444251858,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15707996847192078159,16233066792129684538,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,1683669853705596818,12568259244153213094,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,5727932764192934091,17605825664231427348,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11320762123091662720,16646204501100996615,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,14378698733076948153,16055657593465454164,524288 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5132,i,348720857977929324,1930431019596292391,262144 --field-trial-handle=2208,i,2946498859730940136,117915057142289654,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 076f141035e7aedcae33e1da9206c42c569d5ae82dbb50b4ddec203af0687373
MD5 88639806cc89a0d748e76218f55f10d8
SHA1 f1e2f1bd2ce5438244e02f02001bb9da5419e996
SHA512 e781a0d49550bf8f9269c77f166331ccfe75fe619374fad49ea495c52aedbe3a2fd50ec9aefdaeae9650fb27dab6b5f64fda1d4a201b7604412631dac765d555
TLSH
T148F02DB5CD25BC3B19FC1B1910A44646F75113672780888F3B3D910D8FB1A37865695C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 37efa4498df9dbc58a85ab050ad24d79db4afa9255627d4b850d96437b71f074
MD5 7281a2c44f487243988e932384b7fcaa
SHA1 36087ce37f09eff283e685ab742c3c202d88c9f6
SHA512 d2f741bb91d5fda17f7f225d6e9619df2bb081f7bff3bc73b14196dcd9415bac1f7cdaa0936f765b575295bc4461e7c7064f5fe0683b0a6b335ec624f19e8cb4
TLSH
T11C318EF7C3E8866E890196F0A618AE2BCE1D0954432C7D9AC5E4AF1B93E2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b088e5355dca9ee95b5460ca84f55eab7d29a15124ef6d901a6f53e634472770
MD5 b963359467dbcaa30cf0830444de2903
SHA1 f2ad6e10a845d8a5b209ff96d8bd5b79a10fc56d
SHA512 20c54c4af801a6c7e8de11cac88190db828a64d60f37e925111eea92ecd060444eb2a12b02cb8c075ae7e5988834ab2e3974f2fe52632dfb5821f3dc1e40d2b7
SSDEEP 192:sxZVRLky/fHs4QZZNVzodpH+HW6+WNGYbIazYfEIg5RZJ:sxZVuy/fHs4OZN+eHbGFoYQ3D
TLSH
T15342D855AE28A97B9CC7D219FB55BF53D3F95032A0941E48A6FC8A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 26382b987e6a762e3539ac58b10e2bcd7ec29a1ced7e4998cf6f43bde7d76fa5
MD5 94a425d26e07567e831fffddad662048
SHA1 b46cb25af662ac73fddc0e8abd2d98afaf96265c
SHA512 1c9423ff8452bee5dc80f63622b899cafa4d956087b815c26d0a5dfa9c9aa9e1797c515ebcf4ddb7e9da47695df10aedbf940910ac86b4d703978a94b3d52804
SSDEEP 192:sxZVRLky/fHsPQZZNVzodpH+HW6+WNGYbIazYfEIgjZJ:sxZVuy/fHsPOZN+eHbGFoYQjD
TLSH
T1F942D855AE28A97B9CC7D21DFA557F53D3F91033A0941E48A6FC8A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3c80fdc6a54a38422bfd70e9e9a29efb6079c5a78c321c3f3115ec1ad7c8d546
MD5 0ae1c36db1d87ba0836512a831ad351a
SHA1 0722848b99b0600cd93e673fdb794517e84dfc65
SHA512 f9d7b5ef42720ab1eac001bfafc2826a57a83b2b31c622a6805fbc66de3d27261b7520a59de977d3e16008d1952a65f1c470216d9a9b951d3ae8fffb357cae19
SSDEEP 192:sxZVRLky/fHsMQZZNVzodpH+HW6+WNGYbILzYfEIg5RZJ:sxZVuy/fHsMOZN+eHbGFfYQ3D
TLSH
T1CA42D915AE28697B9CC7D219FB55BF53D3F95033A0941E48A6FC8A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 538406384eef71b20f4b8e86e8e297d9db2db47a61d0f9638eac4f66f13b2316
