hxxps://curationapproachtechnologycontent[.]com/follow-trail

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/07/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://curationapproachtechnologycontent.com/follow-trail
Sample260708-vjaydses3s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280036518539670"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{53F6FA13-E49B-454A-B943-BE08FA2044B2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 5728	5624	msedge.exe	83
PID 5624 wrote to memory of 5572	5624	msedge.exe	84
PID 5624 wrote to memory of 5116	5624	msedge.exe	85
PID 5624 wrote to memory of 5116	5624	msedge.exe	85
PID 5624 wrote to memory of 5116	5624	msedge.exe	85
PID 5624 wrote to memory of 2172	5624	msedge.exe	87
PID 5624 wrote to memory of 2172	5624	msedge.exe	87
PID 5624 wrote to memory of 2836	5624	msedge.exe	88
PID 5624 wrote to memory of 2736	5624	msedge.exe	89
PID 5624 wrote to memory of 2836	5624	msedge.exe	88
PID 5624 wrote to memory of 2836	5624	msedge.exe	88
PID 5624 wrote to memory of 2736	5624	msedge.exe	89
PID 5624 wrote to memory of 2736	5624	msedge.exe	89
PID 5624 wrote to memory of 2492	5624	msedge.exe	95
PID 5624 wrote to memory of 2216	5624	msedge.exe	96
PID 5624 wrote to memory of 2492	5624	msedge.exe	95
PID 5624 wrote to memory of 2216	5624	msedge.exe	96
PID 5624 wrote to memory of 796	5624	msedge.exe	99
PID 5624 wrote to memory of 4316	5624	msedge.exe	107
PID 5624 wrote to memory of 4312	5624	msedge.exe	108
PID 5624 wrote to memory of 1020	5624	msedge.exe	109
PID 5624 wrote to memory of 5268	5624	msedge.exe	110
PID 5624 wrote to memory of 5268	5624	msedge.exe	110
PID 5624 wrote to memory of 4060	5624	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://curationapproachtechnologycontent.com/follow-trail
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffbae89c188,0x7ffbae89c194,0x7ffbae89c1a0
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12495623079382736006,10909309407691323368,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,7570357089064916085,9791673452139928419,262144 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,14356637776368478825,505350913388188432,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9334547629094975453,627388985545046640,2097152 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3140,i,17133884447204270094,12081273865284162529,2097152 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,12616787115244786143,16282501030228170289,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,12076825611399189115,8945500705572937166,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,2255285215615853898,11377106335490725033,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,2255285215615853898,11377106335490725033,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,14212046407759843698,11541867235997057531,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,2434269166872413512,16848856042304345887,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7716537548834437361,10499586018971243468,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,12188578397749696893,15011220420493338306,524288 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5776,i,14988230803221962021,3975737848045031149,262144 --field-trial-handle=2316,i,7139756872503039451,11358839329753542542,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 be14e349db4da5a707beccdd3003c0ce43693ffb02c43db633c3f87cfaf1b7e0
