hxxps://radleybalko[.]substack[.]com/p/the-framing-of-chris-duncan

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://radleybalko.substack.com/p/the-framing-of-chris-duncan
Sample260910-ynkvyaxybs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335437652076561"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{1079BEB8-BE9D-4DEC-8216-D32BF75B8023}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 5040	2908	msedge.exe	84
PID 2908 wrote to memory of 3596	2908	msedge.exe	85
PID 2908 wrote to memory of 4408	2908	msedge.exe	86
PID 2908 wrote to memory of 4408	2908	msedge.exe	86
PID 2908 wrote to memory of 4408	2908	msedge.exe	86
PID 2908 wrote to memory of 3772	2908	msedge.exe	88
PID 2908 wrote to memory of 3772	2908	msedge.exe	88
PID 2908 wrote to memory of 4312	2908	msedge.exe	89
PID 2908 wrote to memory of 4812	2908	msedge.exe	90
PID 2908 wrote to memory of 4312	2908	msedge.exe	89
PID 2908 wrote to memory of 4312	2908	msedge.exe	89
PID 2908 wrote to memory of 4812	2908	msedge.exe	90
PID 2908 wrote to memory of 4812	2908	msedge.exe	90
PID 2908 wrote to memory of 4788	2908	msedge.exe	91
PID 2908 wrote to memory of 4788	2908	msedge.exe	91
PID 2908 wrote to memory of 4788	2908	msedge.exe	91
PID 2908 wrote to memory of 2472	2908	msedge.exe	92
PID 2908 wrote to memory of 2472	2908	msedge.exe	92
PID 2908 wrote to memory of 2472	2908	msedge.exe	92
PID 2908 wrote to memory of 700	2908	msedge.exe	96
PID 2908 wrote to memory of 700	2908	msedge.exe	96
PID 2908 wrote to memory of 3376	2908	msedge.exe	97
PID 2908 wrote to memory of 3376	2908	msedge.exe	97
PID 2908 wrote to memory of 4288	2908	msedge.exe	99
PID 2908 wrote to memory of 4020	2908	msedge.exe	100
PID 2908 wrote to memory of 4020	2908	msedge.exe	100
PID 2908 wrote to memory of 5680	2908	msedge.exe	117
PID 2908 wrote to memory of 5688	2908	msedge.exe	118
PID 2908 wrote to memory of 5696	2908	msedge.exe	119
PID 2908 wrote to memory of 5932	2908	msedge.exe	122
PID 2908 wrote to memory of 5932	2908	msedge.exe	122
PID 2908 wrote to memory of 6048	2908	msedge.exe	123
PID 2908 wrote to memory of 6048	2908	msedge.exe	123
PID 2908 wrote to memory of 5536	2908	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://radleybalko.substack.com/p/the-framing-of-chris-duncan
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x248,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,11132618708126812587,8733199431374529432,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1487012858015897473,16247107573875305985,262144 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,3477087752405959301,14346604117377244536,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11311183446498932565,16640436851364709007,2097152 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,11342448231509419249,17817369839552726175,2097152 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,15236823908362144451,13790900371180187869,2097152 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,13728883270688814215,8054145328427899121,2097152 