hxxp://l[.]l[.]c | Triage™

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://l.l.c
Sample260804-hhh66ahn7v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5032	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302994629125488"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{744E2CD6-2349-4238-9395-992D66F1A456}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
884	msedge.exe
884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2868	364	msedge.exe	87
PID 364 wrote to memory of 5032	364	msedge.exe	89
PID 364 wrote to memory of 5984	364	msedge.exe	90
PID 364 wrote to memory of 5984	364	msedge.exe	90
PID 364 wrote to memory of 5984	364	msedge.exe	90
PID 364 wrote to memory of 4116	364	msedge.exe	91
PID 364 wrote to memory of 4116	364	msedge.exe	91
PID 364 wrote to memory of 812	364	msedge.exe	93
PID 364 wrote to memory of 1988	364	msedge.exe	94
PID 364 wrote to memory of 812	364	msedge.exe	93
PID 364 wrote to memory of 812	364	msedge.exe	93
PID 364 wrote to memory of 1988	364	msedge.exe	94
PID 364 wrote to memory of 1988	364	msedge.exe	94
PID 364 wrote to memory of 4232	364	msedge.exe	95
PID 364 wrote to memory of 4232	364	msedge.exe	95
PID 364 wrote to memory of 4232	364	msedge.exe	95
PID 364 wrote to memory of 2700	364	msedge.exe	98
PID 364 wrote to memory of 2700	364	msedge.exe	98
PID 364 wrote to memory of 2700	364	msedge.exe	98
PID 364 wrote to memory of 5132	364	msedge.exe	99
PID 364 wrote to memory of 5672	364	msedge.exe	100
PID 364 wrote to memory of 5132	364	msedge.exe	99
PID 364 wrote to memory of 5672	364	msedge.exe	100
PID 364 wrote to memory of 5768	364	msedge.exe	102
PID 364 wrote to memory of 5176	364	msedge.exe	105
PID 364 wrote to memory of 5176	364	msedge.exe	105
PID 364 wrote to memory of 5176	364	msedge.exe	105
PID 364 wrote to memory of 5388	364	msedge.exe	106
PID 364 wrote to memory of 5388	364	msedge.exe	106
PID 364 wrote to memory of 5388	364	msedge.exe	106
PID 364 wrote to memory of 608	364	msedge.exe	108
PID 364 wrote to memory of 608	364	msedge.exe	108
PID 364 wrote to memory of 608	364	msedge.exe	108
PID 364 wrote to memory of 1728	364	msedge.exe	112
PID 364 wrote to memory of 4068	364	msedge.exe	113
PID 364 wrote to memory of 2820	364	msedge.exe	114
PID 364 wrote to memory of 760	364	msedge.exe	115
PID 364 wrote to memory of 760	364	msedge.exe	115
PID 364 wrote to memory of 884	364	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://l.l.c
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb1fd0c188,0x7ffb1fd0c194,0x7ffb1fd0c1a0
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,7055689631368113438,9178845003277533904,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,9650879582993345411,6795418616228908076,262144 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,3139665183735008188,3209908391059600669,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,13063402096819911145,12885184688816770662,2097152 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1788388436253967134,7540379439464609022,2097152 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4892,i,11669922954834479776,580969416046247619,2097152 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4848,i,1854231967273811143,10011383956093933122,2097152 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,2039111773257769147,9032714128297602444,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,9502340268140243043,1360699039929069571,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,18006011375711007080,3908598643028872875,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,18006011375711007080,3908598643028872875,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6060,i,5969042914765355738,8820766936016146613,2097152 