hxxp://litiges-sav59comines[.]pages[.]dev

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://litiges-sav59comines.pages.dev
Sample260806-fd62batbnf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3004	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304651965668918"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{E7349985-1AA9-468C-8463-EC96ABE8522A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4864	536	msedge.exe	85
PID 536 wrote to memory of 3004	536	msedge.exe	87
PID 536 wrote to memory of 1632	536	msedge.exe	88
PID 536 wrote to memory of 1632	536	msedge.exe	88
PID 536 wrote to memory of 1632	536	msedge.exe	88
PID 536 wrote to memory of 3328	536	msedge.exe	89
PID 536 wrote to memory of 3328	536	msedge.exe	89
PID 536 wrote to memory of 3436	536	msedge.exe	90
PID 536 wrote to memory of 3436	536	msedge.exe	90
PID 536 wrote to memory of 3436	536	msedge.exe	90
PID 536 wrote to memory of 2448	536	msedge.exe	91
PID 536 wrote to memory of 2448	536	msedge.exe	91
PID 536 wrote to memory of 2448	536	msedge.exe	91
PID 536 wrote to memory of 2068	536	msedge.exe	92
PID 536 wrote to memory of 2068	536	msedge.exe	92
PID 536 wrote to memory of 2068	536	msedge.exe	92
PID 536 wrote to memory of 764	536	msedge.exe	93
PID 536 wrote to memory of 764	536	msedge.exe	93
PID 536 wrote to memory of 764	536	msedge.exe	93
PID 536 wrote to memory of 1748	536	msedge.exe	96
PID 536 wrote to memory of 1748	536	msedge.exe	96
PID 536 wrote to memory of 1748	536	msedge.exe	96
PID 536 wrote to memory of 4180	536	msedge.exe	100
PID 536 wrote to memory of 4180	536	msedge.exe	100
PID 536 wrote to memory of 4056	536	msedge.exe	101
PID 536 wrote to memory of 4056	536	msedge.exe	101
PID 536 wrote to memory of 2956	536	msedge.exe	102
PID 536 wrote to memory of 2956	536	msedge.exe	102
PID 536 wrote to memory of 4984	536	msedge.exe	104
PID 536 wrote to memory of 4704	536	msedge.exe	113
PID 536 wrote to memory of 1028	536	msedge.exe	114
PID 536 wrote to memory of 1080	536	msedge.exe	115
PID 536 wrote to memory of 1356	536	msedge.exe	117
PID 536 wrote to memory of 1356	536	msedge.exe	117
PID 536 wrote to memory of 4796	536	msedge.exe	118
PID 536 wrote to memory of 4796	536	msedge.exe	118
PID 536 wrote to memory of 620	536	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://litiges-sav59comines.pages.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff8924dc188,0x7ff8924dc194,0x7ff8924dc1a0
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,347639623061277347,5539122670291786732,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,2923674271643387799,10574649691069271307,262144 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,5070225249034302184,2769431974215322511,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,3192917097768636071,1039499292196442592,2097152 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,2286422853319320881,2591866989343071527,2097152 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,902021993395073897,16011806580443240185,2097152 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,15398943922093946403,10374583258341767360,2097152 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3796,i,11762935838404538934,17544712775355011769,2097152 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,17030491540053465444,16392142979909910398,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,13653267190153494953,17734403955079825877,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,28503922263942914,11368108184109672166,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10719915225590081856,761155959308608061,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10719915225590081856,761155959308608061,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,3310673872908118639,5199486113505127115,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,380910043056992271,5500143807875384995,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15150780964360304345,2370114847833085955,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,3652125586225031058,8549227506283627240,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,12484123253999138124,9395292046954584304,524288 