699e07359686520a44df577e89e9bd2418e76e161d266269ce9a6b20566efb23

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mdpc - v0.1.3/blog.html
Size 33KB
Sample260810-pl2w1aydle
SHA256 699e07359686520a44df577e89e9bd2418e76e161d266269ce9a6b20566efb23
MD5 f347891fe5e420c94569f586a11222a2
SHA1 8381c77d003ea4416c7f0ead5ef7670c9afe5585
SHA512 d8d3d330d4b7d6175a9baa8e78c12fb6a9282e9d9c449e30c06aaabaccaddbe8302fff60c7e9d5c44a671a6a00328576fe15b56c5490dc58a182518624ccb03c
SSDEEP 384:pNNu0cxbk3VJ3WxETUEbPpk/OJ5lNBxKrwt+hcROF8c/NT/RAKc/NHcRs8c/NPcU:pNNu0sseIIBi29ZQH
TLSH
T128E2B860568C2C7F4D0713C91964766C7ACF8E34DE6A49EAF2F78AAC5382DC18C5C17A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2876	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308383798200341"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{13E20032-E27F-41F0-9351-6F472DD3B6CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6112	msedge.exe
6112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1116	5000	msedge.exe	89
PID 5000 wrote to memory of 2876	5000	msedge.exe	90
PID 5000 wrote to memory of 4936	5000	msedge.exe	91
PID 5000 wrote to memory of 4480	5000	msedge.exe	92
PID 5000 wrote to memory of 4936	5000	msedge.exe	91
PID 5000 wrote to memory of 4936	5000	msedge.exe	91
PID 5000 wrote to memory of 4480	5000	msedge.exe	92
PID 5000 wrote to memory of 1388	5000	msedge.exe	94
PID 5000 wrote to memory of 1388	5000	msedge.exe	94
PID 5000 wrote to memory of 1388	5000	msedge.exe	94
PID 5000 wrote to memory of 3536	5000	msedge.exe	95
PID 5000 wrote to memory of 3536	5000	msedge.exe	95
PID 5000 wrote to memory of 3536	5000	msedge.exe	95
PID 5000 wrote to memory of 1812	5000	msedge.exe	96
PID 5000 wrote to memory of 3148	5000	msedge.exe	97
PID 5000 wrote to memory of 1812	5000	msedge.exe	96
PID 5000 wrote to memory of 1812	5000	msedge.exe	96
PID 5000 wrote to memory of 3148	5000	msedge.exe	97
PID 5000 wrote to memory of 3148	5000	msedge.exe	97
PID 5000 wrote to memory of 4412	5000	msedge.exe	99
PID 5000 wrote to memory of 4516	5000	msedge.exe	100
PID 5000 wrote to memory of 4412	5000	msedge.exe	99
PID 5000 wrote to memory of 4516	5000	msedge.exe	100
PID 5000 wrote to memory of 3808	5000	msedge.exe	102
PID 5000 wrote to memory of 4472	5000	msedge.exe	106
PID 5000 wrote to memory of 4724	5000	msedge.exe	107
PID 5000 wrote to memory of 4572	5000	msedge.exe	108
PID 5000 wrote to memory of 4860	5000	msedge.exe	109
PID 5000 wrote to memory of 4860	5000	msedge.exe	109
PID 5000 wrote to memory of 6112	5000	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ mdpc - v0.1.3\blog.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffc7e3dc188,0x7ffc7e3dc194,0x7ffc7e3dc1a0
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,10538613656014300576,1493063681911825813,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,15385027416732825771,7798954018133642809,262144 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,10819648974888915159,17796057073064970155,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,11660988188858726538,5011870931899244851,2097152 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,629286431455821460,15639740281475651430,2097152 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,8822035054762762243,10490492696283384884,2097152 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,15281682512593892279,12928925794871475564,2097152 