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5796,i,16068560706653426566,11296046514499133885,2097152 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3732,i,15788240396553736489,17114200511990877676,2097152 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,5069631174160081302,2325556678807683313,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10346228925442132356,18437538884738261875,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,5525061814956135976,9467835814648631390,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,13140737281287372965,15205367832165091402,524288 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,9527240785914141319,1497251256229961146,262144 --field-trial-handle=2300,i,4733122663671953632,2086326161052300382,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 74a06dcee84def3de97bc90e0b6822b0a59d64356a8522fad3b7ec7ad89ae0e5
MD5 56bf4cd286426161fa783c8aca38b356
SHA1 b539bbafd832389ee3152d1fcd493c96a0d447ed
SHA512 a4884e6f28f552130f76f3ac4de2d0687a0a10f11e2fbb95e614a66bab7c2232127a7f4e9ffd240ffc864dd5ffcc3968329f8578040e5659de618e9f32b41c8d
TLSH
T1FBE022B6C826ED7B09FE4719A10A8656E70013173A40899F7B3D910D8FF0B2A86D5D5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c6e4128c4aaf7bad9039ed7566c30a71ef4ee5fe4d6e76fa0f50000cb60c3c7a
MD5 4fcac433868a8ec090caef9a0514d9af
SHA1 e41e5a7bbc209296a9bec9c36bfd4e44fa0123ff
SHA512 ba8933f4bb59cbc865090a532515b96069dae868676076d362ec7e614c4c7be5db747fa4713e36284b68458060c6cb931d8ba4ddd8ec9e071eff71a93ad71cc1
TLSH
T1A181A23588EC00E1EBC81D727DD40805B3B36ADAFB03DE89E19044B71DF53528A2943C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eab9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eab9.TMP
Size 3KB
SHA256 f51291da9510b3cbd17da46cb9edf3cfc65f5f931bae73064cbd2a9bf4a67d5b
MD5 6db67b5446554d94cb243331d75e0770
SHA1 f6c49db3e5d07a472ee1e5b636141a79d76eacfc
SHA512 a1fbc6d2c46b3063c03f800bfcea5bde1080dfb09b2269968f84cc06bf86a9e8b36eded8198b455281f13d211316e1d4ad8f4733a2fbe4c3f7532e9a67a8bfcf
TLSH
T118715C3948DD04E2E7C80D727DD4191533B3AAD9FB03AE99E15044B76DF67118A0587C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 39b553a42b171f3b70413cd177d65cdc81965c2baffbdedc4fc832f7caf41f54
MD5 5840cbe4a149ba07727fdcb99b41f006
SHA1 b80c46ebde9110f2b1c371a68deee924b34b7b6e
SHA512 ec07e19b45fbc6991b5bc414d0d0c68b3e9de9419bff82c252c51197d132620e11a1e030cee5689a7c63c83bbb5ed62c9f6aa5fe4e859e09246cee427439d05c
SSDEEP 192:D1zoLReXeHBHwaaij6KNJVcSZyyVDypz4yFyDBS153vpGPH46PXp:D1zoLReXeHBHwaaiGKNJVcSZyyVDypz8
TLSH
T19AD1BEF683F9866EDD5252F0EA143E2BCE1D0917435C3C4B85E4AE5B97E2831E1C0A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4aa1ed2475407e90e03e8f8aea28cb29be248b8dc1d8d8abfd455c17c63b6032
MD5 1cac92ba519773f4a6356aa726995d9f
SHA1 5e97b30f25db1c7d1f16d4476a01571156b6a184
SHA512 85178b951131f4c1923d8b2ee561da15f6f91cbd8fb738533afc9da96a29bafb257fbddba06428048651c7388ef5b12dd0124ee87de3ba228d309b4c3c8281f8
SSDEEP 192:sxZoRxyMqZjK1Ml8UQEkV/fAshhbZdKzodpVjkHW6+WNbff8NZWJYvgPiAwIg5L3:sxZoKqfV/fAshhzxSHbbMSJE7kv+
TLSH
T15E72F8156974997BCCDBD20AFA85BB53E2F91173A1904E44A9FC8E0C04E7BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c4856c60e22d98006fa006d01ac27792da4ddd0c6bd26699d3c8a5285486d599
MD5 37601bd7764631d120f5d0309aa77d3d
SHA1 19bff7661191d69a07ece8172e737ccaf57bf231
SHA512 5eeb839723e92e86760bcc0ef9c2c0aba66e93484a2d037add361a3f050c0ff0b87fe348bb32c466614f6ac3ae42ebd4afedbacb8c50973dafc87ba018b8bd07
SSDEEP 192:sxZiRxyMqZjK1Ml8MkV/fAsskhzaZddzodpVjkHW6+WNbff8/YvTuPQAwIgjiJ:sxZiiMV/fAsskRaz2SHbbM/y7j+
TLSH
T15E62F8166A74997B8CDBD209F645BF53D2F91173A2904E44A9FC8E1C04E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 630bff0003c03b2d08718dcd60f15c4b4b135bc8ad2839bc7e5aec4748b8701d
MD5 ccd215af38a0a86730aa2daecc095143
