hxxp://autodemontagenijmegen[.]nl

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://autodemontagenijmegen.nl
Sample260910-ntlz3swtew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335140930134719"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{2C24F22A-6974-4F60-8D46-389613A6BD23}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2928	832	msedge.exe	87
PID 832 wrote to memory of 740	832	msedge.exe	88
PID 832 wrote to memory of 2540	832	msedge.exe	89
PID 832 wrote to memory of 4568	832	msedge.exe	90
PID 832 wrote to memory of 2540	832	msedge.exe	89
PID 832 wrote to memory of 2540	832	msedge.exe	89
PID 832 wrote to memory of 4568	832	msedge.exe	90
PID 832 wrote to memory of 3716	832	msedge.exe	91
PID 832 wrote to memory of 2608	832	msedge.exe	92
PID 832 wrote to memory of 3716	832	msedge.exe	91
PID 832 wrote to memory of 3716	832	msedge.exe	91
PID 832 wrote to memory of 2608	832	msedge.exe	92
PID 832 wrote to memory of 2608	832	msedge.exe	92
PID 832 wrote to memory of 636	832	msedge.exe	94
PID 832 wrote to memory of 636	832	msedge.exe	94
PID 832 wrote to memory of 636	832	msedge.exe	94
PID 832 wrote to memory of 2392	832	msedge.exe	95
PID 832 wrote to memory of 2392	832	msedge.exe	95
PID 832 wrote to memory of 2392	832	msedge.exe	95
PID 832 wrote to memory of 3320	832	msedge.exe	100
PID 832 wrote to memory of 3320	832	msedge.exe	100
PID 832 wrote to memory of 744	832	msedge.exe	99
PID 832 wrote to memory of 744	832	msedge.exe	99
PID 832 wrote to memory of 4300	832	msedge.exe	102
PID 832 wrote to memory of 4004	832	msedge.exe	103
PID 832 wrote to memory of 4004	832	msedge.exe	103
PID 832 wrote to memory of 4004	832	msedge.exe	103
PID 832 wrote to memory of 3764	832	msedge.exe	104
PID 832 wrote to memory of 3764	832	msedge.exe	104
PID 832 wrote to memory of 3764	832	msedge.exe	104
PID 832 wrote to memory of 5056	832	msedge.exe	114
PID 832 wrote to memory of 1672	832	msedge.exe	115
PID 832 wrote to memory of 4672	832	msedge.exe	116
PID 832 wrote to memory of 1600	832	msedge.exe	118
PID 832 wrote to memory of 1600	832	msedge.exe	118
PID 832 wrote to memory of 3880	832	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://autodemontagenijmegen.nl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffe171dc188,0x7ffe171dc194,0x7ffe171dc1a0
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,2672796882445282946,12606261950465181719,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:3
  2⤵
  - System Time Discovery
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12583820574685287752,13091521573263503602,262144 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,16686097510401691185,17030233137629162012,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6968846339157542860,9390003628069550933,2097152 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11733686955233815246,3317051218180277,2097152 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,7576993136534805333,17467242314860100297,2097152 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,3390700813101758097,14521005136293981942,2097152 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:2
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,5751477932162388237,12645851635788796852,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,7490723697488866878,18152823634136791439,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,4469081898463581711,15898275845597715857,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,4469081898463581711,15898275845597715857,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4428,i,11847195744448115575,18435829019667041494,2097152 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3460,i,8856996371284805334,15884853761612765205,2097152 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,11417477828980031971,13762342172168761373,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,14842745696343169659,9502304521523544902,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6297840258596548293,8034740723437133418,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,9809021868409860847,2006427473179415889,524288 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,3729194723143193096,4665387592080930116,262144 --field-trial-handle=2760,i,955978398095073381,4840848340940532067,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 92cbbad1a922dbdb977ff94b0d78fdf50fea8fd09e82453ff46b2f31c797184d