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,4409847289272233681,15161761583219188165,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,12479685773646842857,6135851900868798914,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7844316602189726817,17700545910456846808,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7844316602189726817,17700545910456846808,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,16772170727154773410,15965871845046218164,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,9671513699759122775,5328508216181352499,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,6913839211696212258,2475861867337550093,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,9799928128578170127,7065582843239176715,524288 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,7425304877207037430,16137121052358768816,262144 --field-trial-handle=2396,i,4128796293433338377,8526242062645251022,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a86fb757b19dabece015c32bcb1ce72e71fe7b9aaf96cc924c7425c95fc8f75d
MD5 9bd5988d6ac8bf71174e90381c8aaae1
SHA1 44ed9b5a53f40549c9fa47e66fa017de7245387e
SHA512 c4fba99545c76a5bc97e661d9bf59afe0cfbc4a9deedaa617d02cf4c8a928f7a6b1da6f5cbf90a37660accf1ae3d143d56590a8ad4dd9a4d9e0da06415c553b5
TLSH
T121513EC7132659E8E72089BFEAE2645A72F5A8655E0F2E0018BCDFB45D02F21D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596826.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596826.TMP
Size 2KB
SHA256 f1f62e50337ff3bb65231cf89bf14e7bc7e169fe41e5463360ec06c8806f12ea
MD5 3daceab52c09d80bbfe0309ffcb14153
SHA1 c7141d1604e56c021990bc54b2dbcabb4a384ad5
SHA512 6bb2cf732bed328037cb73aff95ea90a36a79cd8749ef52c2a84f52a8ffc4c411f4e6c7eed809193e3f8086fb80ba45ee01503dc3793646bd980447a60322836
TLSH
T1C5513EC7132659E8E76189BBEAE2645A72F5A4695E0F2E0018BCDFB45D02F21D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3367f919547f3f4610c6422ffa0d6b69033812d2766ba2b19d08f053191c7217
MD5 f00e4bc0026e6be4978e56a56dc09d06
SHA1 332737f81b0b14523fbcd430bd48fef2c6b37710
SHA512 07553e549d54983477af816082f0b58831211389f3809b6deddaf328556957e6aecd8de18bece44644b0819ad9c0cf0ce2437788dc6ac7a86eee10fadd974798
TLSH
T151518DF782E4867E891156F09A24AE2BCE5D051A432C7C66C9E4AE1BA3F34B1D10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5c701486e8fcaa699d7c403593da8a41bbb0a1091f3b030a95fa6f83e9cd03d6
MD5 e2ceaa933b30042623df03806d8b72da
SHA1 25e538a80356f3b83ecb499f4ccfbff20f14c33d
SHA512 bd3c0d19457cbcbe365cb5f0d996c4186da06b07842adda8248788318087f05a6e8bd6c98473cdaa3f0d2c1e37d074aa5218d329e190caf24ee8358e1f9b2e7d
SSDEEP 192:sxR1RvbZ/fJsmmfYCbnzoA8p4z/g6+WNIYE6X3+GalIgDSJ:sxR15Z/fJs1fPOi/5ICKq
TLSH
T1E042D7196928A97B9CCBE21DBB55BF93E2F9503260902F58B7FC961C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 44e88bb92856541af86845bfcef1fd37fb029f71f4023e28db64c9610b96aac9
MD5 5b8ca1e1c6adf55c1f2041b0c9bf0ef5
SHA1 1130370cf1aab12953f4f5800fe9bcbc3b7932ea
SHA512 d3eb3e538bb684feae96b135efc78cec622075f3b09c08f6e1ab61389259e542e1b64dd090a57ed74dd482e55affa127d03a016b4f82c04e7b65c8bdbebf2557
SSDEEP 192:sxRGRvbZ/fJsGmnYCbnzoA8p4z/g6+WNIYEgP3+GalIgIJ:sxRG5Z/fJsVnPOi/5I+Ks
TLSH
T14B32C7156928A93B5CCBE21DBA65BF53D6F9503260D02F58F7FC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 297d21a6ff1a2e7d516e074f95d4f07073814d25b751a7d77a1b2668f9e317d0
MD5 a19cd3f02ed657a05601eee261eb96f6
SHA1 1ce1cabd33132a9a0f80eca9d45fa3e7b9005cef
SHA512 c9c6084d623604ae561bc4e318a965434b40e66173f4c97e8f82713cb2b8c979cbb75507429080ff0884e2faad9d97373ea0616fffcbaf4fe9a4066d0c9dfb51
SSDEEP 192:sxR1RvbZ/fJsmmnYCbnzoA8p4z/g6+WNIYEgP3+GalIgDwJ:sxR15Z/fJs1nPOi/5I+Kg
TLSH
T18E32C7196928A97B4CCBE21DBA65BF93D6F9503260D02F58A7FC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 111506abe6b5a0ba1df06d2689d0fba032c4290a31a67950d66a33fa94547550
MD5 8591efb27cc3db98b79622a8e38f24b0
SHA1 06212177ea0065c927d622ad1899958705a66c82
SHA512 799d0762bd0101df85542c4ae262fe7bcbc94ac3313195e3c2fe1cab4b8948f1d8f638410db7ef74387734f20fc2643832c526d0e355289b30ee8852ce5f5b7b
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVK:40Dk6DJQD810DbWgQ6DjfIQDF8F1+Uof
