hxxp://www-static[.]saintluc-sportcare[.]be

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www-static.saintluc-sportcare.be
Sample260628-pgvbcshs8l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3088	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271227178204114"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{A2B4F10A-19D7-4B88-9EDF-CC8DBDFCE278}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1280	5068	msedge.exe	86
PID 5068 wrote to memory of 3088	5068	msedge.exe	88
PID 5068 wrote to memory of 1272	5068	msedge.exe	89
PID 5068 wrote to memory of 1272	5068	msedge.exe	89
PID 5068 wrote to memory of 1272	5068	msedge.exe	89
PID 5068 wrote to memory of 3684	5068	msedge.exe	90
PID 5068 wrote to memory of 3684	5068	msedge.exe	90
PID 5068 wrote to memory of 1824	5068	msedge.exe	91
PID 5068 wrote to memory of 1824	5068	msedge.exe	91
PID 5068 wrote to memory of 1824	5068	msedge.exe	91
PID 5068 wrote to memory of 3372	5068	msedge.exe	92
PID 5068 wrote to memory of 3372	5068	msedge.exe	92
PID 5068 wrote to memory of 3372	5068	msedge.exe	92
PID 5068 wrote to memory of 3768	5068	msedge.exe	93
PID 5068 wrote to memory of 3272	5068	msedge.exe	94
PID 5068 wrote to memory of 3768	5068	msedge.exe	93
PID 5068 wrote to memory of 3768	5068	msedge.exe	93
PID 5068 wrote to memory of 3272	5068	msedge.exe	94
PID 5068 wrote to memory of 3272	5068	msedge.exe	94
PID 5068 wrote to memory of 536	5068	msedge.exe	97
PID 5068 wrote to memory of 536	5068	msedge.exe	97
PID 5068 wrote to memory of 536	5068	msedge.exe	97
PID 5068 wrote to memory of 3772	5068	msedge.exe	101
PID 5068 wrote to memory of 4412	5068	msedge.exe	102
PID 5068 wrote to memory of 3772	5068	msedge.exe	101
PID 5068 wrote to memory of 4412	5068	msedge.exe	102
PID 5068 wrote to memory of 4080	5068	msedge.exe	104
PID 5068 wrote to memory of 4636	5068	msedge.exe	112
PID 5068 wrote to memory of 1408	5068	msedge.exe	113
PID 5068 wrote to memory of 704	5068	msedge.exe	114
PID 5068 wrote to memory of 3652	5068	msedge.exe	116
PID 5068 wrote to memory of 3652	5068	msedge.exe	116
PID 5068 wrote to memory of 1056	5068	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www-static.saintluc-sportcare.be
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7fff0f64c188,0x7fff0f64c194,0x7fff0f64c1a0
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,2108989149507557473,12175850267640089455,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,7132146464345337455,7299460918465534569,262144 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,11508459613364162844,16322425218745516019,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7637657698027418702,10589656781088287846,2097152 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6028088490998314529,14840147036186663542,2097152 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8435816570257618835,4947552618426478139,2097152 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,13787168938491694715,11531312854616605435,2097152 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5020,i,11246057687764826618,1918685782426583011,2097152 