hxxp://clarkegroup-new-contentmanagement-se-ii3e[.]stage[.]cp[.]bluerange[.]net

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://clarkegroup-new-contentmanagement-se-ii3e.stage.cp.bluerange.net
Sample260818-wc9ntaxcmh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315488759764971"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{ACB2BB70-F98A-4D95-8A3B-F8BA93BA9200}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1656	4008	msedge.exe	90
PID 4008 wrote to memory of 4916	4008	msedge.exe	91
PID 4008 wrote to memory of 2388	4008	msedge.exe	92
PID 4008 wrote to memory of 2388	4008	msedge.exe	92
PID 4008 wrote to memory of 2388	4008	msedge.exe	92
PID 4008 wrote to memory of 4708	4008	msedge.exe	93
PID 4008 wrote to memory of 4708	4008	msedge.exe	93
PID 4008 wrote to memory of 4384	4008	msedge.exe	94
PID 4008 wrote to memory of 2052	4008	msedge.exe	95
PID 4008 wrote to memory of 4384	4008	msedge.exe	94
PID 4008 wrote to memory of 4384	4008	msedge.exe	94
PID 4008 wrote to memory of 2052	4008	msedge.exe	95
PID 4008 wrote to memory of 2052	4008	msedge.exe	95
PID 4008 wrote to memory of 4840	4008	msedge.exe	96
PID 4008 wrote to memory of 2904	4008	msedge.exe	97
PID 4008 wrote to memory of 4840	4008	msedge.exe	96
PID 4008 wrote to memory of 4840	4008	msedge.exe	96
PID 4008 wrote to memory of 2904	4008	msedge.exe	97
PID 4008 wrote to memory of 2904	4008	msedge.exe	97
PID 4008 wrote to memory of 2320	4008	msedge.exe	99
PID 4008 wrote to memory of 2320	4008	msedge.exe	99
PID 4008 wrote to memory of 2320	4008	msedge.exe	99
PID 4008 wrote to memory of 1896	4008	msedge.exe	101
PID 4008 wrote to memory of 1684	4008	msedge.exe	102
PID 4008 wrote to memory of 1896	4008	msedge.exe	101
PID 4008 wrote to memory of 1684	4008	msedge.exe	102
PID 4008 wrote to memory of 2888	4008	msedge.exe	104
PID 4008 wrote to memory of 3980	4008	msedge.exe	108
PID 4008 wrote to memory of 1248	4008	msedge.exe	109
PID 4008 wrote to memory of 1164	4008	msedge.exe	110
PID 4008 wrote to memory of 3936	4008	msedge.exe	111
PID 4008 wrote to memory of 3936	4008	msedge.exe	111
PID 4008 wrote to memory of 3056	4008	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://clarkegroup-new-contentmanagement-se-ii3e.stage.cp.bluerange.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffc32c5c188,0x7ffc32c5c194,0x7ffc32c5c1a0
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,1669910203222721553,11761257228241374646,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,1532195450662609114,5959957341052141065,262144 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,11805127466771014690,15991980135630424880,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3200132853297078215,7595881327881027918,2097152 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,11830044715172348660,5541379677360437071,2097152 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,17626922365761742883,11612740738704366235,2097152 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,1784287221561286768,5519584926172901125,2097152 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3676,i,13930747222672227568,17662030448180035901,2097152 