hxxp://bpostshop[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bpostshop.com
Sample260622-lha3bsbs8z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4172	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265942995549423"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{44F9D73D-B373-4814-A3A2-44ECFCA1DB37}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4520	1972	msedge.exe	85
PID 1972 wrote to memory of 4172	1972	msedge.exe	86
PID 1972 wrote to memory of 1696	1972	msedge.exe	87
PID 1972 wrote to memory of 1696	1972	msedge.exe	87
PID 1972 wrote to memory of 1696	1972	msedge.exe	87
PID 1972 wrote to memory of 1356	1972	msedge.exe	89
PID 1972 wrote to memory of 1356	1972	msedge.exe	89
PID 1972 wrote to memory of 3260	1972	msedge.exe	90
PID 1972 wrote to memory of 3260	1972	msedge.exe	90
PID 1972 wrote to memory of 3260	1972	msedge.exe	90
PID 1972 wrote to memory of 1672	1972	msedge.exe	91
PID 1972 wrote to memory of 1672	1972	msedge.exe	91
PID 1972 wrote to memory of 1672	1972	msedge.exe	91
PID 1972 wrote to memory of 4692	1972	msedge.exe	92
PID 1972 wrote to memory of 4376	1972	msedge.exe	93
PID 1972 wrote to memory of 4692	1972	msedge.exe	92
PID 1972 wrote to memory of 4692	1972	msedge.exe	92
PID 1972 wrote to memory of 4376	1972	msedge.exe	93
PID 1972 wrote to memory of 4376	1972	msedge.exe	93
PID 1972 wrote to memory of 728	1972	msedge.exe	96
PID 1972 wrote to memory of 728	1972	msedge.exe	96
PID 1972 wrote to memory of 728	1972	msedge.exe	96
PID 1972 wrote to memory of 3264	1972	msedge.exe	98
PID 1972 wrote to memory of 3672	1972	msedge.exe	99
PID 1972 wrote to memory of 3264	1972	msedge.exe	98
PID 1972 wrote to memory of 3672	1972	msedge.exe	99
PID 1972 wrote to memory of 372	1972	msedge.exe	103
PID 1972 wrote to memory of 2096	1972	msedge.exe	113
PID 1972 wrote to memory of 5116	1972	msedge.exe	114
PID 1972 wrote to memory of 212	1972	msedge.exe	115
PID 1972 wrote to memory of 5032	1972	msedge.exe	117
PID 1972 wrote to memory of 5032	1972	msedge.exe	117
PID 1972 wrote to memory of 1612	1972	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bpostshop.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffc8e15c188,0x7ffc8e15c194,0x7ffc8e15c1a0
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,7529222795087591662,7680620071557804557,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,9185599224324535883,3286965086638337756,262144 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,6431980216641514733,1545205408518455578,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,18041817293445050421,14430407289395669712,2097152 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11391894107823627451,15894732171438912231,2097152 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5278226267242406217,10224100004833009072,2097152 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6710696242318903924,7915051163965645349,2097152 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,8790446542197143230,7369598520180009863,2097152 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,17783902856541185425,15410382415092971982,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,15544230202734837420,1326530266081732021,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,2490772655680075828,1031492919051521734,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,2490772655680075828,1031492919051521734,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,17527040534242749835,11402250035929573516,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,12844475314171901100,10618740372103404854,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,16038186269861286608,8575602477372255706,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,2993008229758480659,11354358089577352819,524288 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3028,i,7650148405119961295,12178529234409395742,262144 --field-trial-handle=2276,i,16624176720858735742,14837116541243798630,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75a2206b72474f9d64f68610362a7df920f3bf2de08ca006c86bd4a6b8d1792f
