hxxps://curationapproachtechnologycontent[.]com/follow-trail

Analysis

max time kernel
148s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://curationapproachtechnologycontent.com/follow-trail
Sample260708-vjaydses3s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280036512050589"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{0998AFA0-1AE1-483C-ABEA-4160DEFFE46F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
888	msedge.exe
888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2160	3668	msedge.exe	80
PID 3668 wrote to memory of 3148	3668	msedge.exe	81
PID 3668 wrote to memory of 1072	3668	msedge.exe	82
PID 3668 wrote to memory of 3148	3668	msedge.exe	81
PID 3668 wrote to memory of 3148	3668	msedge.exe	81
PID 3668 wrote to memory of 3748	3668	msedge.exe	83
PID 3668 wrote to memory of 3748	3668	msedge.exe	83
PID 3668 wrote to memory of 3932	3668	msedge.exe	86
PID 3668 wrote to memory of 3932	3668	msedge.exe	86
PID 3668 wrote to memory of 3932	3668	msedge.exe	86
PID 3668 wrote to memory of 2204	3668	msedge.exe	85
PID 3668 wrote to memory of 2204	3668	msedge.exe	85
PID 3668 wrote to memory of 2204	3668	msedge.exe	85
PID 3668 wrote to memory of 3828	3668	msedge.exe	87
PID 3668 wrote to memory of 3828	3668	msedge.exe	87
PID 3668 wrote to memory of 3828	3668	msedge.exe	87
PID 3668 wrote to memory of 3212	3668	msedge.exe	88
PID 3668 wrote to memory of 2084	3668	msedge.exe	89
PID 3668 wrote to memory of 4256	3668	msedge.exe	90
PID 3668 wrote to memory of 3212	3668	msedge.exe	88
PID 3668 wrote to memory of 3212	3668	msedge.exe	88
PID 3668 wrote to memory of 2084	3668	msedge.exe	89
PID 3668 wrote to memory of 2084	3668	msedge.exe	89
PID 3668 wrote to memory of 4256	3668	msedge.exe	90
PID 3668 wrote to memory of 4256	3668	msedge.exe	90
PID 3668 wrote to memory of 1716	3668	msedge.exe	93
PID 3668 wrote to memory of 2012	3668	msedge.exe	94
PID 3668 wrote to memory of 1716	3668	msedge.exe	93
PID 3668 wrote to memory of 2012	3668	msedge.exe	94
PID 3668 wrote to memory of 4464	3668	msedge.exe	95
PID 3668 wrote to memory of 472	3668	msedge.exe	97
PID 4464 wrote to memory of 2804	4464	msedge.exe	98
PID 3668 wrote to memory of 3636	3668	msedge.exe	99
PID 3668 wrote to memory of 4636	3668	msedge.exe	100
PID 3668 wrote to memory of 3568	3668	msedge.exe	101
PID 3668 wrote to memory of 1656	3668	msedge.exe	102
PID 3668 wrote to memory of 1656	3668	msedge.exe	102
PID 3668 wrote to memory of 888	3668	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://curationapproachtechnologycontent.com/follow-trail
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff99838c188,0x7ff99838c194,0x7ff99838c1a0
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,2820825515276214922,7125628352619759079,262144 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,10611128990975028825,3417369752326449398,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,484974880796793701,7866012480151004590,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,10632578774885092101,9493862408553013318,2097152 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,9135487570186434140,9687420843894584039,2097152 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,1420262774513618595,11651545198702231464,2097152 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,15766298343247840736,11571127812354848238,2097152 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4212,i,6398857471056625615,15799960203782455468,2097152 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4196,i,3202312621731194985,14315102910875565597,2097152 