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7483124927517544094,6711864557725023341,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5493939586307777274,3451159217248336879,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,477636412195384422,10002092995112521480,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,477636412195384422,10002092995112521480,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,11206227915264052765,8735624457452516294,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,9724148497529758480,638937765585916430,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5725915233326084393,13369561219237401955,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11125553709499449228,13001164658327261234,524288 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,10713849584572685464,4729960012392651284,262144 --field-trial-handle=2432,i,7884969891985915304,15164338103694337269,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fb2caf64281f166dce77880cd8503ef0628c55f717867dbe8a221a794d7c49b1
MD5 ba3313cc75fa24f8123deae0d3b07483
SHA1 e34876c21c367c479f44fbc4a31fd430dc4a8990
SHA512 3adc4b52de16912eb420e33b8e0b3b443b2469a980038358d0b83019296c1592f17d8f2e07c7bb82db7eee5861fdd364ff037de0050473c1f37c05db82973a97
TLSH
T19861C53825237590DFC442307FD241B4F5BD86D9F56FAE7A1D1399733A09322728A6CA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fe5baaf3936e34404b4ada1f10f2fa9f5c459407fa8d31b87762dabb9f1762e7
MD5 251be0735d2f2b3d40278d196c038c84
SHA1 3beb27b591732337a039a115597ae0331dd121ca
SHA512 c02691f5e2b98d1c3c276d4f914919aa7f703b76b66ca785b3da9fb6f6db28eb83bdf87c0dcd336039dc860f19d83aed0ce848ca19261e307143dfb5d06e0f07
TLSH
T15331CCB3C3E5D56D891116F0AB286F2ADE1D0906C2293D15C9D4EF6B93E3436E101A0F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 88638849582c8c65b630f9dc9c4fdc93b397407e84af08b84cfc7ea05ef080c9
MD5 8a9bcd6f712b0324ad8cd8e49fcec955
SHA1 1ac975e42cfb330f99f3abeb29bd0588b19b73c3
SHA512 6ffe80e52b1f8be63c248193b93f960c060a79b7f99f6a18239000cf9920bafab7639dcf7399a6e458052ffa5d07e3436a96c490c4494387c393bbef98605311
SSDEEP 192:sxZwHR9kA/fqshOCEv+R6Idp7KHW6+WNknqy/YCaGdIpIgrJ:sxZekA/fqsrK+lmHbG/Po9
TLSH
T12822A7126E38A97B8CC7E319BA15BF13E7F9503291951E48AAFC861C04E7BDD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8db82976f6b49ee3d724436be65105498b35fea8f6e5e4329ce3ef26914a6e99
MD5 be8951790a5aacf4523b139d036162fd
SHA1 7a09b7a455266d5a6314fcea79cdff91309cbb40
SHA512 3a37705c3914ffddc33808447d7389ae2622a501fd65e77f3cb8d537e0903c28a7397bddce26adb3ad577e9f13bcc4dbc0cba6ea827b421a5d9a4c0edf5a3cba
SSDEEP 192:sxZwHR9kA/fqsTOCEv+R6Idp7KHW6+WNknqy/YCaGdIpIg56J:sxZekA/fqsZK+lmHbG/PoE
TLSH
T1D922A6126E38A97B8CCBE319BA15BF53E7F9503291951E48AAFC861C04E77DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9503950a5ed36379c2487346202d1d99e25505ec0ff848a2a1768a5602fe4399
MD5 07f6e701d68923d340d5c2c46b930aca
SHA1 462614e9cc250b3fec1bba1e7edbcd6257169ef8
SHA512 f11ac1ec09030b4dfd31e450c0c2542165c6b90ad3496bfa3e1e74677d6fe835866decdfcf7db0e42b75705f22f004f60454e2aaff2fb98d022eb34149d22750
SSDEEP 192:sxZwHR9kA/fqsTOCEvvR6Idp7KHW6+WNknqy/YCFYdIpIg5QJ:sxZekA/fqsZKvlmHbG/oou
TLSH
T12632B7516E28A9778CC7E219BA15BF13E7F9503291951E48AAFCC61C04E77DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cc06fb7b6cd5342af7b5342ada5cea53a7fff2114a34579673c4e20249b29352
MD5 840efc18fb19dc35ed1a0ffbae649a7c
SHA1 92da54fe76adf94857ea3afa80f51e833cfaeea2
SHA512 abf56b8b359be1a3ad9ac0389a04fca5e30ccac53f0223c668d86847007519a133c2daed06996dba3dd273156c4f540c0982015993edceee56a0b6fccecab9c8
SSDEEP 768:gsqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrnroE:gsqbUj+WvSCs6u1jaaZLbWr0E
TLSH
