hxxps://f005[.]backblazeb2[.]com/b2api/v1/b2_download_file_by_id?fileId=4_z840a3aaf1230191bab0f0a14_f1028cc22c2d12d8d_d20260819_m141437_c005_v0501036_t0044_u01787148877538#[[-Email-]]

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://f005.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_z840a3aaf1230191bab0f0a14_f1028cc22c2d12d8d_d20260819_m141437_c005_v0501036_t0044_u01787148877538#[[-Email-]]
Sample260909-l5hexsdr2v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334221635411376"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{51308791-AD85-48E0-98D0-648F693BF753}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4556	2448	msedge.exe	85
PID 2448 wrote to memory of 1908	2448	msedge.exe	86
PID 2448 wrote to memory of 3640	2448	msedge.exe	88
PID 2448 wrote to memory of 4460	2448	msedge.exe	89
PID 2448 wrote to memory of 3640	2448	msedge.exe	88
PID 2448 wrote to memory of 4460	2448	msedge.exe	89
PID 2448 wrote to memory of 4460	2448	msedge.exe	89
PID 2448 wrote to memory of 1492	2448	msedge.exe	90
PID 2448 wrote to memory of 1492	2448	msedge.exe	90
PID 2448 wrote to memory of 1492	2448	msedge.exe	90
PID 2448 wrote to memory of 1240	2448	msedge.exe	91
PID 2448 wrote to memory of 1240	2448	msedge.exe	91
PID 2448 wrote to memory of 1240	2448	msedge.exe	91
PID 2448 wrote to memory of 3128	2448	msedge.exe	92
PID 2448 wrote to memory of 3128	2448	msedge.exe	92
PID 2448 wrote to memory of 3128	2448	msedge.exe	92
PID 2448 wrote to memory of 3684	2448	msedge.exe	93
PID 2448 wrote to memory of 3684	2448	msedge.exe	93
PID 2448 wrote to memory of 3684	2448	msedge.exe	93
PID 2448 wrote to memory of 1712	2448	msedge.exe	97
PID 2448 wrote to memory of 1944	2448	msedge.exe	98
PID 2448 wrote to memory of 1712	2448	msedge.exe	97
PID 2448 wrote to memory of 1944	2448	msedge.exe	98
PID 2448 wrote to memory of 5024	2448	msedge.exe	100
PID 2448 wrote to memory of 3584	2448	msedge.exe	109
PID 2448 wrote to memory of 4648	2448	msedge.exe	110
PID 2448 wrote to memory of 3096	2448	msedge.exe	111
PID 2448 wrote to memory of 1576	2448	msedge.exe	112
PID 2448 wrote to memory of 1576	2448	msedge.exe	112
PID 2448 wrote to memory of 1996	2448	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://f005.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_z840a3aaf1230191bab0f0a14_f1028cc22c2d12d8d_d20260819_m141437_c005_v0501036_t0044_u01787148877538#[[-Email-]]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb3667c188,0x7ffb3667c194,0x7ffb3667c1a0
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,9387691892297140259,11614189849673262050,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,15730945772403707960,15339415274435408994,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,11292598563976238287,6623607777918091854,262144 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,16129050834618536154,16919821859864700644,2097152 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,818650973635329868,10716300203828614131,2097152 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,9280293186569705686,9933922894147370633,2097152 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,16782357433964736635,521187282984291655,2097152 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5814733635842151039,14259703183472011687,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,18217765317414959251,3301438024533290717,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5699716009156721746,18040069261907671234,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5699716009156721746,18040069261907671234,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,16992388009159688589,17704401793046358416,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,6699887919762478057,17210185379230652195,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15717673114118726792,12066605988030990803,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,10893529475062504836,15659534718452022990,524288 