TLSH
T18CB2DB2F640DCB7F5F804A9DAC19AFD76D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bda237cee499f40e219b64620bc96a49f1648fa0d0fd52a08006c049f51ff57a
MD5 4db54ede29c56203a9f14688ad4c7fca
SHA1 45c1956c8628b49c348bc2423dd481de64e0aa22
SHA512 9eb8931f358e404701f967006232656ecacd870e5f63c8aff239748e1503750597ad34c5d799c60238d1e4b6af594fd4f7f1f75a9e4be458b2faff463de42eae
SSDEEP 96:KRjsJ9rhhdW1aQgldK4cgLdczLiVhmHhevL5bfrWvsagzrK4Sg9rchJEXebGKMIv:CjsJ9rhhY1ahl3cgLyzLiVhmHhevL5bk
TLSH
T1E4910545747A02443CBE7A0D88E8D93F96917972311964AB77A811B30FE6E038EFCDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0522bcbb259ada5ecf991303a83a41f9fcff6fde0c75b399e2eeb4bbd7fc783f
MD5 106493452b32b25bcb84df3454cf4235
SHA1 eff2ac4fdf67b7214ddaaf39f81a84c53da2dbaa
SHA512 e886474b6985c9d3c7acc34f77c7c0d1934567f1e7d97cd188e507bd9ed0e232af5b99a057a275e15ea1cd4fddb0a946bb00f6d0b6cfa29105d72f8b59e9c25a
SSDEEP 768:aj3ey0DTd+ZsnUZKeX6+qTko0u229a4vsT6hy6DqL:aj3vWUZpvVTVKa4rTo
TLSH
T1FEF2C031E8B15D7749FBD284B10B35435EF94123D6D82BD4A6EDBB1D058B26C134B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 db51db82041522094b1e36d49acbb18763a81c9821fd2b299cf2236ce8e26900
MD5 a74f0770e4adb0e3857b4ff56b21b3b2
SHA1 aca274a8a246ad6b08cddd090bbe79c653b605e6
SHA512 562670754c8761f9a2aa0f074123b632e40aa7f397fc723ebe3b6eac2e8d26f9c18af74c400624ca93f761f90c178c94287220e0c882404fb3b3fddc4e74c9e4
SSDEEP 768:prv+4UNbdG3Zv+YDTd+ZsnUGeX6+qTko0u229a4vsDteVH1SdW:pbsbU3ZWWU1vVTVKa4MEH1h
TLSH
T13803CF33E86589774DE6D7C4724B35473EB91163CA880B90D9ED6B0D029B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ddf46c644c104fbfea676539de696e8f3b3c3b9a226c9077975609eb980e78cd
MD5 4bde06b4360a066e76b91004e37ec881
SHA1 1d70ff381dd7d33b5e3c20016493bb015cf1a1f8
SHA512 b91e76702c9dfbb97edd10c6346af8d9fc8eece2d0066ce7e6da856114aad05702e55d9d779b3dcd307057bf0598dac431b1784fa54227ff63fda6eb8ab004db
SSDEEP 768:arv+4UNbdG3YW6DTd+ZsnUZCeX6+qTko0u229a4vsS6eVH1SdW:absbU3BWUZxvVTVKa4oEH1h
TLSH
T10203CF32E8B989774DE6C6C4714B35472EB91263C6C80B94D9ED7A0D068B5AC230FD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5fc073629518f7b49b227f51b49aaf07f44cafcbf4acde65cc4b344cb203c776
MD5 54a6f6aba1f0273b4d30b567b75d72fb
SHA1 da68a36167e03dd14cd1291c3b38f1a338c05fc0
SHA512 e7474f63d586f7b28d3a1a17acd2ca5f9908ba6ddd2113c5a16db8dea19bc419b30a13b6541e4a1f0b765e12494295a8daf193f3ca050dde8ea6da7e016b6215
SSDEEP 768:vrv+4UNbdc3hy0DTd+ZsnUZxeX6+qTko0u229a4vsT6R3G:vbsby3QWUZAvVTVKa4rk
TLSH
T1B203CE32F87999778DF7D684B10B35436EB811A3C6C91B9499DE7A0D028B1AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 913381a19eb55630f40ce4ee937e8513a8caf6ff7c1b3c26990f85fde6fe5bd0
MD5 8c7d973076c7b57fc4cdf1c0c2a09610
SHA1 1ae2a45d94474d79ea2e7c790339da4902d635e2
SHA512 cb149061377800226ad91dc6e55f6d95ab0beaebea72f226bcb2873ece66b7b6cc7d3dd9aedfceb782f77c392bc8f068f08d79ed7ed9a9ce16efa17d19802977
SSDEEP 768:Fj3hy0DTd+ZsnUZKeX6+qTko0u229a4vsT6hy6DqL:Fj30WUZpvVTVKa4rTo
TLSH
T194F2C031E8B15D774DFBD284B10B35435EF94123D6D82BD4A6EDBA1D058B26C234B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7d98e53c3b16b35163a4a202396e04d5ad1322c788921a3da12b78850590110d
MD5 6470a22848a8c8431a00d88d2d8b1cda
SHA1 e94c322b4bc2408e7a2c7e54ac9a070d1ac289cf
SHA512 488b0a10e98f011ba989314c63585c470408d854d6dfd3f1382e70a30c49f18fa9d54ffc3f811c51d605fe3c44cbd8ea3d90fc1b5881c50ab7b714df7304c4b7
SSDEEP 768:KM3ey0DTd+ZsnUZCeX6+qTko0u229a4vsT6hy6DqL:KM3vWUZxvVTVKa4rTo
TLSH
T13BF2C031E8B1597749FBE284B20B35435DF94523D6D82B9496EDBB1D018B26C234BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49ca955b-dbf3-467a-b8e8-7d1b79eeddb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\49ca955b-dbf3-467a-b8e8-7d1b79eeddb6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download