T1F0C2D83B340CCA7E4FC01E9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 56d6c90f2fee04c633886ceb82d6c3f44ca08ec32c9b7d5cc0841f7a96c2ba13
MD5 8db0ae2a1ea11007f5d470b83e444688
SHA1 80ab8cdff456c12e5a5d7e1585dc375770256da9
SHA512 ac2308b72e589bb91525db3b4654ed963eb6d2f3a8f0da3a35ac211f4966a1571458ce79511d43933bec9fd3511dbb3f1efa53397384e47c3f905ab330793b0d
SSDEEP 48:K0TQ3D5FRkhFmPIm7kKfBX5jsnTRtZkpt6PI6bkK/BH5kLz08aRz5yxoIvKx2ElB:KEIgKJB0QKp+ayoAKx2uRyK6sl
TLSH
T12C913217757E520228BE2848FBA696665F9531A33064F4BF3FB910660E26E210DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bd38139ca1377b2c4cace2c0d83268e94eb58d859565b30875808e25254523fb
MD5 d6c91c727cc68616216a463e00233b7e
SHA1 5963ee3e6f3ff79febaf88b3405275b02b7a06b7
SHA512 4541f9a87279857bb38acbd451cfd3ce961318871e35e96eeba728094b771fb0602039552879af2a99196abd5411b4d1e1f355c2d336e421a1e1909d63765f44
SSDEEP 384:/ZcIhsN2fTHM79Ea+NOjR0OOPrXLpe8C/2BI:Xh54uaIOjR0Oi9PtI
TLSH
T1FA928D72683C6C676DE3E684F88627179FF88077E2C56B94D5DCAF0D01DB668031AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ac35c8e56e73d62891849781170b0dfeb53c345105c7a5debb1473175f33d633
MD5 a7940dd2484167b9c2a9c168f20c478f
SHA1 8a65294e7717b6c1ad21a5a26342435ee2019695
SHA512 e641bbd6872d96b1cd9ee029c20b8361f54fc341d71d3fa72817289e08315e631b18b5f698a18f944df614942bc4b22d92fe243d5d045215e43f53bbc7ce9092
SSDEEP 384:8FiZcI3sN28TUNTUlIloTHM+9Ea+NOj60OOPrXLpe8C/2BI:8FQ37wgyZuaIOj60Oi9PtI
TLSH
T1BCC23CF254DB5836E9AE9787E77D2E138EBCC067F1856690B3889A0CCC9617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cefd98b0e177f8d8afbb65512c20a5f79401aefba0157068058e38c8a4b2aaef
MD5 5e7c5c326533a44c6c5c58f2dc275e81
SHA1 4ff11214b8f14bccbb87261e3dbf8cc04dbf9e04
SHA512 acb84fb37f4b2b63d1f06bd14f560a756dd6e73b54311a16f9033e1c568b1a47ab1743b8be794e2b593b717fe9eca7ebeaa5918d5a141e7a0d61fd6dd1f65a78
SSDEEP 384:LZcIhsN2oTHM79Ea+NOjR0OOPrXLpe8C/2BI:Thm4uaIOjR0Oi9PtI
TLSH
T176928D72683C6C676DE3E684F88633179FF88077E2C56B94D5DCAF0D01DB668131A829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d4be7a3189376a64b8847911eeb3deee0e2463cf8e1a47a0f845e7245aee319
MD5 6a3b7d337aa9358dc366852c0dede670
SHA1 0eaa6d07b3bb2a67cfcd4dd1183f1e22fb342e6e
SHA512 c5136a61210882e4bc2fa00da48877bf5068e96df2885400de619c725150fa66477e0ee4c32269f79496dca7ae63e0435d882f171415e6174560d5f9c316e76e
SSDEEP 96:EqONkjQsjpf1bxX5ih/cIPURHl8h4otop5hnDpBfPgvE5BzatIRdy+88OmlmsR1J:vON76Db6QmiUy1vHBa+jROmDRuRgESU6
TLSH
T12C02D735696C6CBB9EA26E48F88737279F94103BDA966F84DAD81F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 343ed6c491883cbe0ebe6e5b7a2baadd8c7ad2b3e45cd9d046b29176fd0cd276
MD5 b884c80b9cb52ac479923c40e99fa6eb
SHA1 b140f8d42c66bf8bcb60ea11d54b771b7b255897
SHA512 01aa0be6b2204a1d47830174ea4a84a22f3ec799be2f45e596e645fd2fa4a8b9b40ed478d247b88e78a861a05e40a301264442485422f1da08e139323a05d507
SSDEEP 192:8ONrD6DbnQmiUyPvfBa+jROmDRk0NzfqvU6:8ONn6BMfBa+NOj00U6
TLSH
T14512E936787C5C675DE2A594F88736139FE84127DA8ABF90D5DC2F1C01EF65C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 068163f229eb1a157ad36d6e99e7a550247e83cfe47a356755af564b66876f51
MD5 4560b295360af71c0abd09ec84bc83b8
SHA1 6c9ae6f1b3f795125a0305e6759c9f1116f6c6ae
SHA512 db29cb6388449fabd773182c135dbbd467bfa72bf4649d6502ec24507758b78a8d3a6dad319c06d43d03118394811a99cb1f5f78b31ef4f22d7cd0182c41b4a6
TLSH
T18F412959B6E91148B3B37F5AABF6646E487FB8732F4AD55E00010E4F0622A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download