hxxps://sap-portal[.]netrtl[.]com/login

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sap-portal.netrtl.com/login
Sample260702-katn2aev9s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274542659575588"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4E9A3B81-914A-48D7-B9D5-34EE0A32E174}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2320	3848	msedge.exe	83
PID 3848 wrote to memory of 2384	3848	msedge.exe	84
PID 3848 wrote to memory of 2092	3848	msedge.exe	85
PID 3848 wrote to memory of 2092	3848	msedge.exe	85
PID 3848 wrote to memory of 2092	3848	msedge.exe	85
PID 3848 wrote to memory of 3640	3848	msedge.exe	86
PID 3848 wrote to memory of 3640	3848	msedge.exe	86
PID 3848 wrote to memory of 2928	3848	msedge.exe	88
PID 3848 wrote to memory of 2928	3848	msedge.exe	88
PID 3848 wrote to memory of 2928	3848	msedge.exe	88
PID 3848 wrote to memory of 772	3848	msedge.exe	89
PID 3848 wrote to memory of 772	3848	msedge.exe	89
PID 3848 wrote to memory of 772	3848	msedge.exe	89
PID 3848 wrote to memory of 1572	3848	msedge.exe	90
PID 3848 wrote to memory of 1572	3848	msedge.exe	90
PID 3848 wrote to memory of 1572	3848	msedge.exe	90
PID 3848 wrote to memory of 1416	3848	msedge.exe	91
PID 3848 wrote to memory of 1416	3848	msedge.exe	91
PID 3848 wrote to memory of 1416	3848	msedge.exe	91
PID 3848 wrote to memory of 4548	3848	msedge.exe	95
PID 3848 wrote to memory of 4548	3848	msedge.exe	95
PID 3848 wrote to memory of 4548	3848	msedge.exe	95
PID 3848 wrote to memory of 4504	3848	msedge.exe	96
PID 3848 wrote to memory of 3784	3848	msedge.exe	97
PID 3848 wrote to memory of 4504	3848	msedge.exe	96
PID 3848 wrote to memory of 3784	3848	msedge.exe	97
PID 3848 wrote to memory of 5060	3848	msedge.exe	100
PID 3848 wrote to memory of 556	3848	msedge.exe	116
PID 3848 wrote to memory of 3892	3848	msedge.exe	117
PID 3848 wrote to memory of 3384	3848	msedge.exe	118
PID 3848 wrote to memory of 3064	3848	msedge.exe	120
PID 3848 wrote to memory of 3064	3848	msedge.exe	120
PID 3848 wrote to memory of 1540	3848	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sap-portal.netrtl.com/login
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd39b6c188,0x7ffd39b6c194,0x7ffd39b6c1a0
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2004182135013579143,3723259589559397447,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,16027105910310297141,4977739484338073985,262144 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,11612279401577447288,7613289326053222203,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,12736000358868980776,5959917723972579301,2097152 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,13787054635869779725,15096081364789220385,2097152 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,3258472704206954521,2044023465018968935,2097152 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,9882639133469836951,12110285226059225730,2097152 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3512,i,1598266874428926528,5332194707627511638,2097152 