MD5 5782448524e186f0e7993d5aabda77e4
SHA1 5007f1f41e8958d7cec1fba2185a70252745dbc6
SHA512 c6d0bb9c47d5448cc67fb6cafe3a90b44b2ff10714af06cd6d5c0fd0a4b35d586a7c929a79bb2ce4e34f3270ee8bb232c6f45ab152ecdc237d079d6ede28f73e
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXw3xM:OtfFvpopPxrB4RhfwhM
TLSH
T1DCB2461471BA061138FE790881B6872F464232B33259E63B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ed97c334f263b5a51efac18141c55ef231121d21b82a9bf4f61a172f0623a4ca
MD5 f28ee7315258512832c6cc7c78d220a4
SHA1 19c7b606bf982c4b346696a405991dcf6ce396c9
SHA512 69f6b6729fcfb6dde3f96af5a1948fc9b3c9bdfc76e7d8506fb5ff0b2b8b3e7274420bcd4c55b55864a270d9bd9dc57ab101d85a74fa5afa5f68fd772b399f43
SSDEEP 384:noiFiZcIb3sN08TUNTUlI4f5mg1vXF94zf8BR6aGCY5HN6tgOIwZOy3xgL/7Iz9U:zFQb31wg3MtLBjGx0XsSU
TLSH
T101C24932E8A8DAFBACEB4BD5A74A7603DEF4416385CC9AC4D9D85D5D00971DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1cbf6a90ff555016b52990cfec203e8aee30b8dd9d49e4f8717816b216eeeb7a
MD5 bfc5d6fbf69f017445754bac0e822f91
SHA1 c3df9b07752371535458510c1ae49bcc05f948a5
SHA512 ae05e8600092462bc8df4d6e4fbf4b6d5ed39868671cb7174a7ebc44cb6a01b26a186e6e185ab38dab92cb897b6c7c66575ce4a7f92c079419a2a220a439baf0
SSDEEP 384:nbiFiZcIb3sN08TUNTUlI4f5mg1uXF94zf8BR6aGCY5HN6tgOIwZOy3xgL/7Iz9U:2FQb31wg3MwLBjGx0XsSU
TLSH
T142C24A32E8A8DAFBACEB4BC5A74A7603DEF4416385CC9AC4D9D85D5D00971DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2bb3dbeafe0cb4d2c2cc40299b25b1e9dd66e39e7b030c06c87ffda51547d1ac
MD5 53550b7e579d8988f3894eb57c3b5146
SHA1 a3261cffea06b5aa330d0e89f1d8ac3f5721c46f
SHA512 3cea2801ec2e0394a200e97ddaa619001800982722fbd48b240a4b098a2e7f78d720664f715d88975d6bc348f5fca31981b46429ab8073e5c8d331cb3a14377d
SSDEEP 384:nriFiZcIQ13sN08TUNTUlI4f5mg1uXF94zf8BR6aGCY52N6tgOIwZOy3xgL/7Izq:GFQY31wg3MwLBjG40XsSU
TLSH
T1D6C23932E8A8DABBACEB4BC5B74A7603DEF4416385CC9AC4D9D85D5D00975DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5352848df3b952e22e0f8cfe7b2800425975142f608f33d7e660c39d4310176e
MD5 997954b850a9b955d271167ecef6b300
SHA1 835b04cb31335c592fcb8be28acc0c2edd715ed2
SHA512 5456f4a378fd437ac61c17d9f5ce6b4d5af69ee3539854c1e7b7fcaf6dc5ff0ce7b8bc5d6b23780e0b909a7cc3d85b6524eb576cf0a7a8652c41ba0ebbb909c8
SSDEEP 384:nQiFiZcI63sNh8TUNTUlIm25mg5qn4zf8BR6aGCY8Dsa+VYHigL/7IzSoS:rFQ63YwgSpJBjGQDhgGf9
TLSH
T181C24A36EC98D9BBECEB4FD6AB4A7A07DEE41167819C89C0DAD45D5D00932DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 60ebfe73475fa73db011f715c7521314c63a0b2528d9dd532fbccd5bafcce48b
MD5 343c078501d4e19f8edda7fba5d40b13
SHA1 cae4edb0be8189413f13b3ffd1a2377a59de5f05
SHA512 a96f8ef22666ce6c0f2eedb9e36dc8542018ae3de1cae0ca6f61a6a434c72f7b784f98d56fdc2a0af4602ab48149ba6c847571e1f8c814f530cd90d6d131b999
TLSH
T1C1415A5CB6E91108B3B72F5A9BF2A86D587FB8773E06D45E10010D4F0A62F40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3440-195-0x000001703B0E0000-0x000001703C0E0000-memory.dmp

Download