MD5 3b98bcc0e59f4bfe53648b1fd4cbbfba
SHA1 be316a21a65e9b4a29bc5e0fbef85d7e3632f3f9
SHA512 58bcda39305513947d9b8a6017f96376a6bf9dd1ebb4952a27dfabc4e99c40e28b7e0a5ba968f355b27ffd8c543bedae1a7fafb534c3d53fa914cd7e9d9ff7fc
TLSH
T1C6710A4A0D8D1994F3A53138A3E243C239B1C86B2ADF8E070157D6BBE90672D4C26DF6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5875e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5875e7.TMP
Size 3KB
SHA256 3767947b44d5c82a7d8ec4c42e994d03e4bc15005e6af2c4d3fbb87d0f88e503
MD5 d8546b45edc7837208420fc0c5d68381
SHA1 6ce27ba2712a2a27a641f84f6b1da29a25896b54
SHA512 d977084891e2787b1601199b6abca38e71da7ebf8025c811a3f5e08d55b2f45534f3f36b10db57ff5bda859b00dcecbb0c95cad5b94a3ee112b99be38da375cb
TLSH
T10E611A0A0D8E5984F3A93138A3D243C239B5C4AB19DF9E070153D6BBE91672D4C26DF7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0f4bf7a750397548c021e03f65bbf72e01f33a69817cff7bc7ba022b5c1598d3
MD5 ea83c093dc33232559cbff001c97422b
SHA1 8e33613cca957fc9bd03507bb9d14ab36feceb28
SHA512 20b444e1ce081aa57ea4350c69469eda250581c57aa31844f8ab48be800ed96f7bea6473b479e916dc73fc49d786e79f9033c4fc0dcedac80035a59625f1dfcf
TLSH
T134518BF7C2D5C65EE8125AF16A25EE1BCE5D092893183C6989D4FF4BE3D2472E10190F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d1f81008bf306a9f4fc3cfe63f6e4c6b41c52290505cde1ff14596da57ceff9d
MD5 965e8c66fe8ef3096cf2571a3022fef5
SHA1 25a6d89bd2035ef2450f783d7cf1949f63d75084
SHA512 57aced3052f2e3b3351bd6e4006561c4e54aeb7a921162d93c2bd9093c8ffbb077ed2cadae7186cfc83283bb08322d98dc80a317eb2bf66610bbf4183cbc0665
SSDEEP 192:sxZIRyyM/jK1Ml8Mkg/fssGQEcIdpYyHW6+WNnvM/YHKd4QIgrJ:sxZI0Mg/fssGQEFnHbk/N9
TLSH
T12E52D8166A34597BCCCBD609BA45BF93D6F50572E2940D44A9FCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09b2b4f5313275bc8b80f9dc11804be797aa58f653e569174488e02d129b2f9b
MD5 52c713e2a7102b7261c3dd054261756f
SHA1 6d11715cb7213d3b057a5dba8d36d21cf1a2d586
SHA512 7a08039379eeb01877bdbd152f91bd2809f8842e28585614a3006b21e4afcca597bd8f8532a84925ab54bf2feedbcec541985e2e2eeb6ee6bca52f8e3522e108
SSDEEP 192:sxZIRyyM/jK1Ml8UQnkg/fss9kEcIdpeyHW6+WNnvM/YHHQ+QIg5MJ:sxZIEqkg/fss9kEF5Hbk/n2
TLSH
T19B52F9126A34597BCCCBD609BA41BF53D6F50472A2A00E44A9FCCE0C04E7BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6de177d96fb74aa3eb26132069657c6dd9ecc1b05b73ecdaa34a63770cf58ac0
MD5 56419197650a43f10248ea1a203c8072
SHA1 177217567b2d627d8b813f73942bcd3ebb7cd912
SHA512 5284b0d1fad4a9c6aeffe5c182d4cc074bc9e5b7bb2014a4db132f8bb19c23e101c36d054cca1cae40006266235a5130a3cd91943b0511a3e00cc2df1975b6b4
SSDEEP 192:sxZIRyyM/jK1Ml8Mkg/fss9kEcIdpYyHW6+WNnvM/YHD/4QIg5MJ:sxZIEMg/fss9kEFnHbk/M2
TLSH
T1F152E8126A34597BCCCBD609BA45BF53D6F54572E2940E44AAFCCB0C04E6BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fa97b1be0fc199860a09291f29554e1da290b485c7eb3b098e9863ef62b79b90
MD5 0d4199783418b98866516eae9ba9abc9
SHA1 4378f128e1be08e9e94b78ac9ad616b81250efea
SHA512 898faa68041ff115e109592191d83ee284065977914e3a3a6c29b6e69ff0c3186c4e56300b89d019f0c7500e47cf461362f68f117875e25db7b44aa9cc53de84
SSDEEP 768:L+UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RAroVa0R:L+UZYTMWvg0Pou1ja7eLZmRL3R
TLSH
T1FDD20A2B280CCB7E4F844E5DEC2A6F963DD801CB9A984D5447EA894C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2f746f0b19537012133bbee1ed9ac2d2e4b2eafb34f06799df04ad9878461c24
MD5 9ec571a538e6f4462a416d41b5e2b251
SHA1 e74f4aa931b6cc4632d7c47adea35a3124a1f068
SHA512 497c104cd4eaa3b5aac2d78564a555c1f4ddfcdbc34bd990d2e8a50e69697a4630f0861eda8fd7041f5bdf83a0f09d5ee45990c6ccf2b8476e8d8f32f44e2f18