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,12015644623593219275,1030027800420109550,262144 --field-trial-handle=2440,i,7905769813542995561,6627835808987691216,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e16f76f60cacb2bf1df2a82dfd97d24e7b01fcd9d11b4a82c1e95e8f320b7f86
MD5 c0affdbb8356d5bda483fb5bb8b5332b
SHA1 124bf2d957e4aa4d057ed229eb9215a76dcb8c5a
SHA512 62caae5cefa53b86bb36f5585c6089744d5f84670db28c99ee5df53cd5ba971718760bc9911efe93f5f7728c1ded9cea412d87c7028f416e18daf39480db2bd6
TLSH
T10C61605B0216EBB7D329C930D3E12545BCB280160A2B1F7352818A7DEF31BE7B16621C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589258.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589258.TMP
Size 3KB
SHA256 f08b30717711b8c34afa9da0d840ce3228bf326e9f0b441f46cfc764c0579756
MD5 b2bf9b1c3d8c8d2e9e1a7e9c6caeeffa
SHA1 0f534be0d1140cb2545307dcaef45aa4afa9617c
SHA512 c43f698de3e92d2ed51fbe7779f22b948e203494526da5e6e3ad481b217b0781160ae6394c11179c742a0e7d24c639d8ac0e0f7c4356f85c480406fcb3acd303
TLSH
T16161715B0216EBB7D329C930D3F12505BCB280160A2B2F7352818ABDDF31BE7B16620C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e94b3e3c399226a328937fb254dafe8f971f2af8f818ec77ccffeadde2a5aff1
MD5 3cf71ed4b3d331e1176afc5be4cb3ad3
SHA1 f2e54c3ac99a5a7e604630f405e642542d46d123
SHA512 9f6ad2293df3f5474522e583d5f6e4a7e55252512a1f4bc57ea05756ec79bc80e211ec74a59b593d4aa922215f4a0970d15bdf8f70aea44c275ea07afa9739c8
TLSH
T12231AEF383E5856E8D5116F09A147F2FCE6D0506836C3C1A89D5AF6793E30B1E101A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 24893d70f1f7b119e732750980e996243f898db572ceeba4b7100ea771bfebc8
MD5 f2cc0d8e0a7459c9f052ac2bc7124621
SHA1 330dcaebb9cf37d274eea87afcd0571bbcd9f073
SHA512 4d54890b2cf26fb18dc50069f1e54c1082e4eb0cee58644e425102dc0069ecf82009c1ebd42111797e675900682efd545873319b076c00268195c6ef93bc8d66
SSDEEP 192:sxZBPRRyM/jK1Ml8MWX/fOsUyIdpxPHW6+WNJ+b/Y46KklIgrJ:sxZBPjuX/fOsU7BHbq/09
TLSH
T15242D711AA34697BCCDBD309FA55BF93D6F9057296900D44A9FCCE1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7ecde5c7b8c00f4e74a5138e2a2e220ada12840f3330718a9e3801a9af1096d3
MD5 2ea75df83303b017962e17453bc1ab5a
SHA1 a16359bb54d8ebd08cbe66df6014e615cd284770
SHA512 4b5c9c331b877a0310488ae9283fba276c900ccdb159f89acebe55e277ea5858b2e4d056f3bb32f2fa14d0b494e6e76412cbce5a4942f17d67c9b639a83c0264
SSDEEP 192:sxZBPRRyM/jK1Ml8UQcWX/fOs6yIdpnPHW6+WNJ+b/Y4fLklIg5YJ:sxZBPjqHX/fOs67PHbq/Se
TLSH
T14252C812AA346977CCDBD20DF951BF93E6F9057296900D44A9FCCE1C04E6AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f374cde26631af16b74839921e6e1c868a3818ae1f25959cdf409b1966c64142
MD5 c9f587d0ba28a20c96bd2764f240cbfd
SHA1 a26a39cb997a875cb6d86b1351a26389c3bbcd2a
SHA512 d691980b8d72c709d4588389a1dc101dc828e0565b1942b57712e39afae99eea6bf4709f1797261016c8f1799c2fe73dffd399d65894fb541d8173fe9d5c8772
SSDEEP 768:Rx8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdCrolkuUns:Rx8iJPNWvx76ru1jahALocdZfUs
TLSH
T1E7D20A3B680CCB7E4F844E9CEC266F966ED801CB5B948D5447FA880C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 806ac7cf57f3fd2742e745c54ec845ff82574021ef4e8d1a9e82078fbea97e14
MD5 496a9dda981ca7ed08cf1f6e636126a0
SHA1 8e195c9917477990dbe11525113e747dad387e54
SHA512 ff39e88bbf0210cb9f18f45286e10bca796b8efaf2b181ac31213ad3e244c76eb3a22e49c4002c25ca1618d0b4947b63abb85e1e14f92efbe7e44cdea9fc8743