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,13940341015086526350,16365445507955953950,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15471224546469807410,17827996289837454753,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13659388819029767422,5618200210829204666,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13659388819029767422,5618200210829204666,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,12426525571187317792,8347332840752204947,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,5919378754338775549,8471566934218285440,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,13926187677111372410,4761019825944838967,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,7026604472635336128,15258048546253519062,524288 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,14763670639667282199,1985770729449090090,262144 --field-trial-handle=2368,i,11331995393793310725,9628984140149307382,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c4ae647e0eafffc16f4e8462f28ec3a1a3f0d4ac19562ff9355df9e085d12b5d
MD5 c77ce9ed23bb8701087e25aa571cb557
SHA1 46d8e686928d232c03c2ea27b178e5ff4a4bbb65
SHA512 a0eef9ac75a81b1e456ad7db3d23d5f81c64a6cd6260a9a245047f9ed9f88edb5f2353a1cdd7520c7157332e38ee60137d955cce922fec3c3825426d1615828f
TLSH
T1F27127340972C3B1E7EA02B1ADD72FCD34728CF9F51B6E933890D8B6A6A8F14464514B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582575.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582575.TMP
Size 3KB
SHA256 83e6967014a4efef264aaf8639ec6980c68b3a77acd2b432bfeb403ae7ae683e
MD5 3f1f1d1a202ef8aaa22ba4478a82e693
SHA1 9b735133a8a8d058da33db2bcff86c17613fe595
SHA512 007578ef0fd0ed30de329a8a62ae87f6f9bf85717c98cc61830b517fd55c5ebf7e66b5d19c87fdc5e0e7d1a8007cd44af84fe9fe6c06a897e4782033fbb77c41
TLSH
T1A87128340572C3B0E7AA02B19DD72FCD34728CF9F51F6E933890C8B6A6A8F144645147
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 40d6a1d566cbfa9a91668f1ece54de0f4ae992c1fe57ea1e6d87f7fc6ac7788d
MD5 865385f8196890ec4c61d468a0fa2db1
SHA1 b7a53e4752dddd45d602a2f62598848fe38b076c
SHA512 bfb4c91c5784093f0762e6ec2c4eddaf65fde03bd10e2f80a628df747629555bbeefd9f018e793bf1bad356a543e26f945e2e77bfa986988898c11999d5fb884
TLSH
T1D5118BB383E1856E890256F0AA14AE2BCE2D0611432C7D5AC9D4FF1B93E3075E10296F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 17a2a53aed6c16fa9484755432bb3a9c79938a52831e9bbce83274c30b86cc37
MD5 5f55e2cb1ef9d4b58c6728551636dc30
SHA1 346de1b3126aa072666366406bc01a18693d09f5
SHA512 f56faf2431468510a4fda6e98737e10ae22679d7a054cb48e50fb816662454bfb4196b01308dd6840068e9bd6f21a2286107ba0ef28ef97214087ed5102eaed5
SSDEEP 192:sxZJRY1yM/jK1Ml8Mk5/fcsEi/N0IdpT3HW6+WNiKp/YC6OTezHIgrJ:sxZJKJM5/fcsXNt7Hb9/Riz9
TLSH
T1B852E9126B34A977CCCBD209F955BB53D6F94572E2941E44AAFC8A0C05E7BDC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4390044679616cd349858591f066445c296934ece6533a951533ab3ccdabb76c
MD5 97d44edf5da36ec92daaf81a205cedb7
SHA1 26dc14bcd75d210e4171a96036d5649699ebde34
SHA512 f19734ef94e7d03c759d03a3e956d38d318df367a3fc888868879ae1fe32c6a8aa29a6b2f06d75e173d19e0b364b9ed9823ccf98e5e747e1924115dc14ad1289
SSDEEP 192:sxZJRY1yM/jK1Ml8UQyk5/fcsIi/Q0IdpJ3HW6+WNiKp/YCNOYAzHIg5iJ:sxZJKJqx5/fcsTQtFHb9/YDzY
TLSH
T19452D8126A349977CCDBE209F951BF93D6F5857292941E44AAFC8B0C01E7BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 539188683f970060d27701f1118010cde3babda5ed9777615269c1fe5131e00a
MD5 bdc06a7f99547cfa804fdef27afde69e
SHA1 15d6e26efdc18cafd87347fa20eda81dfe8a6b29
SHA512 9208baa5ebe94f55bef9e984743372b24928653dff86edd68b75d8b03082d66b5e9dd004d372ff875dfd127d095ae9e147e85cc270a1b8c2eb0280d8dd89b15d
SSDEEP 768:HA8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVQroZ:HA8bqn+WvSCt6u1jaCZLbWV7Z
TLSH
T105D20B3B280CCB7E4F845E5CEC266F962ED801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3a41a9d0247fdfcddeef5b1025572b1d62a55741d4ccad385f44acc68c9f1961