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,261250539258202181,3019179172464587082,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,15589891552357901816,18312631988577395796,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,16180625159493367618,4579694677188120487,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3369095978856802586,4954364314375929268,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3369095978856802586,4954364314375929268,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,13053657601305830677,15185028104860357603,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,1053116377036700476,4174311022931050720,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,11007438680433085973,17222847437464228416,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,2775103667028416076,16640253861074232238,524288 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5524,i,15355146445768377869,6348041610179824482,262144 --field-trial-handle=2044,i,1008212406800212756,13252616516791732458,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1b87229f99cc53c652c227dd7b0e674fd1a7f3d2071ecbd7e96d14caf01789e
MD5 12fe7e86ea55bcbc14173d158228b533
SHA1 4d08fab080251fc755b72705a654e4971294953c
SHA512 5f7f520a3c5a907c7487d7831cea4efeb50450367f23409af02c5269a3fd34cd57d86191174e7c2c1b103980b98f431afe701795717921d9887b0f9bcbc45b3e
TLSH
T199D02B7111090041C40D0032107386054303FF010A0578433C6134252D10C09834E094
MD5 SHA1 SHA512 TLSH

Submit Download

91a9b9d4-9394-4799-9c16-493a037acc8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91a9b9d4-9394-4799-9c16-493a037acc8e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 932c78ce3eb6c7fe8fd32ae318375d74f42ebd9879bbe940c96fdcc1993f1ed3
MD5 e8b7bf09307173f26ec3772e1379f808
SHA1 a0f468aa1531c06b502dcb97c59a18257795b6f3
SHA512 bcb0c23bc672997447f19d93a0d188be1812471fd5c5812f4146d120465cd56a4c026eda6bb2c2de38f62b3600d3795c89bcd7eceb3aaafd32820975126de60d
TLSH
T1FC410B3206E2C773D34200F091D01246FA3F91551A977F26DAC46CBA7E25B63F5A2C4C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d8187e57d29a3e6f1bda821b154e3d0184d8c560b9d50abad6612d05a429f934
MD5 a98f0096b9a2370b5da258987df8f0e9
SHA1 42b75ee32228419348121da3bd0d632185634d9f
SHA512 e09ef00ba57f1c363b4b1602b99ae8df0d39262f1771ec3db72edcd396f2fcb69dafa44f791f1501545d98e1c942ce235e24038b6cf633ec3d2f85abec3aea3f
TLSH
T17B21D0F383E5856EDA1146F06A14BE1BCE1D0506431C3C5986E0EF1BE3E3075E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1e07e70e174a030afc7d0fa3e583ee71056caf5486ef1d790bcfb6b2eed1f48f
MD5 1acc1ebb5994a1c11d524938382485ca
SHA1 eeb0ee3417c50e61baa4c81f2fd6ec7584587318
SHA512 34e0df3bc6671c6679e3831d7688b000a9b8962f3c2891fc757ab5a859da0c9a2e27b12e769b99241eee2fab3ae1dfea8e03c67882d578c31072bcedf0ab42ca
SSDEEP 192:sxZBR2yM/jK1Ml8UQeFF/fSsaB+DSIdpDq/W6+WNpWF/Y01zveQMIg5HJ:sxZBYqMF/fSsgybm/ba/55YD
TLSH
T1EA52F812AA345977DCDBD209FA51BF93D6F5147296901E44AAFCCA0C01E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fb22dfea2771e4cf6dbb25c427bc47bea858f5bfb1da40488356e410cd174ce9
MD5 181c0bd1f66221b8d46a1b9f3ebf550e
SHA1 c20b41926d025dec0007679bd06f880b758d4147
SHA512 96828b61bebcbf075d588279e5bb6539438b842557bc220abcc39c7c74e9cb8c3110aff7103ad13097ac5d8a798cde5294b53617e0b5e39b096614147d3eb02b
SSDEEP 192:sxZBR2yM/jK1Ml8MFF/fSsHB+8SIdpJq/W6+WNpWF/Y01G5dMIgrJ:sxZBYdF/fSshJbQ/ba/5h9
TLSH
T18B52E812AA345977CCDBD209FA55BF93D6F9147292905E44AAFCCA0C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f85905f085788bbb509fbd80b6e72b2ffc3247e9b2b080181a86878e24f8459f
MD5 9ede540fdd4e5c0f3395b9431da1f52c
SHA1 3a93707ffa1a3210c6dedcf07348796559e74d9e
SHA512 130c8223bdc3887817301fb745e374b1e9d69b403671e4aa1591358db77cdf7d905040f64b80b39f3ad09ff501daf2749aea7ee073bff2d258ce42ec1eec0108
SSDEEP 768:Do4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4a:DPu+68si2y1WRmlzQqju1jaKDILpZ8Uf
TLSH
T1E2E2193B280CCB7E4F844E5CEC26AF966ED802CBA6684D5447FA494C03C77EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1936f835e4c8fc759c87a3599a725165e9b3cf5ce8e6d0721b7bea2f92255bf3