SHA1 3e280a4a03c3ff648d8b5d9d13e290160209a936
SHA512 67b4eb31a8e8c44133086551b44b45b3c2f4ccb0fa3e9573c1465e374f1cdf034a325ce1be1e2288af518c36995a1e568ae3f2bf6f3d556871fb7738ce8447c1
SSDEEP 192:sxZoRxyMqZjK1Ml8MkV/fAshhbZdhyzodpVjkHW6+WNbff8Nui/YvrPQAwIg5LWG:sxZoKMV/fAshhzjSHbbMB/b7kv+
TLSH
T1E262E9156A74997BCCDBD20AF6457F53E2F91163A2904E44A9FC8E1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1bc4ba7a7d612165e2ad9bd51d5f68ca77eb3c4a965ec46e21aba12d1b708199
MD5 061b31435475fb850c4fd3eaaefeb190
SHA1 9b34d8e03278e089bc1793b8212c6d0f63040a9c
SHA512 d992d4412d1c8aed6e95a5bb17bc1c1b4a142cd1a29b56df3417a41f2482ce86119e6a8a198cd1d0124199ae8bd02c9e5a6cbe8e11e740b6104e5d5287133c30
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG0:05ppxnY753RNBvRJJdt7p5J9xxN6
TLSH
T1CBB2695A713A0211397E3988B39696364F4235A37058E4BF7FB814A14F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2ab3591912c81d9fa49f1d07540b2ebb8aed7235fd5c2ca459900a566799350d
MD5 c960ae082fd3bbbb28ea8c022f9abcf5
SHA1 025a3f09e50faf34ca009edd5b9724d68d759616
SHA512 30b90c171d0f08b2c773fccac5b72c553901d05d88f8142966c11575bcf0475507640fd9c2df42ec3f75f3230788de3354d927b8d4d81551159012067f2d63a7
SSDEEP 768:AFQdQwgJk+ibGCtD+qEip0M1KIcTjKgqmUchOGx:ZdSOtD+qEiOVigRUc8Gx
TLSH
T188D25A32D864DABBFDE79BCAA75A3A079EF0416389C89AD4D6DC2C0D018759C030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2fb6534fccb19ce5057f589c2dddf883bd4d9b55dade0c32b89ee0673df6f25a
MD5 1f92c5ab18275388253aa2a3f9d93ae1
SHA1 fc0fab20e8b5498b4e18cc2fa61a559cf47fbaaf
SHA512 796516e5755d57cdc52dcc28eb44551883cdf37b9bc92764e17ebacc36bef4975ad3454137496e9277deaab4092d9592102c4c50124b50c902f4b8a51864b37a
SSDEEP 768:p1Fccps3gwgbkUAPbGCtD+qEip0MdKIcI8p0TLY:Ps3SKtD+qEiOfI8p0TLY
TLSH
T18AC24B32EC64C9BBEDE34B89E75A3A07DEE4526385CC99E4DADC1D0D01971AC430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 655af0f3429749c81d4e2dd214567774e2cae3ff8879233b2c387d8215661902
MD5 9a9663c1ed9b1b4d694553bc3637f7d4
SHA1 4d3e2cfd5939fc85afb5c6dae74f6cae01da55fc
SHA512 38719b25efe1b02ba315c1ff5554dd07b2ff5462b5cc2bcdb737994088c0448baf3d0016239b1293c02aa1599d427b90ad643d6dd966c087d6a2ddd213238726
SSDEEP 768:pcFccps3ywgbkU1kbGCtD+qEidTI8p0TLY:Ks3UMtD+qEipI8p0TLY
TLSH
T1CBB25B36EC69D9BBEDE34F89A75A3A07DEE0526785D899E4CED85D0D00831AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e988e3945560214e694b8903a912b67f85a50ca8c927f8cc15fc4dcc0f8ac155
MD5 b0e1478856394b8a32ee3251686b8275
SHA1 8328011799690eb49ab820c6f21fae6a900b3a06
SHA512 f90380a9f2c8b1cd458d16ca9339aead8bcc8e9e800fa03d1777eac23903c799c4b08762f08e5574814230b470ce141f850fa337fb45cfdc8e3b35cdaf4da383
SSDEEP 384:npqiF9CcmyWCr3sNV8TUNTUlI44QckCrjoEpv4fmGCtFh+qL6OKip0+j1KIcZty3:phFccpr3Qwg7kNibGCtD+qEip0M1KIci
TLSH
T11CB23A32EC64D9BBEDE74BC9A75A3613DEF4426385CC99E4CAD91D1C018B1AD030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2046f2ff196eea33052c362a9398295d30c8b368f29f754735510b57592f2744
MD5 35c05050ff407490b6b4aeda55fb7f97
SHA1 7b235630b7340b568446db2ea05e36e6419d8dfb
SHA512 7d60fc209a44f93c0aeb7e5adc9dfc37bfbf77dbe000e088ebe1db3e31d57bef7660cc229238339c03c1812e445690305437bbe2760ff109cd934a198ef63919
SSDEEP 768:vFQ6QwgJk/ibGCtD+qEip0MtKIcTjKgqmUchOGx:a6SRtD+qEiOTigRUc8Gx
TLSH
T11AF2C3F198D78977E8AE4B87A77D2E029AFCC153B5885990B7D81C0CCC861BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 678b89b0534f2ffdbf3ad4c2399425d6dae4f55ba3816447cee48fb380d74ee2
MD5 3c625368f3994c965b96750dd260240c
SHA1 5bbc191dd589e25cce3fa58492969d78afe8c8a8
SHA512 5b9c924b190d890bbe032b8483addd1fca7d2db2606e43593c2d47c1b818f2eda3be2c779dae0163a4ed6caa4bf47bc69fd75320b712c7ae9e5340091996c5af
TLSH
T10541FB58BAEA1154B3B76E569BF6646D487E7C772F06D49D10010E8F0A23B40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download