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,3627277381683938956,13536969723296843602,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,17921900174177729863,14588727745872981718,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,11973115138651507795,8270891597632711313,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,11973115138651507795,8270891597632711313,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,9299388180328419524,9821837826291096784,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17402320687218845168,8339946272390973427,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,8568977597202246113,1921283667729243524,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8920283273233461814,5859478420902705654,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,5546871372822118059,13381370061011952558,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,978829074814547326,18003454165965788439,524288 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,12937724914447356601,3732151687166594046,262144 --field-trial-handle=2248,i,7176844698328442012,4134318275187317915,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 31f44555b5b200f4f56aedb09da2854c4790fc2b53c457843b9e2a30a581c28c
MD5 4c44e54d8b029cab7f713dec05aceca2
SHA1 5df54af66f5fde30f13bc2c6193f70e958e2b80b
SHA512 22b2b974854c855ecf22f1e2873586b486dc9b8f702f264761495f88b1f41d6c5c24aee59df19ef3ab190595696df19f113add812f991a897ec7ccdff3279cbf
TLSH
T137E06FE96380C7E48940E28380086F04E8383A23F7CC8A7A634068F9EF8000E9A820B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 42KB
SHA256 6678d5ebc13c00089f7337792e3a522e7282875eb54235052b09f6becef5bfb4
MD5 5f2456b141d1c73fea8e3f29df7037e6
SHA1 5b51b77c84d444d02f82052ff43eedab6f4c7634
SHA512 94f9b62467ac88f2abc819c724f06e734594870ae560e2ca887e4ac6f87357e994d5f0e0d09c4db7af1a54847354c1c2add92866b815e9cbc12fc18ebba0542f
SSDEEP 768:odhnh7lH/a+khp9XcdNFiKFUK81UyVV5wWv+7dRBB9kFXZ3Xtt/tgqEx5:If9S/Xo/KqcwWedRKFXV9t/uqEL
TLSH
T1FE13F1EED6255F2DAEB36775B4C1024067C1EE83B21B4E4EE9664C1D241F39E8DC18E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 400KB
SHA256 8423a057095b3fca6d2010a595c3ff6dfc60d55d0dd9b72464466ceb4a33381f
MD5 42860bbb9d88be7636070359ea4fcf40
SHA1 57be5444a385710d75d9eb0bcf14b21fc2825aae
SHA512 7eafc3fb4eec5b29aadf1e160064e73b025a54e25fc0c0f10971216962cae7bed0ed33aa4f918a9ed8e40cf465763f8a1cc84ae0e353c42ac9b6383631a263b5
SSDEEP 12288:yOSJDt0Aq8j0eEuVUXKkMDjZoBFR7V5EBUl/B64nIv:yOSUF88aZjIFRwBUa4Iv
TLSH
T1FC94231FD3E08D95607522B5F38DBF9662E7B638BAD7104929EC0711FBE42B480722D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 991fe4bd64fb33a360c3a3f63789c1c9e15862de020d101cc62fa1ecaaab64af
MD5 7c3ca26b930e3b6fbb60afad6913fbb6
SHA1 be46f6fb5e4ea9410fc86598d2df200c76dae711
SHA512 fcf81c8bc8058f1729325fd5a54307ea2d98930f91485be64aec292d861d5e2fb882ba593589fd56452b4d3502de0f278fe071844b4508b38060dd23964e2022
SSDEEP 96:vZutXy/mYlDTmHdS/cwtEHHWwDrbC9oofn:RMXah9mHs/ttEH2GjUn
TLSH
T1AAC13B3B1085A3DAEF92D172A3C02E4FB5328DDAFB177D851F13E8B4DA31B94514A254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 d06a4c575d2d49b35dd4d1fcf9056f1490588ffe152337d5000455df4ece86c9
MD5 899bf173c0505468a24890d0441986b0
SHA1 5a69987a714c2a9690c978560aa61c045ed4cd42
SHA512 a846a406778c8768a05c7ffae4d3d49939b9bebe91790ec5d0bb7b2b44794efc1de3b751186ab6d05730a057ece7af103ca03439be4f2cc410234b5e57d210b6
SSDEEP 96:CIiTPtWxCSE+l1TsH/lw/cqqFEcMKsml9rTrbEK0WqYA6ez:ClZWon+PsHW/WFEcMmzrvtzqh