MD5 a13142eff3d27ce7d3044eb7d662eee6
SHA1 3267d986772dfa7a545749b026673b56ce176d82
SHA512 f69b0c7019795bb9a69a60126f2ff00d66a53adb3664fdd5684a50fbb4b81a3f3d736bfed09953e29f15213445355b04d1124890343e4af9d2adad21efe33a84
SSDEEP 96:KANyKOkSsZutpnTf8njMnVR8KtpV/8p5psX5hSWAKPKRKvWK8cF:glsZutpnTfAjMVR1pV/A5psX5hvEKvWY
TLSH
T1F49186A230FA02263C3E6D09A2D597776641B3A33095E83B7BA900F11E6BE105DFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec6dbdac-6b06-4346-abc2-b29c4da76db9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ec6dbdac-6b06-4346-abc2-b29c4da76db9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ff728a25344158466895e0261af60c6f383cc96aae47ddc6063a7b617d723aef
MD5 ef5a09e7321316a8e87e3023c5472ee3
SHA1 4e21a72db6c34830558f128d46601b9245e95c7f
SHA512 571813904deeeacccdcfedf0e65c75928fff38051d75c0717ad476a8ebfa7a96bf178554b549c30fcf52321007f601480b09e343ef556874d6a7e1f1d2cdc44b
SSDEEP 384:LiFVtNn/s3n9S58Nm8TUNTUlIlhty/O9r3b+AR8GAGXtkScjmw0YJ:mFVj+9gLwgdDJrp7tk1j3J
TLSH
T1A3C22AF358D79976D9AE4787B77E2E028EBCC063B5846A40B7985A0CCCC61BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 59db822f99f0f1d7d03706394196421040a38eaccabf97133ae1e27ab9b6ca92
MD5 ccb662d0adf80d878e3cbd6fc440ded0
SHA1 0ddde5ef4be2655f8779f417281e8c98287e2246
SHA512 f7da8d41f956f7a8c0de79e91721b1d2c1439613b3da6d76734195bfc5907427e59633c8122abac8c3d1ee5813d5df4044dddc2ce9ac331b683236ff132895cc
SSDEEP 384:AtNn/s3n9Sl8Nmqty/n9r3b+AR8GAGXekScjmw0YJ:Aj+9aOeJrp7ek1j3J
TLSH
T1A4927D33AC696DA75DE29585F8472657CFB800B79AC43F80DAEC6F1D04CA1AC431BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b2a217923bb00e37c54188a2db78b83b0545515650862984acf103f8c1e6328e
MD5 2d347f17ba24f9c7c92f1b5a1c62981d
SHA1 b69186e8bec0e139386c2f62ecf26b1e4b209a9f
SHA512 ba6addd6420fbd84af1ae2fac36f74738fafb0de6ed276e2f242f99aa5f6c4809628aad859d665eff986253dda4827e24ffa6acacb71fe50caaed6ff0dcf35ac
SSDEEP 384:2tNn/s3n9Sl8NmWty/n9r3b+AR8GAGXekScjmw0YJ:2j+9a+eJrp7ek1j3J
TLSH
T122926D33AC696D675EE29585F8472657CFB800B78AC43F80DAEC6F1D04CA1AC431B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 35eac347f6f1ef5f06d7bc0a884d6a42c50d4c7f08d259e9d8112fca4d47eaa9
MD5 47073354aef79a653555b2f873397170
SHA1 24b94dd1162f9ba32ee9e858d97548b57d7ae54c
SHA512 16cb04e5e81f63f6eb59528139fe8d5571a15c7dad40921e53b855acddee8c8860835f735f7e5c5b323855ba0cef54e81d9ca529e98cf04d6c7ab8ce836c95cb
SSDEEP 384:YtNn/s3n9Sl8Nmhty/n9r3b+AR8GAGXekScjmw0YJ:Yj+9aZeJrp7ek1j3J
TLSH
T1EF926D33AC696DA75DE29585F8472657CFB800B79AC43F80DAEC6F1D04CA1AC431B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd1f4fedc998b46a1fa5cc85ef3e65d5c6b5e65b7577f6fdebf9c905199aefb1
MD5 067dc36070dfaa362a9b45ce868af906
SHA1 534725c7bb94da8642c9313032de63abff7e8c4b
SHA512 c143c43629d8c50ebd033c0ddafbaccd4a233f16f70696a9ad7e73b539be2721deea0ac57d162a9239d497ec708ec1b032fa03c6eea3a5f48cfea2861d6e9c31
SSDEEP 192:nRGNP6yMQmiUylJmf1Y3b+jc9jzorriAEMn4wTU6:RGNP6xyk1Y3b+AR8GAjvU6
TLSH
T14502C735A8786CBB9FF36E45B58727179FE8113BA9952F80DAE81B1C00C725C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1dfab8c334d980a41f28261363dd7723df8d6b86382689856b7cd6c5c5b6ab2
MD5 84b476b16dbec28930ad87678e350864
SHA1 91ed4b6426b1a800df41469cc6812e15700b42e6
SHA512 275554b8217273a2170cf73b43f5ee9f52f9e7cf67f0693635c46515b2ae7574ec5f9b83f05302e6d2ede09854d147e67a174f7c0d336a484204251ca5f06b97
SSDEEP 192:7GN/6ydQmiUyj0ffY3b+jc9jzorriAGXJ4MpqxU6:7GN/6aXfY3b+AR8GAGX3kU6
TLSH
T1BA12FB36A868AC775ED36984B48732138FF90127EA897F80D6EC2B1C04DF55C530B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27fc8344-a978-4f43-acbf-7548e105123b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\27fc8344-a978-4f43-acbf-7548e105123b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download