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,16383232961946386315,6152927908978879886,262144 --field-trial-handle=2904,i,3512866035096993792,17293681800188674772,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f881497a94c5e9fd3a193112d5ac4eec835d21ecd71f3520112ffc51d32ed3e8
MD5 f3952ac0c0a91e2c8a6adaa292ca1c71
SHA1 6b9318c96187aa3d63b78c632b64c18560fb3b20
SHA512 00dc8fd5f2929939019f4486629a5cf87dccdc24ed9e5541d37511d11c0f5e78c4c0641e95d650a4827c6f78961d993f2856066665220054aa7c4d1cd38d1177
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c43cbfe598af2c9ac9bc1d2a76c44a4fca0e6e1856ad18a50ea635dcd5baedf7
MD5 36cdfafb6b104b06bfe0d24a2918d00b
SHA1 74e62e80e6b2350272fd29f656a36e6b32b848ae
SHA512 236b686092c62b79b5f8d0a6da9b18bd274d4f289a3862e4020805043654fe693a486010f8098205072012b2e8e12871152cc0b40559775e1abc6fb0ceb3849f
TLSH
T1EB71D4C4F1759896D3A2833DC2E1CA6534749B9B0B4FDD4B0660863DE90FBE753AE118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5924e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5924e3.TMP
Size 3KB
SHA256 0a0bdfa9f25b0e63bdd242ef26964a5fab8ef457acdc29c675c9a3f361c7837d
MD5 e558a1b327ccb7ed9f67dbfa01015ca5
SHA1 dc2de6047e52c8aafdf5141e340100c863e6f929
SHA512 cddfa0ec7dfce19b007522594a5b10e0b245734721bdc2285d6dd73abb138a4f9eaedf2a8a228632d8db0001283230746bfd0ee9249f1b96b109b3630a0445e0
TLSH
T1307192D4F1759896D3A28379C6E1C62434359BAB0B8FDD470660463DE50FBE343AE118
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 657a859e12fbd302a387b23a98ae0d8f5d79e4e3e259b0a7e2965929a9057eeb
MD5 c13f7d5d7ab368ddc83630c525bed64b
SHA1 0cc6ae6a7e05e02cfd0f162c091b6dc083fbda3e
SHA512 a90485567c544284e6b588e9659a9addfa38ea4c03f5c147b0b599a436aa144a813ea61e327588b3205f7b41eaa22d405bb1fc953ddf3da5830c16ab032dd4f6
TLSH
T1CE81BEF6C6D5C12E9A1256F09B243E26CE19051853B83C1F95E4EF8BB7E10319282E9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 01edb47f9508fc80a9b4759208c06d9475ece918043fe5b8c77d6fd7d51bdaf8
MD5 6dcd84f1192c46aadcfb577d386984ae
SHA1 53a059bb22336044fb7b16e4247790b728460ee3
SHA512 d5910c3944a5e3e3bc93d08123bfa5e02a60971034d33705a47fbbd5131db177c582236cbe41ceedf433c95fffe65e1394e35a67603c914e5f49433276b564f8
SSDEEP 192:sxZdRqyM/jK1Ml8Mka/fVsSVsTIdpWRHW6+WN1W2/YwaMX3IgrJ:sxZdQMa/fVsSVsMmHbx/V9
TLSH
T16552F911AA34AA77CCDBD209B955BF53D6F5053292900E44AAFCDA1C04F2BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 03d6dfd28d4d896e05aef5a5345bd5c6d1a055da6e80b4bf1edc202ce25169dd
MD5 05c395df183dcd75a16e03db90e330b8
SHA1 0761a03424e8d828c54c6b82866c45db961b4494
SHA512 a031ba5b96e323104887c9bd662c351207ef48e80ee4b78c2a8fe3eebe38cf1872700410757227f412a1452a005e7c3ad1a8393d6e39383057eeb030f46158fd
SSDEEP 192:sxZdRqyM/jK1Ml8UQWka/fVssVuTIdpURHW6+WN1W2/YwjVv3Ig5PJ:sxZdQq9a/fVssVuMsHbx/73
TLSH
T1D652D611AA34AE77CCDBD209B955BF53D6F5057292900E44AAFCDA1C04F2BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e2d1a39f0bd5bbda3cb288c0bd2017bb463c178f21a46a5f0e516d8a81fd25bb
MD5 3c073f0e2bab2d335dbd2c6b9067d48f
SHA1 537083d5c5a2e5a7a21cd0895671f52a7dba46d7
SHA512 2b4d4f6f7b1deba09e6007e50dc9be5045534a95060b3fb1bc83c6c2b1ebbd1fd58f4977d294228d31b9f4cb0d9a7934e552b49d277d2f86a9be767e0b80e8cc
SSDEEP 768:Cv4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dtrohvcLTa6:Cv4jeXmWvmKLEu1jacPLZQdG+N
TLSH
