hxxps://siteflow[.]fr/

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://siteflow.fr/
Sample260910-n2c25swvcw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335148004717905"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{7E370824-3B26-400C-BA35-71FCC5A88F1C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4728	1760	msedge.exe	86
PID 1760 wrote to memory of 2540	1760	msedge.exe	87
PID 1760 wrote to memory of 692	1760	msedge.exe	88
PID 1760 wrote to memory of 692	1760	msedge.exe	88
PID 1760 wrote to memory of 692	1760	msedge.exe	88
PID 1760 wrote to memory of 4060	1760	msedge.exe	89
PID 1760 wrote to memory of 4060	1760	msedge.exe	89
PID 1760 wrote to memory of 2860	1760	msedge.exe	91
PID 1760 wrote to memory of 4664	1760	msedge.exe	92
PID 1760 wrote to memory of 2860	1760	msedge.exe	91
PID 1760 wrote to memory of 2860	1760	msedge.exe	91
PID 1760 wrote to memory of 4664	1760	msedge.exe	92
PID 1760 wrote to memory of 4664	1760	msedge.exe	92
PID 1760 wrote to memory of 3344	1760	msedge.exe	93
PID 1760 wrote to memory of 3344	1760	msedge.exe	93
PID 1760 wrote to memory of 3344	1760	msedge.exe	93
PID 1760 wrote to memory of 4260	1760	msedge.exe	94
PID 1760 wrote to memory of 4260	1760	msedge.exe	94
PID 1760 wrote to memory of 4260	1760	msedge.exe	94
PID 1760 wrote to memory of 4476	1760	msedge.exe	97
PID 1760 wrote to memory of 4476	1760	msedge.exe	97
PID 1760 wrote to memory of 4476	1760	msedge.exe	97
PID 1760 wrote to memory of 448	1760	msedge.exe	99
PID 1760 wrote to memory of 1276	1760	msedge.exe	100
PID 1760 wrote to memory of 448	1760	msedge.exe	99
PID 1760 wrote to memory of 1276	1760	msedge.exe	100
PID 1760 wrote to memory of 4312	1760	msedge.exe	102
PID 1760 wrote to memory of 4804	1760	msedge.exe	103
PID 1760 wrote to memory of 4804	1760	msedge.exe	103
PID 1760 wrote to memory of 4804	1760	msedge.exe	103
PID 1760 wrote to memory of 4320	1760	msedge.exe	111
PID 1760 wrote to memory of 4236	1760	msedge.exe	112
PID 1760 wrote to memory of 1396	1760	msedge.exe	113
PID 1760 wrote to memory of 1540	1760	msedge.exe	122
PID 1760 wrote to memory of 1540	1760	msedge.exe	122
PID 1760 wrote to memory of 2552	1760	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://siteflow.fr/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff715ec188,0x7fff715ec194,0x7fff715ec1a0
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,2430230659960566325,8815932365996582960,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7850689361588857636,9335539116307497652,262144 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,1704552006709601031,5544626314261188821,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,18396036809345650882,2458836107586402552,2097152 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,12434233880527276423,6596707965601926637,2097152 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,8600156506789498455,3558820199530382317,2097152 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,3145351455173098172,14427935015694391659,2097152 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,9572624819899665638,569231272781492077,2097152 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,9925816620533068229,14382149818323206580,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14440202042287505844,17193857223656932373,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,4024857815339335546,8941775052862123082,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,4024857815339335546,8941775052862123082,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3708,i,17207250313877250807,14484543130603333265,2097152 