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,15656083692416910559,8022239968721981712,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,4122312864804697295,10077918361841474058,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4093704035736255684,7567922681419573684,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4093704035736255684,7567922681419573684,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,13117666538019843066,12248573844550878782,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10603657837991191778,13083137611743440278,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,4666969673259532177,1531760647668824917,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,9290930473642813949,9459237724416212770,524288 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=744,i,8652192506504595973,13398612411709963722,262144 --field-trial-handle=2264,i,2072650782823248296,17151979503330645839,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a771c494e3fd6ed8c8fbb97e7f2ed1345f751f999714162cbd28c0937bb18c34
MD5 e0cd00ab55d75ab30622825fb3cb06eb
SHA1 8936ec18f76946ca7f1c0e6d95c251f26b21c1fc
SHA512 57a44f5890d462434914cb94e3038b841b76bc0ce818260aa9f6cb70e77a5b08f4987c0aaa83df9a96674d1ad76120cf5488ef57c98c38e767a73e8aa08281c4
TLSH
T17B71A17403020061EBF09131B3E221D9B03268ECFD17AE4A705C44F82AB936DC51CD5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3823ebc6c8aff29f9ebd6f9bfb314fb2032546948ea778967cea8b4886bbf24c
MD5 4d1a91cf24d7f100cf5c6a857f3f6fd2
SHA1 32c882c4efefdd9349b4622f25b5cb207a21d7c0
SHA512 740d0530225fd71bed0dd8d540d25a51d2d6912106efddae8e0c2f6b7359272a8d4236a52ea1a011bc92d3bc20dcc1bba3b0dbee4a01145e5399fc9cfdb0a215
TLSH
T143318EF787B1456EDE2196F4A9189F1BCF2C0511436C785982D4AE27E7B34B0E012A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6c4b4395e84e4bc04f42fba40974e90abf65836d0ec763b329c2c0beef174fbf
MD5 fe0a9f2b312fe96060215df2fa263b9f
SHA1 712b9aac4aebc0f72561ff9d02017d1df82eb564
SHA512 1c2063a2e6d2461995ea79db16c000c34111d2a225f6c2ad257d4b0b99dc503344b53af23a4f9b4d73ad8da8fbd4ea84cf29dc837adeb8eb86b0395336fd87e8
SSDEEP 192:sxZ/oRVyM/jK1Ml8Mk9/fls42A8RVvIdpLlHW6+WNf33/Yvq1zFBIgrJ:sxZ/obM9/fls4yURHbv/Vb9
TLSH
T1BE52D7126A346977CCDBD20DFA45BB53D6F51562E2940E48AAFCCA0C05E6BDD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1d6bc009e6ef3a2e9b50c6f804f180de7dd4e4dfad8a878fbfb0b3da413730a3
MD5 6c51ad77eee396ed4bb1a9950d63feb6
SHA1 49001efb7912a43b1368c9f702eb9778a77d57ff
SHA512 12e1c9dcb443f6be010286980f772449fc83323610e617a0c3ff8b4d11861ac8a749759c10b1b537277102fedd65918f44202d591d3dad52e783660a7d6faba3
SSDEEP 192:sxZ/oRVyM/jK1Ml8UQwk9/flsR2AJjRVvIdpRlHW6+WNf+9XYvNM3FBIg5YJ:sxZ/obqD9/flsRXUzHbAXJbK
TLSH
T1BC52C6126A345977CCDBD20DB941BB53D6F91562E2940E48AAFCCB0C05E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2f5492ece8f05788dc43e080b1309c4a9021e15bc7deae27631ed45b18ba3212
MD5 21bc1b7f603d624c8a8bfe10476b4f19
SHA1 1e3180e796c79d2ee6782bbaa2b22fe5e47ef4a3
SHA512 4cf33b2f0e151192713345699415cd11054300828517c6ee78ecdffa413f1b2e6eecf1e250c5aa7f811adb1eafd10db6a7051596ba4ebe28bc68d4fcebb477be
SSDEEP 768:f/seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppYro9v:f/seJ3xWvhfynu1jaVcL88pj1
TLSH
T102D20A2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1ef7b7cdf820f1159a1a8042685fb44d5ff4678600c6c342d869faccc2f1bc86
MD5 46c4cd9cb8b1e34e32db246a39973bb8
SHA1 aaeb4495ef894f98ebc3fbb6b63eec872d704df5
SHA512 aae874541f67abee271889a33ba85adeb9d6784f7948451f1811950be005229c53a603d73e062d6847315bfb32021800972d6822c6c63b10bf534af092ab32b7
SSDEEP 48:KYHIhKggkXyh+IHKnKIXyxmIHKbaMA7kh1DZe:KYH+Kggmy+cKnKqimYKbaV7kh1DZe
TLSH