T12AD20A3B284CCF7E4F844E5CEC2AAE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 44fa34cf1d5ed1dd9e1f3962d709091333e3b0228499ebdfa573ac12d5855bb0
MD5 49364d88aaf472b05475ebcd8c96050d
SHA1 d0b2efb31ef01241ae6fd3051ae278b181df95c0
SHA512 21eade807c54242d2c082ae5e35df1c30107763420e46571c92a9d056078be9fee02ad57324438ede64a51654cd383f045e6e4f11a89f7626d119fa7861a220c
SSDEEP 96:KkHC7ntll+n1AldH+KFLdB+pfHoxXfm3uKQ4v+kKLCe1:zHC7ntll81A3HHLdBwfHoxXfV3r1
TLSH
T12B91664576BF42023C7E291C9694CA671B827A733108A43BB7AC41B24D67E660EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50cade33-daed-493d-bc88-f9785d7b4fd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\50cade33-daed-493d-bc88-f9785d7b4fd4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8568070bc4f34139196bfe2dbdd7f7104f9a8367ac3923822c4a7de9fdd39e31
MD5 b71c66a80c5748bc04a3f41460025c13
SHA1 fbb0c60863aba8ae0480d1762d09e186a89d7e23
SHA512 7a4b95d93c2b8d3619ea915e0451ec4df33b507540a58bacfbc0df5d539aeb8a62074ef71e89e871741bc6a5d0a55eeb07bcfc8cd57c6357b87605b286c3b6c2
SSDEEP 384:0ZcIhsNYyq2lUOf++BO1/chFZnTKwBODNZOCngm:yhuo+TBO1/c7ZnewBKZOBm
TLSH
T1B6928C72683CAC776EE6A545F84736034EF86133E6D53F98D2DD7B1C04A9698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7bd3ea5f4c1263286e56b8cb4cff56a5452034a42ca469550ea979a19800c638
MD5 7036c3d9c0637892c4f77e10bcf3e153
SHA1 43c8d3007bbf897589971caf1d2becb16ab4ae2c
SHA512 fe4ec45c89718dd9cbc7842da7b0fadd5f1973ced7cf7e24946dcbcf15391201dfa30f79101975ecc75d3232fa246d6661a2da3f8a9bc093c8b56b6d01a8cd1a
SSDEEP 384:eiFiZcIXzsNI8TUNTUlIla2luOf++BO1/cLFZnTKwBODNZOCngm:1FQDVwg4+TBO1/c5ZnewBKZOBm
TLSH
T1B0D218F248DB9836E9AD5B47E73E2D034DBCD163B4946A94B3886A1CCC551BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7d7a286affca8955c6ed0a6893775dedc8af3813e3fc23985546377b06be7564
MD5 633b0b3bd8e5b09201d84a15fb645333
SHA1 0ffca7ba5246958a1fcf8ac62a9404d581177036
SHA512 dff33165ac28a658ef7cb86888ce609536de1f1155eafaf374e69737a0b729bd309d1f8dba46137f70c4c9546ff3ad4f944151298c666fa7baa358d8d0a89b24
SSDEEP 384:cZcIhsNYa2lUOf++BO1/chFZnTKwBODNZOCngm:KhM+TBO1/c7ZnewBKZOBm
TLSH
T19B927C71683CAC776DE6A545F84736038EF86133E6D53F9496DDBB1C04A9698130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5593c57cfe13dd19ef029f2426d1a05dfccb0b9f97e9fb5a20d69575bc989c2b
MD5 71e72c3822436937a1d981c46def8c6b
SHA1 f2e74e0e3373b5ec573c38ca98af5d36ac13b40f
SHA512 a31b06ba1ed2981bca08a209fd999127feeb9154ffabdf55be4f0c4b291aaa72184643eaaf84deeafea43bdf6d454b356071819a22c4c776ab01bfe06d0db5dd
SSDEEP 192:EONI6hZ0QmiUyHhpc/+jVEBO1Tm65wOZKgfrU6:EONI6oGpu++BOU2PDU6
TLSH
T14102D835A86C6C778EE2AE45F48727235FE4212BE9956F84D6E81B1D04C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad2c8496dc5653996664ffa8d1503ecb035f80b905edb5ffecec40df1b9a0128
MD5 e31a7afaf639e6e9a72a230a5041877a
SHA1 2985f233917a147eb02776b24944dbcd6626e4b3
SHA512 3e62f9d4bd0e4ce339bd369d07b2db352c8a239b46bb8ee3768df66782179376fa6a37fe138cdbc67c7c198c1ee0a39de7939520f93c8cfd3665944c29982a12
SSDEEP 192:QONZ6hZpQmiUyyhqc/+jVEBO1Tm6//El5cOq9qwU6:QONZ6jVqu++BO1/cA9ZU6
TLSH
T1431209326868AC771DD2A985F48736534EE5522BDAC97FC5D2DC2B1C04DF7AC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab68b9e9-d18c-4401-bd7c-d8ce218ffd92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab68b9e9-d18c-4401-bd7c-d8ce218ffd92.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6ff86a7ca9c58b97376752e287a09c23b3901a80f19379d9fbe2ce74fdeab7ca
MD5 733a4f7a5235f5e494b43039287f7429
SHA1 f3ecaaecafb77e20b058bf464751f1291edbbc45
SHA512 b70985505f5d327b3cfb801737db4c50c56eabef74823a7a8b3500fb118a35f4373de9bf9116e094894616d4b56a375f467b7fb25bed8fba3e0b247959d917b7
TLSH
T10541ED5CB6FA1158B7B76E5A9BF7686D447E78372F06D49D00010E4F0A63B41D8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download