hxxp://tristar[.]besmart[.]co[.]za

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tristar.besmart.co.za
Sample260721-stem8abf84

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291210937308660"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{922C3A18-B0B0-440D-B2EB-DC01D5FC1229}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3788	4788	msedge.exe	88
PID 4788 wrote to memory of 4312	4788	msedge.exe	89
PID 4788 wrote to memory of 4792	4788	msedge.exe	90
PID 4788 wrote to memory of 4792	4788	msedge.exe	90
PID 4788 wrote to memory of 4792	4788	msedge.exe	90
PID 4788 wrote to memory of 3124	4788	msedge.exe	91
PID 4788 wrote to memory of 3124	4788	msedge.exe	91
PID 4788 wrote to memory of 1652	4788	msedge.exe	93
PID 4788 wrote to memory of 1652	4788	msedge.exe	93
PID 4788 wrote to memory of 1652	4788	msedge.exe	93
PID 4788 wrote to memory of 508	4788	msedge.exe	94
PID 4788 wrote to memory of 508	4788	msedge.exe	94
PID 4788 wrote to memory of 508	4788	msedge.exe	94
PID 4788 wrote to memory of 4416	4788	msedge.exe	95
PID 4788 wrote to memory of 4416	4788	msedge.exe	95
PID 4788 wrote to memory of 4416	4788	msedge.exe	95
PID 4788 wrote to memory of 1340	4788	msedge.exe	96
PID 4788 wrote to memory of 1340	4788	msedge.exe	96
PID 4788 wrote to memory of 1340	4788	msedge.exe	96
PID 4788 wrote to memory of 3756	4788	msedge.exe	99
PID 4788 wrote to memory of 3756	4788	msedge.exe	99
PID 4788 wrote to memory of 3756	4788	msedge.exe	99
PID 4788 wrote to memory of 2144	4788	msedge.exe	100
PID 4788 wrote to memory of 4232	4788	msedge.exe	101
PID 4788 wrote to memory of 2144	4788	msedge.exe	100
PID 4788 wrote to memory of 4232	4788	msedge.exe	101
PID 4788 wrote to memory of 4504	4788	msedge.exe	103
PID 4788 wrote to memory of 4448	4788	msedge.exe	115
PID 4788 wrote to memory of 1716	4788	msedge.exe	116
PID 4788 wrote to memory of 364	4788	msedge.exe	117
PID 4788 wrote to memory of 3896	4788	msedge.exe	121
PID 4788 wrote to memory of 3896	4788	msedge.exe	121
PID 4788 wrote to memory of 2844	4788	msedge.exe	123
PID 4788 wrote to memory of 2844	4788	msedge.exe	123
PID 4788 wrote to memory of 2648	4788	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tristar.besmart.co.za
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffaf7dbc188,0x7ffaf7dbc194,0x7ffaf7dbc1a0
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17210690799480300278,11884213404772134615,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,13021787167722359503,4283993842699681816,262144 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,1530999065370329690,14369039482706389958,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,2628345076304073630,5714761266397737487,2097152 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2221622467688580923,1759454338854473746,2097152 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,7467282495795888279,3258401411226019490,2097152 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,14520850472177549018,13762910673627594706,2097152 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,14172315937930538978,12503217111199023056,2097152 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,10989659792547154887,9935339700185200692,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,3282727434928581539,16307158370074284568,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,11512368344548852055,495286693622754099,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,11512368344548852055,495286693622754099,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,391126583464032806,8174489430840988770,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,374039560938947991,14351096868844102793,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,2665258657590260981,7590683755804860354,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,12471207375393389541,9162699434602530648,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,4300019512712606750,17394086547339719502,524288 