MD5 a9da08ab2937b57158baab44789f7d93
SHA1 51d27d8b71a1e8dfd68a22bfddd4f698bb8d16c0
SHA512 5d3173287db919a6c20285f5b3a6e9388d0aa41f2299c11caecb78adf698d137a19551589fbc6ba2d848b3fe0f35e947e398fea09f6482f48fd9cdef87831ac2
TLSH
T186E0E59ACC61AC3728FD472864654B86E71003562B50991B373C52089F70636458A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2dc5119b436546c78dbe6a438a0d0b5a6264c799934c7e409a8036a2f5d23209
MD5 0f15413f2d48315beebc423141bad451
SHA1 da03c33f4723e4456b72f3030be9d5f76f9928e2
SHA512 1b97347786b390ac80d296a791d5d8e0f099204d65fd856c49190d6a35889a07be9895bd2f448f14acf37032ee97adc3a870083deeaefaf75326c13a94ed1460
TLSH
T15051A2F383E5826DDA1156F0E614BE1BCE1D0914432C3C6A85E4AF5BE3E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 872f72435619a6ba848f976a275a25b958f7454b574a868939dffb05df9250e4
MD5 36e55004ae594a060fd7b588fe19a3c9
SHA1 b229e27810981c266e0c9a64d93ad630f23cfd24
SHA512 b214b98bad60e93f674bd8350de2993c606d5a54d652655b9dd9cb110896d658a121e237de3c53fc3c00e7030553d82e5c717b3288bc5a1774d69c9e4e54bc28
SSDEEP 192:sxZ4RNyMqZjK1Ml8UQLkh/fosmvz8Z5z/XzodpE9HW6+WNpNVdYQYJzcVHIg5vXJ:sxZ42qgh/fosmbC5r8UHbxd4cBh5
TLSH
T1D272E916AA3849779CDBD209FA457F93D6F9056396945E44AAFCCA0C00E7BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bb1d23e456342ac60a7a9c58ad170cfafdefbfc1934c5c9a767526f243af9b85
MD5 aa6f10f5f1e23b135cb1048afdaf7a58
SHA1 61a9bfa586f85688d61e455bfb85b0a6bff97fae
SHA512 5d371b2d18c5fccdd6f49486fd8450d29be6917951dd4055aa71edccb75f1d491a68688aade07fb992b85dac7707f6187a532fbba989231949a2a5fa7c6591f1
SSDEEP 192:sxZ4RNyMqZjK1Ml8Mkh/fos7vv8Z5z/XzodpESHW6+WNpW+/YQHJEcVHIgjXJ:sxZ42Mh/fos7HC5r8DHbh/ocBj5
TLSH
T16362E916AA385D778CDBD209FA457F93D7F9152392905E449AFCCA0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 8bbfe7e01e59040dafca24c1f193eb0363824987759f278ab324ed37d6526ad1
MD5 b08a4af421f6b5dae5d6850e968af2b4
SHA1 3437cca59ed740ceaf31284948570b874f73b347
SHA512 9b211f24c225cc42d272297e42b8f12c25039f89f2e456bb623bea0de533ffc61086a60e90b9827a0fc296e7596ce35f3c205481a5f9d3a5733ba51f4a542d83
SSDEEP 192:cVSnNDxZ9l3iZ3QxVl/1hVPuVpB6/masMsFt:c8NDb9ViJQXlthlunF
TLSH
T19AA25A16713A460238BD6D4CB3A68A3B4F4271633418A5EF7FB810760E6AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 99f2828e31767446623446d15b91e7675d2b4ea53426305dce138d20b7a2bbdb
MD5 6e30f23eccf73b82a9b866f036d4fff8
SHA1 4d7779816b812ae39a47c1668c20d265790ad87c
SHA512 2e415cf04f884e62e6fe52bf6522265b0c9eb1f163b928fee0953b8fe5f11d56e85d6bc8912f893709f4a5286676889b3e4823fa3acfb9a90c2c8cd85ce7dd76
SSDEEP 384:nwiF1tNn/s3n9Sa3sNL8TUNTUlI4kFJSjb0CifbWo0Y6E611MT8fScjmwMYxF7IQ:LF1j+9D3iwgunzo0F1U8f1jXr
TLSH
T187D25C32EC95CA67FDE74ED5B64A7A46DEE04263858C9ED4DAD85E0C00CB1ED030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ed4a31b15a37eba40e5a57498841609814f2606a4b48ffaf9ac34504049622f0
MD5 e67e8aa5ad0f5430e4029162b0a75c2b
SHA1 f952029b17f8769555f0ebdf05b395ece8c0e5ac