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6041539860046157931,12604389494175632043,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,16383143734381817984,11053314270890677700,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11956557583617423687,15416724680995959139,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,17270504466350372069,10984737093953674226,524288 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3756,i,10614161877776930561,16334288573385564798,262144 --field-trial-handle=2088,i,61108601714380877,13911751690654617417,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2c85f459c9170d463fa175f939062d24ed241e14b41fc72cbdcc50e13adfe11e
MD5 02628f27fde78a648aaad5f32ccf0f68
SHA1 692ba50c50e0997912c4da4a06d7013188165bfb
SHA512 e2b66e6471478579b6318a128730453823f6379f4c0a891cc7e0bab3fdb2afc4a6d865eb410d0d6c35ddfa4717d6def8f6b725798ac0bb76c0f8dfa5f85e1229
SSDEEP 48:EzWz0KGLKfNrIsa7tyXcvafIBYs3IqvkTM/jl3At4Dc+OOv7j:EK0KG+VAkn4mjt4DcYTj
TLSH
T1C1811FB146424056F75203705AD0850679BC88DBFF13EE62AAB0E5F61BB73534D3938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d164.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d164.TMP
Size 3KB
SHA256 48df7ff0f0ce1f254b482c04f04e51267efe259b2c914b3c904ab5b27ef7ef69
MD5 02a90d914f8648dc7ada2df98f739bad
SHA1 b8edf3aca0766729e360c992ae75fa59ee9f122b
SHA512 3ff28933c50a6cb5be0627b07cf38bb776fb065d97edf164b23c0b72e4b46897a7b8917eb40f870d505d68c3beb0b4413f8840f7a12b3190cbcb32b3a994763f
TLSH
T1197151354B4200A2F75203B162D0D2067DBC85DBFD23EE01D3B4A9BA5BBA3534D69387
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a5785ced8c88080cf5f096fca1837ca46278a489edf5198f21e358ce6183f6b7
MD5 b97617a5f70d5a2f74fc41b020837efd
SHA1 4a4bd1a82af32acd563f045ab2e2a1f05412611c
SHA512 a9d2a637b32741bb9847fdd3b7578744def2a4be29e7d41fd2093189c9035115aff041e474f29dfa61c4e8f43fd4c064d00378f4b1d6ca12ac051f95c6fec37d
SSDEEP 192:D/MnQpQcNi1w1ad6KULnNHbSuFhE+s0wGGXT6+AabaSnm:D/MnQpQcNi1w1ad6KULNHbSuFhE+s0wq
TLSH
T190D16CF687F46A3D8E3256F0AA166D1FCE6F0814971C3C6E89D4AE16A7E1470F10162F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b5a179f077d75b92d8be17ac61a689347ccee18658d89783b7f6f1fcb7e99595
MD5 dfae46866efca7cb1464e61a9ef39edb
SHA1 15e9984f0e72d282597fa0ca401781ce094855db
SHA512 d1bd064a2fdb5dec9909f198ff570ed6cef7575a279845dad0512107d8945a3688a58770082e41e94f806df2ac3ec988ecea0b4e558b46b5f83071494e691d58
SSDEEP 192:sxZaRvyM/jK1Ml8MWN/f3sUMAIdpTLHW6+WNXZv/YzF/tCIgrJ:sxZaBuN/f3sUyvHb5/H9
TLSH
T1F842FA52BA34A977CCDBD209F941BB93E6F50473A6540E44A9FCCA1C00E6BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a04a4dc8869b4e4bf96b3f223b970bb67aaeed0d57893cfb9508cf3e6e60b6cc
MD5 372a3270445c968cf84df04d861a0e94
SHA1 d73f84297144ab624d33e601fc793ae6212577d2
SHA512 966786ca3142541de6fc14aed3f14f30d5f7ac89879deff219e16642763dad222962a980dac8f45b5c83ee80405bf4418e8952d40f4775c423bed99088e568f3
SSDEEP 192:sxZaRvyM/jK1Ml8UQyWN/f3s0MAIdphLHW6+WNXZv/Yz6KmtCIg5rJ:sxZaBqNN/f3s0yxHb5/GT
TLSH
T10752E952AA349A77CCDBD209F941BF93E6F5547296540E44A9FCCA1C00E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7c4107d5cee4d2369a0a25508a0cbe5a803ee53191ffd5cd75512d23a5d1c159
MD5 00ffdda584660859fc9622cf0a61d00a
SHA1 a473d8530932da1f585d064ea0509b15a863764a
SHA512 148e0324455b70bdfd5752cf483aaee33de7ec3abcbd626ab564ba74f89066080cc2983ba13c320a138242775952129791f59a8b44ec3b0959ac0abc21dfbcb9
SSDEEP 768:8PW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjqroIeixYi:8PW7kf0Wvqidau1jaa5LA3jBDi
TLSH
T13DD2FA3B680CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b1e860e3df3f5c9dec3dfede29efe0cfb783e159d6192421734c1108079c0847
MD5 e4e425f11c4a45904a7cc2b870b58c8f
