hxxp://www[.]badmintonwycombebookings[.]co[.]uk

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.badmintonwycombebookings.co.uk
Sample260907-slbxcszalg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1056	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332675506413136"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{CD98A7D2-5A3A-4BA2-827F-C3939328F022}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2600	4904	msedge.exe	86
PID 4904 wrote to memory of 1056	4904	msedge.exe	87
PID 4904 wrote to memory of 4732	4904	msedge.exe	88
PID 4904 wrote to memory of 4732	4904	msedge.exe	88
PID 4904 wrote to memory of 4732	4904	msedge.exe	88
PID 4904 wrote to memory of 2160	4904	msedge.exe	89
PID 4904 wrote to memory of 2160	4904	msedge.exe	89
PID 4904 wrote to memory of 2948	4904	msedge.exe	90
PID 4904 wrote to memory of 2948	4904	msedge.exe	90
PID 4904 wrote to memory of 2948	4904	msedge.exe	90
PID 4904 wrote to memory of 2056	4904	msedge.exe	91
PID 4904 wrote to memory of 2056	4904	msedge.exe	91
PID 4904 wrote to memory of 2056	4904	msedge.exe	91
PID 4904 wrote to memory of 2288	4904	msedge.exe	93
PID 4904 wrote to memory of 2288	4904	msedge.exe	93
PID 4904 wrote to memory of 2288	4904	msedge.exe	93
PID 4904 wrote to memory of 1236	4904	msedge.exe	94
PID 4904 wrote to memory of 1236	4904	msedge.exe	94
PID 4904 wrote to memory of 1236	4904	msedge.exe	94
PID 4904 wrote to memory of 1528	4904	msedge.exe	98
PID 4904 wrote to memory of 1528	4904	msedge.exe	98
PID 4904 wrote to memory of 1528	4904	msedge.exe	98
PID 4904 wrote to memory of 1544	4904	msedge.exe	99
PID 4904 wrote to memory of 1544	4904	msedge.exe	99
PID 4904 wrote to memory of 1796	4904	msedge.exe	100
PID 4904 wrote to memory of 1796	4904	msedge.exe	100
PID 4904 wrote to memory of 900	4904	msedge.exe	102
PID 4904 wrote to memory of 3704	4904	msedge.exe	110
PID 4904 wrote to memory of 2580	4904	msedge.exe	111
PID 4904 wrote to memory of 1820	4904	msedge.exe	112
PID 4904 wrote to memory of 4268	4904	msedge.exe	116
PID 4904 wrote to memory of 4268	4904	msedge.exe	116
PID 4904 wrote to memory of 4708	4904	msedge.exe	117
PID 4904 wrote to memory of 4708	4904	msedge.exe	117
PID 4904 wrote to memory of 4844	4904	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.badmintonwycombebookings.co.uk
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff88f74c188,0x7ff88f74c194,0x7ff88f74c1a0
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,1827159422895958889,5483139580894412004,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17915001336360051112,4977291549031798882,262144 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,16785180227333559400,1151985011047052253,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4706250721623643026,1274837680929109692,2097152 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3232614112930299328,15377058708214762562,2097152 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,18383902162365950462,9017212749476254923,2097152 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,11237010869638950454,14464145394035795627,2097152 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4988,i,11379455369414996484,5461810974850511831,2097152 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,12798310928377337105,16051444057785657179,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,5121179931793529964,1116115132881561235,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,17549457452828449066,4214193260091875552,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,17549457452828449066,4214193260091875552,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9965424023671526456,9372593878597200438,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,17825988871395764441,9384212959665023355,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,13974085255994625745,7442809923938009157,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,5034676013309811628,257547070995770346,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,2299315779135991350,4251773894806453990,524288 