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3676,i,16315460418149645956,12179296005731515769,262144 --field-trial-handle=2176,i,17609008531391955962,3649255935122675418,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3bc6f5c22e10305be021a6318b0eabf0a6abf49a3bdc5b39af41db7ab0278e3f
MD5 04168e374d81980fc5f3466ce4149565
SHA1 292f2330e00859ee9546278a7256f137039595ee
SHA512 87855cfb3a78e7d87b2345fa049ddcadfc780ea959a15238de760aadddea6c61d083e45f41ffc37deb36919420f10e888485a11d7239e8afc3ab6380c8ac066f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T132B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2763c663084704f2ed19b175ada90941df007aeb259e8d60f389d2148b64d853
MD5 48d00f049a62ec426644f8aaadccf226
SHA1 63c258bc153aa2325dfe6d47def9916a2f16121c
SHA512 cc07c0bb15b35212b98d89d34caf84ebbe4a0abd9049fba0a7dcc7c080522b9e5355cba00397369989fc603f6e81e5a349d960ba4dbab0df34839da4387f3a87
TLSH
T11F717F59C65D0D91E7601DF9EEF2B27130B285C809A3CED5A61049FF670ABE98C6F807
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58538a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58538a.TMP
Size 3KB
SHA256 dc141923b5024d817218426bdc06a4f85ab496c941cfeffacd0190446ff3f303
MD5 0e8a0f1f17374115995903f0be29034a
SHA1 130027df25a87b4b72fc6470d035e8a09bd9587a
SHA512 ecfe481669ed231889e40d61a084252cc11649330797b36eee2d51b5365d261c55979f3547a447bbc49f0e9ab2ed400521dba1ae784d272568107a9bd9de402a
TLSH
T108717E59C6490C91E7601CF9EEF2B27130B285C809A3CED5A51449FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f13f6acf997a2e7c249e303e9cd245bb8f04492678e0b180322c699c2fa71d50
MD5 ef678e6eed2fe33689f3c04f6bce48c5
SHA1 73f3ddd69232d6c71bd993a8f2acaf27f3fb97bb
SHA512 071d37ab8e57938d1f5d2881d12b349069d5986984562c8b4d352ef73f10495f58372d1e1cc3c9c6b24ddb075f9dab40e446c646ed88e495722a3c417adea3a1
TLSH
T129117DF3C7D595AEC90116F06A24BE2BCE1D0606832C7C5685D4EF2BD3E3475E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0e93cacb0cceb04f2fb8e2834eca7aa3e6b33f8e086a876b6d18938488f45c83
MD5 08062e8a8a09148a30aba9aa9a81af89
SHA1 8632f06d47f1177b23e883f93af0f740a5bce271
SHA512 d7b5c1e75c13fa79b7db15404bbd79b632f5a4b98126dd68b7239baaa763101177a9c1c5444d500da3ac5f19d2c5fab99a7ad82f911b167073f833d0bc68417b
SSDEEP 192:sxZHR/yM/jK1Ml8MkJ/fTssInIdpGNHW6+WNObQ/YLalHZIgrJ:sxZHxMJ/fTssIoiHbB/f9
TLSH
T1A352F916AA34A977CCDBD20DB955BF53D6F50472D6900E44AAFCCA0C04E6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2368e6d8a12965e605faa1be8b57a3aa0e823f14a567cff6c86cf07e3734c21f
MD5 a3e10914dcc06b363e79ae59ed31eb2a
SHA1 768c9096e59670dce7d3b06b7482c8c374df7a3b
SHA512 123864cf41adfe0ccc851d175b593609378889dfa978baa9fd1b9df57d121d261de4326ce7bafb79252033874ebd8a0e97195435cd72ad67fc8fc75e96f2397f
SSDEEP 192:sxZHR/yM/jK1Ml8UQRkJ/fTsMWnIdpkNHW6+WNObQ/YLuBsfZIg5lJ:sxZHxqiJ/fTsMWooHbB/zQt
TLSH
T18852E816AA345977CCDBE20DB955BF53D6F50472D6900E44AAFCCA0C04EAAED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 98314213a95e2dc27cce8b1a8d9358c18ffc1570c5ba986b841d04db2a4c5601
MD5 c7cf75c47ae969b2bc7cc1f7265c9948
SHA1 4951f2d69ef78d6d634e25621c517c26267e0ce0
SHA512 b6fd78d346ab6fb412440c5d6adc373c20d1578d764a8a31b2d5a94b5d618b24bab09b9843a706f1a0878bb90d7b606581435a1fcc0305bb36d54843b3cce540