TLSH
T1D0024B3B159163DAEBA291B397C12E4FB57248DAFB033D911F13E4F4DA32B44C156214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58562a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58562a.TMP
Size 3KB
SHA256 5f61b6e41ba41a2a68183226150fa1ad0e1f8628a89c12c6f3a4f0af88f96e1a
MD5 a8aa2fe95bb89ff3d6354618181ff611
SHA1 c1eaf9a2d810e6e95a9923f497092a380cc619a2
SHA512 df531fb6ac634e902aac2bd0de92e25e6128eae46dbc49b1c7f5e41eae5dcc5ad8e378f7aab810a2556f8f2b79a19f28e8b09b45d25039aa1b5bd59a52539157
TLSH
T14C71B534551653DFF7E602B290C12359F6328DEAFE273E412F2379B45E01FA08169388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c8aadec-c155-476f-9b90-1867112db407.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c8aadec-c155-476f-9b90-1867112db407.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e347c77e26369556ab35daf1080a58e48897c9f86e27261ddb560e3f04770cec
MD5 3255e42eb58eaa515b7c630b28cefc10
SHA1 482683e8d219898a4648574ea383d6d97927046d
SHA512 e3a715c0f3d7096e64109b242012ad2a670e65e6e40daeb0d2f9d53d41ee196d5d68005d8280e68c9510f2c73f95880336f5442fa45b55833e803c09fdf9bf11
TLSH
T194618DF287F5996D8D2151F0AA156F2FCE5D482053283C6A89E4BF3B63E1470E21176F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1796ada1297a43914643a8177e32d7afc1cbb09ee19c6907ba4014b1cf896800
MD5 55fef8a7004defcf55cfe2b3262bbb52
SHA1 d86e1f047feb07c9a7c09b3590e73a0f690c649a
SHA512 aaa0088eff11c99009a02791f894a0aeb05134ee76b99554e483478ef52c655a2dd8a324e37c4916b4aeeda027afbaa2e8b9df3113fc9fadb3ca5dc5a67ec424
SSDEEP 192:sxZhRiyM/jK1Ml8UQNWZ/fpsgfDIdp4SHW6+WNTcbdYINY3V+BIg5oJ:sxZhMqUZ/fpsuczHb0dYg2
TLSH
T14A52F7116A346977CCDBD209BA55BF53D2F44572A2950E44A9FCCA1C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c8909d18f10b3812cef78a8647e758117449fd3362120442993f1007d321f2ba
MD5 2eff9cd3ccdcfbe6bf725a1f11593578
SHA1 4295dcf354f85caee1ae827c234e3cb50def2123
SHA512 14094e75d3d43e7412386b465707dd9c9e14568298ae1f6c3dd7023ae58403126c77e76576e173e644068e1ee4db9de6d9f08b92d1915706e34d0baac8a9ad4d
SSDEEP 192:sxZhRiyM/jK1Ml8MWZ/fpslfAIdpeaHW6+WNT9j/YI5B3V+BIgrJ:sxZhMuZ/fpsdBRHbJ/Jg9
TLSH
T13842E8116A34697BCCDBD209FA55BF53D6F94572A2940E44A9FCCA1C04E6AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7c3d8f5bc1b86178a75c60d9c6fa5f932527147cd7c17844edd7be24c6a450c5
MD5 0716d2832d284ecb5c363481f4891920
SHA1 764fdfce2ed9646b3cae31f6c90e7293dbda37f5
SHA512 dbf789fbf32d1df3e79646fbc504c75e48386238f87d22d0505a31258cd5097f4f521417a5232db2f362247a4f4225a8e026dc41a1c68e33d7b3a33f8292ba78
SSDEEP 768:dJsqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9CroaN12:dJsqxXlWvJD0Tu1ja54LAs9Zaz2
TLSH
T160E20B3B694CC77E4F840E5DEC26AFD66ED801CBA6988D5447FA880C03CB7EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3574a4a5dd40cf43612c611bb61dc8c7b87b94ccce383dd52aa07a90467d4f6d
MD5 7b4580ef42a682397d4a7016c4dfd632
SHA1 2084a6318ce5931020e0619c97d1e90652264137
SHA512 48ef0bf39dc5953c2f0b4eb6f6a00406eea39b8e992d387fd85f0ff0b326d819bc615fc88d361517e0fba306b4c8dc903ba482cb4e8ddec96be8c051e7f2b49c
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMko41YJlnTD:KYbaKYIKvdCKegCeHuKMk11YJlnTD
TLSH
T13191021935790212387D2864B266DA3B5F413A63701CE46E3F7850A64FA7E110DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