MD5 924e0f23ec29c31022c92fd07ad486b1
SHA1 76595d6248ce5be8b990d649a56ed4c31270733f
SHA512 874ea05384e9451d78b4b0a89a1ec2a968638214e15b9f64c0032171e1430517b4eb2e90d17bda64fa86040ae0f74fa8dea302ea841400b315fd069abf920846
SSDEEP 24:Kdof/sdaCdK6W4KG+dIjAWKi1haeW1EoGSmcMl8gHyXYgfH0laKdyyO4i++VIjoC:KwZIFKCwwPyNlIpKuEsGJIJK6kULyI
TLSH
T136918406743E03013CBE690891A5C96A8D4271E33459A87F7BE851E35BA7E111EFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 94407a7d19f3298812330541b0b56dba7cac9914f9247acef9cf0547ce083787
MD5 97408ec6882b7a70675a6b4fe7f84060
SHA1 eef77b539ea23d79aa79824d779ee1a2d90b68c4
SHA512 08df6b923dad4b788e6ecc4a5539f999518f315020d32b6300ea5db745d7ec2089e113a721ee2638f30fdc8ba5592ed2692e2f7c17a9a82f81f826ed6f2476bf
SSDEEP 384:9tNn/s3n9SfsNjta3bbu98pFEa+wOS7+2rRAmn15wbAjEO8fb:9j+9UQWbuoGa1OS7lFAmn12bfZfb
TLSH
T11F927C32687C5D775DD3A588F4473317AFF8907B938A2AA4C1EC8F0D01DB298131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 08367b9ed3323c741c8a31600d26c46bbcad90bb48e87a74404c3af9a5282fda
MD5 ab6b4dcba66900c3030a11f6f616b386
SHA1 f8ee2cd8d9f5e8a4da143f67289609b86296cd50
SHA512 b1b9f06c2776a73e94135fd1085e61ccee8072246f8132ca76d77cec6520f3cb35143914052c275fff5fd41c05d03044aeca3e71fb1784a0d2e66364b80f8602
SSDEEP 768:ZF1j+9Rswg0WbuIGa1OS7l2Amn12bfZfb:I9RHWbZzr0yZfb
TLSH
T170C218F248EB4936D99E5B47B73E2E139EBCC067B5852650B3984E0CCC961BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 913fb0f14c00739993e17abb66c9168df410163b54b32af11e9b48a939b743a8
MD5 8122e7a8270db3a4dcb5de25cc79dad1
SHA1 75fd0e238f8254c3056c19ed503972c3d4e28c3c
SHA512 117f774f4c78aee49b9fd72a70cc23c094067ec15982c7d339c11cc1915f4e6bd1005cceae16acbe5fc97c4341a1cfd96fee25eb997941d8d4112c067124a4b1
SSDEEP 96:EqONkEQsjpf1bxX5ih/cIPURHl8h4otop5jnDBBfPgvE5BzatIRdy+jCOmhsR1RU:vONw6Db6QmiUyP3HBa+jcOmiRqRgKbU6
TLSH
T10202E73568786CBB9EA2AE48F88B37275FD4103BDA966F44D6D85F0C00D765C234783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b77e521d54b3f390eb3a05bb1d5e1f7bf4b7e99c7bb0b67e2df10d0d27644762
MD5 b91e8660fd2279ba7b241aca40a914df
SHA1 8225b729ae8c6c8779bf2b0a8122bcc863b1921c
SHA512 d1fc2c80bd8058c8c6ba694aa7817a4c94c38749eeaf22a6145d063b524413cd0a2356f249ba83f5824afeb74dd0cda9196df0cf89b455dd57a1d003ec578f08
SSDEEP 192:EON+6DbnQmiUy/33Ba+jcOmiR67+2iNzsqyU6:EON+6Bw3Ba+wOS7+22AU6
TLSH
T1D5120836686CAC779DE2A544F48736139EE8512BDB8A7B91D2DC1F0C01EF65C134F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3c3e8e9-37b8-419d-9554-b965c8d11387.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b3c3e8e9-37b8-419d-9554-b965c8d11387.tmp
Size 19KB
SHA256 90b13e52150eca221ea19b5e012da984072dfec1a5bbfb94dce75a5f70028a86
MD5 b62cc26e08f17acd461a58965f45091e
SHA1 9fc8a1ba647b57846dfe545b1e38c6a7812dc664
SHA512 c2454700d78ac7b21877c7e77bd1c2b8613ae67d2003a5eb99c648b62a68b3efef42354a3c9c30a15f5e21aac41f1a81d59008f1640ff1b1165bcd5a91876c89
SSDEEP 384:PtNn/s3n9SfsNjSa3bbu98pFEa+wOS7+2rRAmn15wbAjEO8fb:Pj+9UdWbuoGa1OS7lFAmn12bfZfb
TLSH
T133927C32687C5D775DD3A588F4473317AFF8907B938A2AA4C1EC8F0D01DB298131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f8e5bbff7a7fe356b06a5035c49a183a461d25c20c1cfbadf2655ea860641a25
MD5 5429015797e6b056173c72d6543df595
SHA1 74367825f69a2b14efdb7f57eb75cd575cfc99de
SHA512 51a057e6593a94394b4c086c39fb81c1167bebd36d5e777695a1337107bf35e7556fe289381d0a4f59d2e7462150c594f846147ad2b006676c9a3e9fc1efd666
TLSH
T17A410658BAEE1108B3B76E5A9BF6A86D487FBD332E06D46D10110E4F0626F40C871777
MD5 SHA1 SHA512 TLSH

Submit Download