SSDEEP 768:4as6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNDrojNX:4as6pD1WvxzWju1jahILIsNwpX
TLSH
T174D20A3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 3ba510e6c78cfd8842df9edcd3b482f70a7f837f1d8bf29e4cf278907d5364a4
MD5 57fd51fd96bc5d5bc6c16108f20a9295
SHA1 eac47a8d245c3e13e4e575138b3c93c1fac67406
SHA512 afa8a4157643d8c5b4d8a6146e4328e8da59c3ec4c57e63d688ed51f3c212188af524cd7a777b1c458703eb1eb2da5131218f900d95c59fced7bb63e6a07bfa7
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8wY:KUAAKtePiwQKFWvC6EKfKuurmKA8P
TLSH
T15EC1EC1271BB0A023D7D2B0CA265872B97427273305CA92B3BED44754D6AE394DFC6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f306.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f306.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5a5c69d21c76fb8f0a9837ae65e06a76c917e2d0098c6788efb93d4c8a700804
MD5 df1b2c2ab2f8b8b0808afcb2c82e9b55
SHA1 fec45df59f89aeaf65c66f280f36d733862f7adf
SHA512 3f3a696d7af3d40896f259e4b4aa58af367cace0b1a0eda744cfcdacf2d8a36c6629a12a0c30e87bf727bef229732489f01a6a63261c676a813c60378db7bf3e
SSDEEP 384:CtNn/s3n9SfsNrQB9yhR8a99d/VffcKDVcl1lIO7w/sOpdH:Cj+9UL8lfzfcKDVcLCO7w/7
TLSH
T1EC928D36A8B96C675EE2B545F507360B5FF48477DACA2E50D0DC6F0C01DFA6C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c4f3788bbc6c52af137f662bb43b8dfd66893350381de14ec26394d96611dbe8
MD5 5c8b9c682403294b43f94f62ec07cbf6
SHA1 244e7da8a21b76dbab2ec6dcab660951d6f9d0ac
SHA512 cd9980dc0c77ed159458211d1dc162db5c07a29df814393cef87859803b2a2f42b499c9777f303f992d9311c9f9aff674eddde071e3019801afa0457cd0dccd8
SSDEEP 384:jiF1tNn/s3n9SelzsN18TUNTUlIlFB9yh78a99d/VfUgKDVcl1lIO7w/sOpdH:OF1j+9lgwgrylfzUgKDVcLCO7w/7
TLSH
T1E6C229F658D75836DAADAB47F73E2E074EBCC067B9856950B3885A0CCC8A17FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 670f34fbe8a35dbab0b96a26fb2d729845e5a619a922883792fe951b4424af76
MD5 2bdb1ddac24cfe219466387465102615
SHA1 98a97b997d1c370165eefde5d3208231cd3a3421
SHA512 616e2e406729bd48594fd647903d245d20066d04595a39ddf6712f3a2da02c3c3f2aa0d63333439b001137ae2e4266fce6f9f3ef9b6844c6bf264cd0daa59c68
SSDEEP 384:0tNn/s3n9SfsNrFB9yhR8a99d/VffcKDVcl1lIO7w/sOpdH:0j+9UI8lfzfcKDVcLCO7w/7
TLSH
T165928D36A8B96C679EE6B545F607360B5FF48077DACA2E50D0DCAF0C01DFA6C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9d03df598778d171f6942d387a6b43e31f6a8f080a26ffac6ee3e61c6c59b4b
MD5 d19c6818194594dd6bf19709691f9a9d
SHA1 5d8e1e382c05d0f127cdfeb0cfb7fc325f76eeda
SHA512 11df174bb90890bb460d8de43657f0366effb2adc934867335b6d09e0b50565170349fd1f22d9f9f8b152823e57f42bd28c3b9e64670f3d710a838c0c3ac510d
SSDEEP 192:qONt6O7+3hQmiUyRjGttb0j+Fd/9UgGm6W8rU6:qONt61eGt99d/9amt8rU6
TLSH
T17902E835AC786CB78EB2AD49F58727235FA5117BE9962F81D6E81E0C00D765C2343C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85df75f9dbca2cc4f5e8bd87a314c78fca831114ef3794333b2efe5dae657569
MD5 fd60354581e3f84b8fdb0c81128f43f6
SHA1 31515500fcd14cd2cfc76f65322212fdef6913bd
SHA512 032929f923e8a10e9a22748d39cf932a7998ed5661fff5fff18067111640644d1ba12adb61104c922ece6f18c8ab3fc1beeda35ad5222e3b6f07288342a528c0
SSDEEP 192:UON+6O7+3kQmiUy5jsttb0j+Fd/cQzDR7cNmqMvU6:UON+6e4st99d/VfyKU6
TLSH
T171121936B8A86C675EA2B445F58736135FA54167EE8A3F80D1EC5F0C01EF96C2346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a0d03c4e95e0dc96c14c1db35184f14afc90d3b5d6088d51ca95b80f36ec2054
MD5 08819122077615f1bde6eda7e3d2b8f4
SHA1 35394db098b6811849be8178f0561161fb8e6507
SHA512 ffe0e6a9fe77a376f76443ec59eefc90db8ae2f96e3b11d82e6765a4b958e8a489cce5570ad078778a8e603e48703534598f0c794e0537d8e00d62b760274331
TLSH
T12E41FC58AAEA1148B3B76F56ABF2786E587B7D773E06D45D00010E4F0626B00CDB1B77
MD5 SHA1 SHA512 TLSH

Submit Download