522e27e3-deca-4317-bdf8-15965c42f0bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\522e27e3-deca-4317-bdf8-15965c42f0bd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5d1a994b1a04c41f0e7f14d3df3f134cb89562f579ae9f7d2b533bf1215b1c77
MD5 f85e92c8ed3066d7d9d39244e818c98a
SHA1 a376516870ed4aacd805937c78abbf0604494d96
SHA512 8e29c2114b589019cd7f3c6bd854edf6658ff2c1766ea79600c815645ffa8e26800a4a495097db9360679821a3b548e4cf5515ccf292f605af8b1bf4bbcb47c8
SSDEEP 384:yiFiZcI8sNHs8TUNTUlIlF3qtbOX3VRNmd2OYoA7xuvzxV+Mhdpifupol:5FQ8xwgHlHmR474184pifsC
TLSH
T1D1C229F118D7587AD9AE5747EB7E2E034EBCC163B9895A50B3985A0CCC961BFC30AC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cb475d99c893e0533d1de7be2344571a10a44930434248a0c1672b888e752f56
MD5 a67115c073042e130caadb1b8c86abfc
SHA1 91d470937158c8f11bdb8fa0995d5a0f0860d457
SHA512 1812ab6df1ebb94cca089633d7c735306ffe3d861f9b287d7851d887719a400fce482e7bdc3fabd95a23f8896ce4c7cfbc903dcf08b46c128e6baacabee52320
SSDEEP 384:oZcIhsNHkc3qtbOw3VRNmd2OYo97xuvzxV+Mhdpifupol:WhJlHmRl74184pifsC
TLSH
T16E827D316C383C775EEBA145F88B32035FB89127BACD6B4095EDAF1D01DA6A8131BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e8714d14503b4b0b01e17588be486d04ca443c412ff1b6a433f1b56b58c2d2c
MD5 55f48a65c7131485611409365494eb0a
SHA1 75347766e7e7748f925161b3d78ccec6cc2832b1
SHA512 59889ea717c35013b9ce3c5e861d00b2f9e3ec7dc8687092b73d40a1d21f75cb63315bf0f6e91e002e2da96073a7a9b2d07a9d86ec8713c48ddcc9232eb60915
SSDEEP 192:tON06JkRtQmiUyk6W+RN5+Fd107sh3RRHJU6:tON06Ur2W+RNmd28nJU6
TLSH
T13802C935AC382CBB8EF26D0AB58737135FA5117BBA992B84D6E81F1C01D765C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a0eed958161ae5d57eb231e75f5fb6c8139ac667d593f6f22b8e6cbc77e3f82d
MD5 8e8144534f4570dac5b27097bc5e3313
SHA1 9aba1776ea59e1dbce0ca0c7ec9bb35aef965186
SHA512 f1b88d69202040d54e371352dcfedfe391df9c21e43066f37f90fa0c76ebc1f12ed4bf9dc1231e86c1bc7df2d229b05635dea218b4870d38050483d162bdb2e4
SSDEEP 192:JONzx6JkRiQmiUyx6F+RN5+Fd107ptpefPwoUzVcDqVCU6:JONzx6UeBF+RNmd2OYo/7U6
TLSH
T1FB1209356C682C6B4EE36845F48735135EB4922BEE8E3B40D5EC1E1C01EFAAC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fd75a5b3314fe79249ce7f7f1e98125b5f0d44ed4445c8770853f51d9b7a5b6b
MD5 5f66c3e4ab9c5b929a6407495b0be465
SHA1 bdc2ec43f39f554c388cafb1510716860d6f9f9f
SHA512 31a3bcdd3db7c6f6f4a3a5c94f866425b791f6b6c5d4aa01d7033122a31b1be9f5b1acce7813d96375005040bfa0da22b4105f24c30200fd34cb7d480a34f876
SSDEEP 384:pZcIhsNHkF3qtbOw3VRNmd2OYo97xuvzxV+Mhdpifupol:hhClHmRl74184pifsC
TLSH
T187827D316C283C775DEBA145F88B32035FB89127BACD6B4095EDAF1D01DA6A8131BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55115c25-e109-42bf-ae0c-6c78b63f5962.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\55115c25-e109-42bf-ae0c-6c78b63f5962.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 58ad918f68cc2ade99588596faa58829b0d1038dec1b31ec08f832da1e8c3b34
MD5 ed562c619c4cc1c654f44dc966e5d146
SHA1 25428a16cefbc5ed4a7a039254bfbc680c30e724
SHA512 885a230f79ab69a7c110b597682eacf194c79865a2e0f733e809b8eabb62982d75842ff79c92c83606dec91154c2c48a57c2e4d8fbc8d4225412161a9ca3e40c
TLSH
T10D413B59B6F91148B3B76F5A5BF2A4AE447BFD372E06D05D10010E4F0A62B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download