MD5 00d8c06c7b254821125427fb5e7b6301
SHA1 ba363868a47a35e58bbd9291f06c9a56a62c467d
SHA512 d17aa8624542726011c7d3b80749e1de3e37c9d6a509cc76d3c302499656c83aa446b302c75f667869c68ee850bb1e99b51cc0d56c15ef2f8391d69b5cb2f642
SSDEEP 96:PV4dFYrDPjP7nTWg/kTIppT+GmhH0htrAtLszzLe:NrzHTWgyy1BNhRAt6Le
TLSH
T100A181F4068351AEEF2E91309DD10E3C707789D8F7235E8B1194E8F8DD42B92D2B1594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590025.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590025.TMP
Size 3KB
SHA256 67def391f7b6f261beb73e687258c033feb15e97a320db03f40c1cfe79ed16d4
MD5 34ea22894d45f7e3354af502d554a507
SHA1 6e07f0f885b45654620fb11d54581c8e3641b76f
SHA512 fe316e8b0c1829dfc9c3fa566c3f57317f7fe099972f3452dba5908247edf37516223eb6c8cd2b89964a25d1fd12431e4331206b52b07941774b75fd965fd6fd
TLSH
T11B8160B8024312AEE77D52319ED20E3C747382ECF8235F5B51A4D8B1ED957A3C236488
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2d58859d68023c8ec1a768bcfb3556b17884987c8dfb0da12e8dafe7771b6c95
MD5 6033d9b2ce762e3c228dd8cbc499d46e
SHA1 b05fc6d3598941ed557616a1918592c293fd66c0
SHA512 92e89dc949a3ba2e312305e9b61a114e1b5575c59dfd9c884413babdae779f0a9ac73a81ce529523bdbfbeb71116d335a4c7671503761d2348c938727db74147
TLSH
T115715CB786E4876D9D030EF06E34BF16CD29182A532C3C5689D8AF4B9BE14B1D102D4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 84625645dced7c76886f3326d7235811bca7189706ef442420a2f611774f3f4c
MD5 e15c8291564c469b7a0d4f2e92362634
SHA1 ea0640642173d8e2002c684edb4502bc64890cf4
SHA512 3d4325128e466494245d54401d6a26ecc991598677269f21b876a65f00d2ce66936c3438ed2aeabe22a4b9564ddb8a48df9f0360ac097efb2ed70ae689a37502
SSDEEP 192:sxZsRqWk/f+swdIdpJHmD6+WNGYCI/n23KdGIgrJ:sxZsLk/f+sweJHFGCM9
TLSH
T18822B851AE28A97B8CC7E21EBB15BF53D6F9503295D41E48EAFC861C04E7ACD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6624a86862aec6cddf83c156c7f3d5ae4435985ed94b3c129875bfb261f22ab4
MD5 649ac7fb95bac5a6a295fc35ffd0ec33
SHA1 326051bc72b90755d01046aae7ac2c674c5cbbad
SHA512 2f541de757bfc69aae8f7a517054a984b45a8a7939ee859900b7a56bf3987cbcfcd4af91d3dd6bf57a206aeff5c61ef8b38742b450b7474ccfecc9ff4f8d8b04
SSDEEP 192:sxZ3RqWk/f+sjRIdpFwHmD6+WNlqJXYCJTn23KdGIg5HzJ:sxZ3Lk/f+sja+HFqXtMxl
TLSH
T1FB32C951AD38A97B8CCBE21ABA55BF13E7F9503295941F84A6FCC61C04E7BCD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ece5738e67f0140f01daeda0c3fc8aa087190525dee411c4cafdb1efdb0edc54
MD5 d6914ae42071261520c2d6ac2860b9d3
SHA1 86409b5e846fe3329b596f07d9087900429c1087
SHA512 aa6b2525a22bad62c2167c1ee253c091b7bd091826e88b3abd5207415879713584b951cb37b49f07822a9bd5e09232dd128647ad028ac2867daf211e0cafe1d6
SSDEEP 192:sxZ3RqWk/f+sjRIdpnwHmD6+WNliRZYCBcW23KdGIg5HzJ:sxZ3Lk/f+sjawHFmZfMxl
TLSH
T12932C952AD38A97B8CC7E21ABA55BF13E7F9503295901F84A6FC861C04E7BCD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ebd19a119c482824e43386614712543b4f600dac7699ec5c29b8d98d7de757e3
MD5 c230aff2b9d759a2f7261bed83c48043
SHA1 cbd4bde48db445a207acf366a1a95e94be4b8859
SHA512 fa3a4cde39d538db9c07ec5fec63c419d43e910d0724ed625816d09473dedcb6594d0fecb357d8a262e08aa2f1862644316d5e174881de00ae413039e158242d
SSDEEP 192:sxZ3RqWk/f+sFRIdpFwHmD6+WNlQ3/YCA/n23KdGIg56J:sxZ3Lk/f+sFa+HF+/KMs
TLSH
T17222C851AD38A97B8CCBD21ABA15BF53E6F9503295D41E88E6FC861C04E7BCD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 672db6fe9b9d68680e852a2e79771aa80936e761b68727782e7efa78c7344ef9
MD5 8b66aaeb43b8e0be3d936eabd3ded206
SHA1 b472b8aae6cd4dbc63b3e0b916dd97125959b952