SHA512 8bf20a5c918b934adc455d62cb16b98f2334385d344ef9746154ea195aec52f9a0f32b89cba8d48eb9ad68bd2fce982a190818da0d4e00aed7253d033915a5a1
SSDEEP 384:n0iF1tNn/s3n9SMm3sN58TUNTUlI4kFJSjl0CifbWo0Y6E611M2fScjmwMYxF7IQ:PF1j+9O3UwguRzo0F1Vf1jXr
TLSH
T1E4E2D5F298D38977E99E4B97677D2E029ABCC16375485984F7C81D0CCC861BFC306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 80f03c6daebf0833daece1bffe7c0d1de934d253a25b55fc7963e8fe3e910eee
MD5 3f8f9acbb1488ff58608898c519141cb
SHA1 beb71637590267940362235fb401f1d53370c58e
SHA512 a01b82140829418a452b30dc30a2f0b82a8b71740b195f44fdbb53b1e2f80d4bfcd6957aae6157dff61343f4231ec018740758a9a7ed4ae810b5a5a7ef3963a6
SSDEEP 384:njiF9CcmyWCy3sNL8TUNTUlI4kaJWb0CifbWo0Y6E611MTRfhkP+lFYS/k1lHF7q:OFccpy3iwgpzo0F1URfhkoFYS/g8
TLSH
T1D3C24B32EC94CA7BECE74BD5B64A7643DEE04263868C9AD4DAD81E1C00DB1ED130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 af5356f3c65c95b026a06fb8ae4c3a814db31bbde01de97a976424ffe4215b4a
MD5 53a33735531261881df9ad0f308f19e9
SHA1 7cf9afd6641c650b50e1c994a067e8956c950e8f
SHA512 e3e0af53e0050b2afa8e4df7aa24c8ffc79dad88894239f6f0a4ebf48526e243b4f8fd6b404e808446ec372a93ad4928e7a38b965ac83e7b0dad834b96fa2e3c
SSDEEP 384:ntiF9CcmyWCs3sNh8TUNTUlImkrJ1lJCifbWo0Y6E61O7udhkP+lFYS/k1lHF7Iq:kFccps3swgD6o0F1O7udhkoFYS/gB
TLSH
T143B25B36EC98CABBEDE74FD9A64A7647DEE001A7859C8AD4DAD81D1C00CB1DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ae03c82220635632531645148ea4d504e0f70a5edf893bea293aaa6f6b277052
MD5 1e2bda7ccee493727b3451eaf1b2cb67
SHA1 decfeab3efdb84b8c1189de93bc45f20d1231d4f
SHA512 910aa61e1097919720dd410c3852877d4a0b4edd321c5b7d3f12544de2dd7a238caf5f6ef591e97b4a84368fe4b0f708bb0f5eaf15f78f6ca4774f0feb047a18
SSDEEP 384:nriF9CcmyWCs3sN/8TUNTUlImkrJpFBCifbWo0Y6E611MTkfhkP+lFYS/k1lHF7D:GFccps3ywg/yo0F1UkfhkoFYS/gB
TLSH
T140C24B32EC94CA6BECE64BD5A64A7647DEE04267854C9AD4DAC81E1C00DF1ED130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 56524bd23bb490269eeafd667d3146edd0d3161c83a0d0a85be55fe12ad9e1fa
MD5 aa738dddb0040b893072e560c7cea3ec
SHA1 4c73cd89188576bc2e0ed2d26e147e32fd1e9d96
SHA512 9d90ec933352b8de384b6fd9c6eae052929313ed650683cdee375cd1c1c20acd5c329392ddff154ba30d142cad32e65457077d5ada4d4cc207b2328256fae220
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59554a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59554a.TMP
Size 392B
SHA256 cef9edabd392902eb655ad6071b5287b75f89cc11f5c02c5d5ff2f6465982c6b
MD5 a18720f9aa8fbb7d8130e4a88213b6ae
SHA1 78c78482971ed72650567046ac259f0627968e19
SHA512 06eec4a4ae03ef007339b1856ca2dbbd4ec612015acd24296e055f09af5a9d1567265d75c31d7071c4abbcc878e1700d7908165f26ca9598547bf42fc7e53134
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa2b12991b9ed6287243a84c3395d5eba030c4ac9c644fcadcc12141062b3138
MD5 1321ec0e96e5bffe38bcbe59ba16a834
SHA1 bf70e6a403cf589372025e99d467fac3d54b2de3
SHA512 98655a281c7926aa178098afe3b270ee8a1bb413ed85482f5a8fde304a79952d49a8cca3dbfceb4a1f2a58bbcd1bc90bbebffcb06482badb244418266e40aee6
TLSH
T1A0411798B6ED1148B3B77F5AABF6656E047AB8772E07D49D10110D4F0632B00CCA1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-204-0x0000021E048E0000-0x0000021E058E0000-memory.dmp

Download