SSDEEP 48:KwfIlKoK6IfKTiELyp4IXKRGcefelRHBlzu1MCINJzKAq4y:KwfyKoK6gKTiaK4YKRGiQgK9n
TLSH
T17591240671FB42263C3E65189366872B4B417FB33018E42B7BB854B11E6AE244DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592ed6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592ed6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fefa7562b0a24b0d94640f2af62c3de8f8cf3ea7ab2cb917e80d5cfe9184ebeb
MD5 69ed0de101857161030fe508d0364c7a
SHA1 ddcd0ca68df49fcacf5f9ab9da9d5f3b0181a696
SHA512 f3541c9fdbfd87852deeee92d7e679d40976c12626accca1c8e4f94ef1848d4b941d2b5a0f43330d8f94c76c2c7d01f7ad49b4eea03e01ac0ea1b180eabb2531
SSDEEP 192:uvLsNgZQbOKmjmQmiU1vD34k03bb9zUNEjYLINqAU8:asNgZ+4G9okqbFUiBFU8
TLSH
T1153228716878AC7A9DE3A645B04737139FB44127DBC86F94C6EC5B1C05CB2DC630B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d85403e69a8fd7769e939e2718a153e55cec635738455d9d67d55e9717a1a3b8
MD5 0c2c20c1646b0004f1ec5f9306ae68a4
SHA1 6ab281ea59106a13720b04f758a543639c0482f0
SHA512 ecb971a954f07aef17433d4b5c8564b0fab12fa54f279bf90d8773c4f8602e19fe0d2b2e273a4df1bb388bf3b4326f8f62980516930c76b37885a5e432cff091
SSDEEP 384:XiFiZcIDsNg8TUNTUlIlr+4GjokqbFUieFKPno8:SFQDpwg09QbeFw/
TLSH
T114B21AF218E7987ADDAE9743A77D2E034EBCC163B6849A50B7D8560CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6f5f8865f4db8775ae3ffafa43727c144928e3aa78c85b92509a2d954534f87d
MD5 c9509738c7174b2ca882a0389ef23c36
SHA1 fbe04359a62fc7f51c9e72e1c221cd30efdcc351
SHA512 d2c89a22077d0bd342617da181c96e062fc339f3f9984215249b911a53cc4587115faa110a4f005f5298c98046b39a65580bbf29f9ef76ab8cc80bebfe642dc7
SSDEEP 192:uDLsNgOQbOKmjmQmiU1vD34k03bb9zUNEjYLINqAznmpo:usNgO+4G9okqbFUiBFKe
TLSH
T12A524B722878AC7A5DE3A645F04637139FB48167D7C82F84D6EC6B1C05CB2DC2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 e01a63baa06af76232ec6798a2d7e091e7a362ba0f4d18c80a09aeca54a3c5db
MD5 70526249418334cd9f74fed2671a4fb3
SHA1 573c7c45fae48836cf864e814d76053486f307e7
SHA512 0b6273a29527b8ab684165ab661824dc5e705e8c010499525da4582188b5119a85c852f5e505ebda0672524023c4bc396aff1b1bc7d11772fc8c8db8e0b8aa31
SSDEEP 192:uDm+xasuheOwQxMGsNgKiQbOKmjmQmiU1vD34k03bb9zUNEjYLINqAznmpFnCZSt:bZcIhsNgr+4G9okqbFUiBFKPno8
TLSH
T1DE726CB22878AC7A5DF7E246B54677134FB88027D7C85F8485ECAB1D05DA6DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5483d5f2e23e9184955ecaf86a36f4ab90682e9b4e137b24b6e0169fc677775c
MD5 7c9a4c38be5b170df6a38f4d1aea65d3
SHA1 84a2e279a8583fee778dae510badcf081e2a3284
SHA512 5d9d4af7daafa7e22d95c9e0bdcde50cac43be47801df67436c58c6deffe617366d91fab0f0b3d4fc12eed0e12df7c3a14119c0450b6c2491fe9ff0a092e5ae0
SSDEEP 192:hONJ6kSQmiUyQvY903bb9zUNEjpcRNqAU6:hONJ6jbY9qbFUiyFU6
TLSH
T14712287168B8BC7B9EE3A945F08733135FA54127DBC96F80D5E82B1C01DB69C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43128493eb3d694ff47903c4a9217dd8768b3593322c4784c5aa75b93fafbc19
MD5 b2e969375bf60510661fa190631b0de9
SHA1 9fa9878f0c6d521ce5683f67930062451963def7
SHA512 c7920627c81e6dece52a2cb2f305ad9c8fc86e33cb269762fba9cffe82072bfe543475544924ff0cf6e66657d4e1bdcf7a30bfe67c3ccd66736b69e6ba0afe25
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5F5DxbBhPwivh50xy0SFYK4AxYYCs:gONZ6kDfQmiUyXvZ903bb9XQiSCCU6
TLSH
T17B02E835A8786CBB8EA3AE49F48777275FE4117BEAD42F84D9E81B1C00D765C1702836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9f26b609d52b13a2ea4fef37344a4f38ed954d025ad39a929f9faf8bbbf6866a
MD5 ead4b960bab3a262818a56208c6b58b1
SHA1 477450185330d86c5a284d4a28b816a211282a65
SHA512 2c5e99a1800069dec9d93305c22b36de44919cd757b07db863eaabf310b971d97f490fe6672f41ee75e263ebfe7baa34e5f03fe60f7850907fbda02a94f4511b
TLSH
T12B412A59A6E91148B3B76F569BF6686E487FBC372E06D45D00010E8E0A72B40CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download