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,7968371512526312922,3213325140317721840,262144 --field-trial-handle=2320,i,3183074968337530776,14598086912219999227,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 68KB
SHA256 6eb1dd439a1876980f04c603795c626956bf8e28dc71981367e5becd29e84964
MD5 eee9226c95fd88cc2b1366644495d03e
SHA1 8a97fe976a08c27288ddbc576d45ec6f088611d1
SHA512 941f4d81f3eb58f0f058f7973cd6a58124ffed526085bd9abbb521d1b1b061837af182c82f877f98c6904d5c09116b11dc00f3442eb5ad1736d7eb8a16df3b87
SSDEEP 1536:sxJ63QcQjbcz+HOvIHFVa4CosRQ6qqQ2yBBBBmb31OuY3Vp1nAUUQzDQ25Gn:sxICIzYOvYLaCsRQ6qlfBGYuYlp1nAUg
TLSH
T16D6302A94C1969454553DD71E228492CECD3776F996202C823762613CBCD380BF3B2EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 24f63e77319a56697a6014e63918492f6c1203526d51c174b261fb8dbd473da1
MD5 01a0d474a8bb8638a14a1e3c0919a8bf
SHA1 79d72540fac370059eabe143492b047e290d7798
SHA512 3b0c1bf4cc2efb106f428513144fa8ebefca020ef6dbffea31f1244284472a009c952f6625544aff1cf2735217feac03bf1cfe0503e00cb80f44c666fff07957
TLSH
T16F816F7445A212A1EB910272E0D36E41393399D54EA3CF2E527FD7FCE631BA68C6D048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59160f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59160f.TMP
Size 3KB
SHA256 dcd75da92166a20ee787f7259954d8df7e0f3559e329a456b993bd54087f81c9
MD5 b0280c9939eb2b17d6c586d070af4d23
SHA1 76e57a7bbe1adaf7bd4e88555b192f9439ba77be
SHA512 16482c50e77ce249efedd5c289dbce93dc96616e025f71e1eccb198c52b4ce96000fe00796af86ad5b7565bcfb27b2daa5fcf51625dc91f97a35b13b25a60435
TLSH
T1DD613B3502A113A5D7501572D0E36E0539738DD94EA7CF2E527F9BFDE635BA28C2E048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d6d14feaebb2392003dc1ffefe6cf47f9a22a0fc1479236ce9dcccc30e46d9e1
MD5 89ab65031ecf1cf7d9ff7c54d9a181d3
SHA1 ebc4278c3ef7d67ea9c29ec17f77496cce1b712c
SHA512 8e1d2b48b008a64912eaa28f07efe08596580e980d749e8d2b6c018517aa83412bd0794239b0d3e6a3f80e448d6c92dcd22ef24986647fb7516a73cdcd12ade4
TLSH
T134517BF7C6E0552DDE0197F0AA247E17CE1E0945436C3D4B84E4AFA7A7E2865E240A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8faefef1158988d64750eebb472b8e0fce9e746b1f064feb41b7c2664967c825
MD5 503fe7690b9b251bbe4335729e8462cf
SHA1 b37e63132eedc677efca36e04b4eafb948f271df
SHA512 efb63d4b721d4e035acc7204ef0498c1368129e0bfc9d0483e7aab2a713b8e19af4920276013a73592c3305d8eeda0dd89003f7c6143f299c0faa561693b9479
SSDEEP 192:sxZmRuyM/jK1Ml8Mku/fSsNcEIdpXAHW6+WNf4n/Ywwz/OCIgrJ:sxZm0Mu/fSsNcdQHbQ/Av9
TLSH
T12752E911AA38A977CCDBD309F951BB53D6F9457292900E489AFCDA1C04E6FED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bb6588eab4cd2eb3ee9be4c96c2c25c8c18ae908511028f360444b2c648f2b07
MD5 056309a519a1800a3e3c39b3aa08d7e5
SHA1 3db86147070c7f700382b612a2f398b1d542f67c
SHA512 86676bb3df1cf0e6f745a73f501389207a8f587efeeae170b6cbaf31716b92e233b030928684dcbbf5ea382a7c7e4ef58f4ee70dc649839d127e73b14c27094d
SSDEEP 192:sxZmRuyM/jK1Ml8UQ/ku/fSsD087IdpxiHW6+WNf16XYwEz0BCIg5FJ:sxZm0qsu/fSsD0LcHboXE1p
TLSH
T1DA52E811AA389977CCDBD20DF951BB53D6F9457292900E48AAFCDA1C04E6FED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e50975775ea16116115d7d8d06f98300b07d9e7c9ed4a986239534ff02b13f0f
MD5 6333a286381ef6b166501413e2f1a18a
SHA1 e9f97755228b87f166896425d072ceb7ed66a95a