SHA1 5f2abce312e5597e111ae55ac451be3fbfab9c0e
SHA512 de0d2d6e9c03d6d8c8434d25489ef8778423342e3e38f933180371b92f59cd9916422f5b7ad81b2fa6478e778eba3ed14c703fb849ac5a54cc877c5b12cda1cc
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTnnIFK8sgHyNzIhKowU92R6mwcYkocLPILukKyBaj:KIbCKcnnGK8siGziKowfryKQY
TLSH
T16E910109713A1602387D2D58B2AB96271F4372F33429A6AF7FB814610D6BE154DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaf3764d-4a0b-4b11-ab76-82cd28fdae1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\eaf3764d-4a0b-4b11-ab76-82cd28fdae1c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d1ad7767fd0db57f29e16b81851f718693d3fbad028e7653e8f36f10525fc078
MD5 3fad3949ebf42d92af3e95f2feed6809
SHA1 8b7843fe7e8ceaecbaa9709f8c684b81b8f7825a
SHA512 4fe25c7da0e854185bd6c31cc33250d5148b0b58c1aba42659efb367e734ed16cec5d65b4868ed4f5eba712f10fa899abd4f823a4434e4cd6ca57ae6b98e4140
SSDEEP 384:mZcIhsNXG2IhAbXy29LdXm0CEJrF7xuvzxV+MhdpFoB:0hju22RvhF74184pFa
TLSH
T1C6826D716C78AD775DE6B241F88736035FF88027BBC85F40E5EDAB1C01AA768171AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c3e0c5c69e68776faf778f6039df4c818d4c0cb87074f2356fa77c1af50cdfda
MD5 c2eb6289c356f8552b7515769ff01c3c
SHA1 7727a7bfa579262e1cd78c5a55aec7f36fc2c441
SHA512 e8be7a953c9d8ee21c3f2e3631305224e2145ac22830e5b2dbe55dc9735bf04d8af24ea00fe9e77e5b50cbc5049aacdbc63758e3897d14649820f0ac95984f68
SSDEEP 384:miFiZcIEsNp8TUNTUlIlD2IhAbXi29LdXm0CEJrO7xuvzxV+MhdpFoB:NFQEAwgjuu2RvhO74184pFa
TLSH
T1EAC219F258D79976D9AE5743E77E2E024EBCC027B9849A40B3D89A0CCC562BFD306C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1f99df7ed5e2ef56381d19d0fa6c1a8e51df46524ed5da1d3a74b968bb8f530e
MD5 c8a869d3164a932970d38ca9d4f87833
SHA1 15bc0ad12b15e40547125fa3274d347a39016d6b
SHA512 eb56641afa9d33472ac125958d688ce5479f974d922c8e79a050632e0bc50c270e8925d2a7ae3e0436a8f5169c037598d74605b003d436ddc7832f53ef480ddd
SSDEEP 192:MONq64BAQmiUyZI1JW5GBPKnX+FdG4m0+aDJOU6:MONq6eARXWMdXmgwU6
TLSH
T1E502DA35AC786C7B9EB3BE45F4863B175FD8113BE6945B44EAE82B1C00D765C230682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc6a9766e1c1b4a37f3b97147164b731d59747f17fb3f089c77fae5d9be03513
MD5 cb5deb28efebd11e11c48ea4909b5226
SHA1 44537c2ecb2e73a079ad7dc3e614cbd87458f5d1
SHA512 92ea361ca07ce8d245ecd5a2a887a3a1777f06c7bf14c7d1fb6c7f7373c6fdb992b44e748778f1f4a66e9c752e23e6e65294a9f8374238cbd573b3bd47ff10ab
SSDEEP 192:UONy64BjQmiUyZZJs5GBPKnX+FdG4m0PbFC1SJrE9Ww6qTU6:UONy6eVCsMdXm0CEJrw7U6
TLSH
T1D5120B75A864AC2B5DA37151F48736139FE5822BFEC86F44E6ED2B1C01EF76C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9678a9011c07438a6510fdc9a78e8c900e0bcac84b59636dd29a9b0b932aa491
MD5 8926c5f0a03f6604c971a6c12ba25520
SHA1 e24b91b0a84a890d500d04cfb06e17eb9c07931b
SHA512 39b08b4a39b7eb22a6cbca2205cc2ccfea738116ad5abc5ee8bec89f1ce82db3f8d771a81ee26df3761103c42365fe3fa7ca76d4428dde40b1cfa75d51530c85
SSDEEP 384:sZcIhsNXD2IhAbXy29LdXm0CEJrF7xuvzxV+MhdpFoB:6hKu22RvhF74184pFa
TLSH
T1C4827E716C786D775CE6B241F84736035FF88027BBC85F40E5EDAB1D01AA768171AC0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

507726b6-0bac-4dfe-a194-4f1b67ce4298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\507726b6-0bac-4dfe-a194-4f1b67ce4298.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 385382ac097f8ee80939c4376a32d1a9bfa834496e751fe08c4824ed9beb4ba2
MD5 63e78ab28ba4ac0d325f665819cfc4c9
SHA1 115ed6028b092641c0c6ac9c7480da0f071b3cbe
SHA512 f1d6a744be3853e8780dc7be7ac7ccdaa30c30386c4a9661dad551c73f4e8b43f7b28f03c2fbc9ae49781367ba36603a0b84794fb3ce0f2ecdc864ab547e7d7e
TLSH
T157411A88A6F91158B3B76F5A9BF7A86D487FB8772E46809D00110E8E0B63B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download