SSDEEP 48:KA1ItK2AIHIdKUMgHypa/MAac8hZ8yI/KDyQ/yNDIlKA8Ag34jHlr:KA1eK2AIHuKUMSeCycKDySuDeKA8c
TLSH
T174C1464271BA52933C7F6A08829487674E42B3637118F42B7FAC50B24D67E249DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590f67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590f67.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f832acbf4644b28b5c91cf6f55ea38006430479f6ae0d51a7347400f92daef41
MD5 8b80740a9cfa63c26e08d3abf3715c12
SHA1 c8d3ab4f6447e725e19b541bdc54b6432ec6f17f
SHA512 74ea3b8813034d95f2fbe3d15a88f7224b6a8dc3f670ad53e61a24e99249fa1bf037ea2becba61e27786bf3e6b90b28d2409c4efba7593ded932fc5db9959f56
SSDEEP 192:MzLsNXeGEQHb6ytxvItxl/QmiU1+LK4zX5Obd+jCjzorOyRwXJ4Q7q5jZEg+:usNXePTytwRGVzX5od+a8O1X7utk
TLSH
T1F6421B36A478AC7B8DE2F544B44B32135EB85067EBC82F9096EC5F1C01DB69C130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 25a9356a5b3a2708ed75f7d9cea9407f170cd5f8b1f465acd235ae5babf6fb6b
MD5 44daf33da3336f8d24175e401756e058
SHA1 2d9682094fe5c6d541b82ede68ce63e027a058dc
SHA512 356fdc186dd297dfb3e55a4e9c30eee5d43174761e1e050431f77e1768204eb7eb79f8e59908d98ecb4a0c1feac977e299ed2caa8cafb954a069d5879c4906b7
SSDEEP 384:ciF1tNn/s3n9ShzsNp8TUNTUlIlvTytwRiVzX5od+a8O1Xvu82MbdbJax9y:HF1j+9CkwgIt/tOVvuixwvy
TLSH
T1B3C208F244D7983AD9AE9B57B73D2E034EBCD067B5846A50B3985A0CCC862BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e4fbb8ca8a0e9498781fb4491789e701add978fe4f44156884f536d61962db28
MD5 975f8f2b617b234c72cf49443d4a963b
SHA1 e155bf71e0a8dc975fd3003883ffbaa76616c9e4
SHA512 311970631743bf13044a69892bdc20c7d65a353c48adde6f981691e33005c5ae24a05fd3c230d7bf6bfc5b32f7ee1e7d17ce710fca9aa22d35c537c66df10dc8
SSDEEP 192:yONb61VWQmiUyJkgGX5Obd+jCjzorOyR5/an3MYU6:yONb6WDgGX5od+a8OTcYU6
TLSH
T16202B735A8686C7B8EE2AE49B48737135FD5206BEA956F84D6EC1F1C00D765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c6010592e73594906244b8e1e2278ae76e68c695d46518ee63372b6017d8bd1c
MD5 e4a6500aa75e271ac8c37f8254b0646c
SHA1 761f4db590579f2c8e9d8444540a946ad06586b6
SHA512 47827fe5b2a1a0e2ee29f7e8e4c9ee7b91fc5faeb28728763d8365ec2871b00f6c2155a8118607152004367914688be265f9e0d416f61debea3a99527a73d478
SSDEEP 384:7tNn/s3n9SfsNXvTytwRGVzX5od+a8O1X7u82MbdbJax9y:7j+9UhtTtOV7uixwvy
TLSH
T1A1927C329538AC2B4DE2E955B50A36071EB8A067E6C43F80D6EC6F1D05DB7AC530BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fbbc68e9d92b523f434e023cafb4b136859cc8b693b14d1a65be53a0db965b8f
MD5 b6a2235802e709b45cb39b768509e8fe
SHA1 3954c0ebfb8c5e02b7beb1f86130e79ccb0b1dc1
SHA512 fffd2711d6f3999a214ed33b20865c36bd2f7b5397b7db8da9298ba20e4f1bc151d6ee4b086be0d0b0785daa3197b334062b105d96205ad73a2d7a33722a258a
SSDEEP 192:tJONS61hWQmiUySknGX5Obd+jCjzorOyRwXJjJ7q5U6:nONS6C6nGX5od+a8O1XLuU6
TLSH
T175120B32A468BC6B4DE2F954B48B32135EE55167EB897F80D6EC2F1C00DF69C130AC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fa576d1e16041a1c379f116b198c5c6edeeaba2891f8ec9b01e2c3b49eda3dbd
MD5 71f77f7f4b77f369dc39c2d356aa89dc
SHA1 5fa83ff2900f5f407e59232a61c027c31c0ec64a
SHA512 65bb5d1271e3314b8d76b77aefd695b5e866dbdd9ee6b8a7110263b1595201d78397614aa0e1a4dd58a496369e6e6780b78d451b656f86f117e7997141c2aaee
SSDEEP 192:ugzLsNXRGEQHb6ytxvItxl/QmiU1+LK4zX5Obd+jCjzorOyRwXJ4Q7q5jZEg+:TsNXRPTytwRGVzX5od+a8O1X7utk
TLSH
T161421B32A478AC7B8DE2F954B44B32135EB85067EBC82F90D6EC5F1D01DB69C530AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4e485c18a078e57439053a0b128b26f7a2f50f6aed1346c107ce4af521979edf
MD5 576f91ea3eb264a6b344977b301ec403
SHA1 4a314a0ca4f9851360d4d2f57a7e7f9a38b661ca
SHA512 ffa6101236ae317de62d0448dcf94d3fab9b31fce84d5e585adaa393f2ef0e45d611e89bbb533feb453ca9f0592163fcd7811cbb4dd9aa6f4cd7731ccbfe44e2
TLSH
T1C841D658B6F91048B3B76E1A9BF7A86E487EB9672F07C55D10110E4E0626A44CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download