SHA512 4763c1a786e6fa4e4a1033d7e10c1958b140f38a688d5b05ba18d2d35ab21f3b83b399d21baeae6c11658ffb6d2a5309db5a44ca2ce059a5b153d74ad8996df9
SSDEEP 768:hi4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d+rohkcFav:hi4jeXmWvmKLEu1jacPLZQdVZK
TLSH
T1F4D20A3B244CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1e344d27245cd74ae38de21eb5ab681a97c3b630e8f511caa9f7db2bcdaefc51
MD5 bbc02224dce73e63aa4f61b298119502
SHA1 017f82ec425259ed22501ffed5f13e3d06e564da
SHA512 6e7f57ba43528cb4e71719e46af585f51d41518d5acfaa7bf42c397e320b3336ff62246507436d659e75180ad599c71f3f133155bb95541a9a8f3fee1957167a
SSDEEP 48:KAJIdKawQvy1bI1KYcgUyI/KPaIDyd5815vPfiz:KAJWKaw62bGKYcrysKPaGc5815vPfiz
TLSH
T12B914151707B07466DBD2A0DA7D89B5B474176A3341CE52B3BEA00B10E2BE264EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1a7bac7ebf44b2eefcd31c196a1ffa067ad9e29dbc6be944c86c21a08601138a
MD5 aa3ef89b6b3e8110ca49ef817a071a74
SHA1 36840a5edd4086ed3abd1169bc8bb3a334a698f3
SHA512 dec1c94e8f424e42805a3e5beafd641bdfd8c51b9a190f285e5c801809a4ecea9c6e2f8e7c419fb34056809fe8705983eadb1d13edee4b3f6f374890710f5762
SSDEEP 384:WZcIhsN3gCyx4s5j3VQi9f+DO5YShxJrbFzsa+VYTd7UxoB:EhQnsZyi9WONThJzhg2AO
TLSH
T1A1827D325DA8AC7658F2A795F84736138EF89163A9C97F84D6DC6F0D00DA7AC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7ef0c1cff6c8dc43fe6ddad760cd114ba1dc02973cba8bb1a253458a9f493497
MD5 9aa7de549d7157677242049ae3814b48
SHA1 4aa3c9385d69adf3d5b62f5eb3ab7d6da395b93b
SHA512 f938b85e3864634f37725322e954269657048bfef0dd34537b1d110a855a9e8e87863f08467134660f02496c5bec497eb811a0bd822648580f800a823764790d
SSDEEP 384:CFiZcII6sNJ8TUNTUlIlvCyx4s5j3Vqi9f+DO5YShxJrhFzsa+VYTd7UxoB:CFQV0wgUnsZYi9WONTh7zhg2AO
TLSH
T1C5C2F8F209D79836D9AE9747E77E2D124EBCD063B4846A94B3C85A0DCC965BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c4911d82bd3fbaa157aacc646a4d5ddd9cd94dc52736781c77f6ce91610d0d17
MD5 0c893566afc4b2d8bf670d546b4b6695
SHA1 0c79e6d067b05b82e0441b3f1d14d5b4b9c8bd56
SHA512 b8b4955c4c096272e7e2245affffd65f8768646aace4dc46ac6374c414be0ec1db77b7ae978a8eb1a8bf3e381f8da08878f86dca3e88a2d6cd196a7ebbc8f4f1
SSDEEP 192:EONt6hZ0QmiUybtpc/+jVlO1TY55wOZLnU6:EONt6oSpu+DO5YA27U6
TLSH
T1CB02FA356CA86C778EE2AE45F48737135FE4112BE9956F84E6E82B1D00D779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b9bc71037b7a14acc5c3991a7fae5dd538acd36cfdbd558c232dc74915ba230
MD5 c1ad99bd6466e9cbafff3897defd68d4
SHA1 3aa54421e1c327fd67c4719ca6d8e894f48769fa
SHA512 9168cbdb06d57f8a3d477c14fb68f30a5465dd32d27e232f239f96dd56a9b0f12346078cee4f69ef6253e6444231b281133bc05bd33300ee60ae49ec057f74b3
SSDEEP 384:qZcIhsN3vCyx4s5j3VQi9f+DO5YShxJrbFzsa+VYTd7UxoB:IhtnsZyi9WONThJzhg2AO
TLSH
T114827E311DA8AC7658F2E795F84736138EF89167A9C97F84D6DC6F0D00DA7AC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a41436b9f5b880e3954e15b98962dec303c1107aaf0b7e6156e25226e6b80863
MD5 a5c13dbe5d6dbb741c216cd3528571da
SHA1 c9f60b0e37ca635405f6bbe32ef4af88811f18c0
SHA512 35388eed797631215cee6ffd4f2176b03a2ad7917664af0539bcfc75b583095c7dc7ab36a582576661c9e201ece0906e10d5d4bfe5cbbd11c7b389464cf31d30
SSDEEP 192:WON66hZbQmiUyhtIc/+jVlO1TYSbFuSJrb5cOqUq1U6:WON66ZSIu+DO5YShxJrG9zU6
TLSH
T179120A3168A8AC375DE2A645F48736138FE55127EE857FC5D6DC2F1D00EBAAC230AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 526d22b2beb4339f01e48109989add62dfec6e39cac71c5830d49653adc5c46c
MD5 d58641a3b2dd45132cd453015ca3b8d3
SHA1 4d5f08a933458eb3e6dcd8224bfd273f6aa882a1
SHA512 c48dded6aeae06908926c052781521e8a1d2ef2cc2030d5b14c09f23a97d49f0d9a2ae3419e241d996c119130d4adaff4a0076027005754da7254fccaaef5cd0
TLSH
T188413959BAF91148B3B77F5A9BF2786D487BBD772E06915E00110E4F0622E00C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download