T13D916716363B0642387E244CB6A796379F4232A73454E8AF7FB850A50E26E116DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26d56a93-3a09-4c63-bc55-4a617c35ab3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\26d56a93-3a09-4c63-bc55-4a617c35ab3c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 db833012b53f247efc3027cffdba27b1dee623412ec49e989ceddee941cd23d0
MD5 b6cbec2b4b443a00e60195e39624b552
SHA1 5e65eb3fe0408710a0b58dcb69b0bea6fd64e325
SHA512 d21acf9192ecca9117f16e8156bdaec45263417eb819da4f247b604454458ae22bfa715f796223d907ed23982e2cfb47c4d5d829e3fa7f18be8bf7cbb7131fed
SSDEEP 192:uxyTSNWMsnMcPPQLz3XX9VofsNd6QV7SFWM7WZEQmiU1jja4MTwz+FdLD1WSJr+J:eYtNn/s3n9SfsNd6/L7mU5F0dbJr/rHW
TLSH
T1AC625C32AC74AD2B99E3A589F04B37074EF4926796C56E94E6DD6F0C01CE3AC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 8fd44b21613e89d8990ed4c275b23ae3702ccc6629fad88ab9734905f6f8792e
MD5 67470ac19f5ddcf1f540977fad36f5f4
SHA1 e6040342d761eaf3f205b8aea06f87d71b034237
SHA512 d206f1a3716318b9181b4898e699e722befa8c32d5f6c0a81f6910e6304959c6fd87dc93619e7ba12c65de6f0264b9af7aa36648270c4f84cb5e498d282d9e59
SSDEEP 384:MyiF1tNn/s3n9S0zsNn8TUNTUlIlz/L7mU9F0dbJr3rHW:M5F1j+9TWwg1LdqVh3rHW
TLSH
T14BB2F8F248D7893BD99E9747B33E2E064EBCC167B5816954B7885A0CCDCA2BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6f64257687c8b55b91bd5d52e6a0ade065134587ce3a2032a171bec4e9a5d231
MD5 afa31d39db5e01506b51e2d3ae61c73a
SHA1 a05a8684ea6a4f31e7c320eb59b1a82caa8bc317
SHA512 a310774c083e8cbe0e498db0c5de0a5f3da54e6adc78a5d052653118c91f1f9dbdeba1d017ae1dc01714d88160d87659a3d7cb1a22715694a95a5dd6e81454c0
SSDEEP 192:OONo6vMzPQmiUyKx3hTwz+FdLD1WSJr/80I0qFU/u:OONo6UzRV3ndbJrwrU/u
TLSH
T1F0121A32AC64AC2B9D93B545F08B32175EF4926BDAC5AB54E6DD2F1C01DF26C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cc078419557881db3483a39a656be60963b958b94ba784e52985f8aa80480bc5
MD5 aed459b8b6591328a5597ef72b4332a6
SHA1 be1f5e8e962e9eab6af4e56a701cb565f3b179c5
SHA512 88363dcb71977b40318cf7aef6784b624ee7031166fdba138442b6f9193efdd7042964f3ae595fc0ea027106892f10c4665b2809271551fb17919b167beec95a
SSDEEP 192:u/yTSNWMsnMcPPQLz3XX9VofsNdzQV7SFWM7WZEQmiU1bja4MTwz+FdLD1WSJr+J:UYtNn/s3n9SfsNdz/L7mUNF0dbJr/rHW
TLSH
T1EC625C726C34AD2799E3E589F04A37074EF49267D6C56E94E6ED6F0C01CE36C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92283549554f90f4dfb8a7602564814de2aa7abfefa621894beb86f27686c280
MD5 2e3b386669b8fa3370c333866c459cb7
SHA1 32946e92a67c8d16d4bfed9e3cedd3a54811430a
SHA512 b51e5802ec00db72c6342ab50560c0fd38d26ad726835595dd4d8c92e512f1f948dc9d9963adc5c30ec27b0ac54d70b135e0bf68bbacf918b5ef81ae8bcc1e99
SSDEEP 192:lONr6vMtPQmiUywxThTwz+FdLDf847j6U/u:lONr6UtRNTnd/mU/u
TLSH
T18A020935AC786C6B9AA7AD49F48A27175FA4517BE6D05B50EAE82F1C01C725C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5d716ab-699b-40de-a97d-17eac128b9b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d5d716ab-699b-40de-a97d-17eac128b9b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4b11280ff2f079673979c3f3b14452b25ed655cc607af4cb2e02bf1fc94fa450
MD5 55b382e404717c3c82d5b4cbe3b9a3fe
SHA1 28948a0874777ff4d9e03df46752ea16b46ce3d7
SHA512 119fe0ef984a3ba5677bb4edd99f24e7d3a12814b30e18b713e761ee75ff20a9fe3d962e6c4425bae11b608b528ff0e2196a19c5e87106b812914e2bb8e89347
TLSH
T1A541EB5CB7EA1148B3B76F5AABF6A86D487A7D772E06C45D10110E4E0A23B40D862B33
MD5 SHA1 SHA512 TLSH

Submit Download