SHA512 fca5c440a5d34af0b88ee3de74d3e4abd454b29f6b77a9ac17c789f018b84f9eb636e633d9fad2c8b6c2c79bae21212e346b4b3ead39e5f8a3e77ad939197b7b
SSDEEP 768:SaqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrBroOQ:SaqbUj+WvSCs6u1jaaZLbWr6b
TLSH
T1D5C2E93B340CCA7E4FC01E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e6578f522f1bbfe6c02f5013d65493006acd5e2c0828275f76a3b59edbcf4581
MD5 c0422be43ebc9891e799843a72045669
SHA1 84c7bf7465b63006f403ae7ce04b69758efce399
SHA512 885ce7aafd36656589cc4260324f021ced94bf0437c8464a189af5751ddda02aa570f8e48f533655144df564e0a4ae4f4ac33e64d760e8e4dd878f5186903a68
SSDEEP 96:KlkdQ0uS+gyKHzssgK01s2gA8s3WEtGZiKCopX6K8YKOz:2kdQ0uS+DKHQsI1s2r8s3WEtVDh+
TLSH
T152918222307F070538BE3908A695C63A4E4671A7354AA4BF7BB804B55F67E122CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592fa1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592fa1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 69b01ef7c42375d07f7f69fd0aadf98302487189bda1ada113f25f600924dcde
MD5 35040fd1c8e0551c666dfe7a714113ce
SHA1 ced190bfe843791ea592306817a5d3c34d713506
SHA512 7e5481726ece361ab6c09d61f7ca02515d5a81d334fd7de3ecd5bfe9a0b7f8820f26bd417152c157f30027f67b194f50b63609b528bd0fcfae8dba48709e9ff4
SSDEEP 192:u8LsNu8Qftjh8biZuQmiU1P8Tp4Ea+jqOmWtmtuv++AamzsqpU8:ZsNu86lBAp+2Ea+mOByuv++ozDU8
TLSH
T18D321976A83C9C774DE2A545F54737139FA8906BCA8A6F90D6DC5F0C00DB69C230F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 44a691b5e1f404c7c8722b751697df7cb76bf2c070c2c89fe9b7711f6162ca6c
MD5 381522650e8c95c2c6c51be0f657b247
SHA1 e124e0c3c05e29f30ca3f8f9baa3a7db55d40626
SHA512 6c9351411eccaf7007d1093ccd8e8c0b2f9c479aa5436ad436a0afb5844f4ec90d149e4afe86f2498c52b6956ade9bc9562eab663920839e984b6876367d2534
SSDEEP 192:+ONX6DbBQmiUyLn8iBa+jqOmWtmtuv++0NzzsqpU6:+ONX63O8iBa+mOByuv++0zDU6
TLSH
T1B5122B36A87C9C775EE26545F48736139FA85127DA8A7F91D6DC1F0C00EB65C230F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ec93b1c945f69328bf06305b2e6e493c61cc345f457227b71155410783c77d8c
MD5 878b27af544be442dbd826010b390d28
SHA1 dca10401adbaefc4009b917d993ad37a42cb4750
SHA512 2be16bbf3dd3f8ba1809e050e96c921f323995559856df980e07828346446e258c00532d2dd424d852889c51d1074c76ad872c13207cdd29c437ae8645433782
SSDEEP 384:ciFiZcI6sN+8TUNTUlIl16lBAp02Ea+mOByuv++zzDxuvzxV+Mhdpqoy:HFQ6/wgWlY0labOAqxzzD4184pqV
TLSH
T1F9C208F248DB8876DDAE5747A77E2E038EBCC067B9859650B3C85A0CCC9617FD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 496e85e98ec53ec52c551fdef972ad1b5e5b4144f802347e0f31eef0cb08839e
MD5 211560881e89075621bd286dc24311aa
SHA1 ebe79f17966ca8f4552bf27892da4eee796f0e9c
SHA512 d6b559adc7a4c65e081eee87dd4e71ead809038e1ee101707fbf49f9460ea6568465bdc22ac1e919c68066b388b8d8a4f99b28d6ad0fb392fb0bf8af10fa4870
SSDEEP 384:BZcIhsNu16lBAp+2Ea+mOByuv++ozDxuvzxV+Mhdpqoy:Jh2lY+labOAqxozD4184pqV
TLSH
T1BB826B7268389CB21DE6A185F84737178FB89027DA899B90D5DCAF0D00EA658231FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7bd7ba70d6959e9d7431571e623b38e940c576fd1610dfb980bef20a2f39b66a
MD5 782cd0f4279a9938e078b97d36fb2e84
SHA1 c045f2e9772b197ab5aeb9bf86c4798672a3fb27
SHA512 20a699537ef5b54ba1308964919a9b3737775aaacc318263dc8ccfce7a709c0237d67e54b8fb4640436b56ecc0bc6cffb1a62c7833507d7e5b0c5649a667b9c6
SSDEEP 192:vONx6Db6QmiUys8HBa+jqOmWtm7RgznIU6:vONx6uiHBa+mOBHzIU6
TLSH
T14302E93969786CB79EB2AE49F48737275FE4107BD9562F84DAD81F0C00D764C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

feb6358f-54bc-4750-97ba-01b382b10eb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\feb6358f-54bc-4750-97ba-01b382b10eb5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e4f92dffed1c1f64a8bf1ae7dc8ceb11c53123e495a2414d28b1fb70b7bc229
MD5 ee9aaaf52c8f40261448c965a665e555
SHA1 73222d36c3663fe49c9475635d32c86ae6b4190f
SHA512 079c5eb5145a38cd25719f603e91b57873505d46157dfb2e041af423363ea5e9b67842f59388f0d24d0f52d8dd9850a8a5c7c5997a610ef0576381636e4f8229
TLSH
T1FA413B98AAFE1148B3B36F5AABF6A46D547FB9372E06C45E00110D4F0622F40C9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download