hxxps://contactmonkey[.]com/api/v1/read?cm_session=0f1ca64d-e725-46c3-8789-7e5d6e002df3&cm_type=read&cm_user_email=carmela[.]sanpedro@bergebulk[.]com&cs=423d0236-b7d7-4f92-970b-1d1d5316ce76

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://contactmonkey.com/api/v1/read?cm_session=0f1ca64d-e725-46c3-8789-7e5d6e002df3&cm_type=read&[email protected]&cs=423d0236-b7d7-4f92-970b-1d1d5316ce76
Sample260710-e2fzcset21

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281311996171186"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{60049653-DF12-4526-8AEF-B3AE192EECE5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1296	3040	msedge.exe	86
PID 3040 wrote to memory of 2284	3040	msedge.exe	87
PID 3040 wrote to memory of 5116	3040	msedge.exe	88
PID 3040 wrote to memory of 5116	3040	msedge.exe	88
PID 3040 wrote to memory of 5116	3040	msedge.exe	88
PID 3040 wrote to memory of 5020	3040	msedge.exe	90
PID 3040 wrote to memory of 5020	3040	msedge.exe	90
PID 3040 wrote to memory of 4412	3040	msedge.exe	91
PID 3040 wrote to memory of 4412	3040	msedge.exe	91
PID 3040 wrote to memory of 4412	3040	msedge.exe	91
PID 3040 wrote to memory of 1824	3040	msedge.exe	92
PID 3040 wrote to memory of 1824	3040	msedge.exe	92
PID 3040 wrote to memory of 1824	3040	msedge.exe	92
PID 3040 wrote to memory of 8	3040	msedge.exe	93
PID 3040 wrote to memory of 8	3040	msedge.exe	93
PID 3040 wrote to memory of 8	3040	msedge.exe	93
PID 3040 wrote to memory of 4360	3040	msedge.exe	94
PID 3040 wrote to memory of 4360	3040	msedge.exe	94
PID 3040 wrote to memory of 4360	3040	msedge.exe	94
PID 3040 wrote to memory of 3580	3040	msedge.exe	99
PID 3040 wrote to memory of 3580	3040	msedge.exe	99
PID 3040 wrote to memory of 3832	3040	msedge.exe	98
PID 3040 wrote to memory of 3832	3040	msedge.exe	98
PID 3040 wrote to memory of 2064	3040	msedge.exe	103
PID 3040 wrote to memory of 1824	3040	msedge.exe	110
PID 3040 wrote to memory of 5108	3040	msedge.exe	111
PID 3040 wrote to memory of 1328	3040	msedge.exe	112
PID 3040 wrote to memory of 1204	3040	msedge.exe	114
PID 3040 wrote to memory of 1204	3040	msedge.exe	114
PID 3040 wrote to memory of 4880	3040	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://contactmonkey.com/api/v1/read?cm_session=0f1ca64d-e725-46c3-8789-7e5d6e002df3&cm_type=read&[email protected]&cs=423d0236-b7d7-4f92-970b-1d1d5316ce76
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb20eec188,0x7ffb20eec194,0x7ffb20eec1a0
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,17820685430700521036,10422476788135692945,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,8041605687972643501,12079292133419967505,262144 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10189263936945324731,4165527167274069461,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8384010747154464426,11876558527030344209,2097152 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,15426536084444906915,12448707885639153731,2097152 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,8832699918390392918,9949513616062457079,2097152 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,7429423353958105831,1835361908163897400,2097152 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,1764730534493952462,137146192702688268,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,10961588248445073234,323481994490488544,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11565810670201154505,13567585082645299141,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11565810670201154505,13567585082645299141,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,15254398747862186139,11542703367999893453,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,17896719190556264019,12094949797170973808,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,7407763531581871885,16179261696893512366,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12418216385451475189,4512118110903768511,524288 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,18082064034622784705,4133061563831989816,262144 --field-trial-handle=2312,i,9775722997400255084,9690172844947889681,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

32533fea-44ed-4c0c-9422-0aa1e87f5c1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32533fea-44ed-4c0c-9422-0aa1e87f5c1a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68bba928191d782ea46d5844508df2dac3825f29d9f49c16ada2514cbae434dd
MD5 34c6e2a99d4bb4348f4b850a90771629
SHA1 cce1bb6b3d1122eaba90faa997f5b2660d75add3
SHA512 74e8710cae3136f206efae0460a3fa137daf1378d259928c513bda4b2d108352f871f0a58019e0a01c66679ee8adaf88b88246a02885eac3b536bb49c746cb43
TLSH
T1398161370282A6C0D3A4273990E68224367082EBFF6F5F7D3B9459F12B767250E19DD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5860e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5860e8.TMP
Size 3KB
SHA256 ef08d15377e922280b999b92b77665c3cb7e1539810eef3876df5598d5b90eb8
MD5 06e8f672523f4d44db2aa11c31229aaf
SHA1 52b0e3913993cb1a6dfc0b467473a03305322504
SHA512 c5b98c1e31e063b4b3387a8c412c6395092cf87a6243d186ff5e186f08bc7d7bda1e4536bef84ec45b0ea5804c569d1ac4283f88fc04a70867ced0f6cbff1cae
TLSH
T1BA8150370282A6C0D3A4273990E68224367086EBFF6F5F7D3B9459F12B767250E19DC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a16610e73c24f4c5f84ed205c7ef20170413212365d25a332101fb02340972f1
MD5 b65b9815a97efe125470076996960391
SHA1 137d1724e3cc8acc4af4ab9c75133d27e185f753
SHA512 192b6f9ba495914a3925a0abe46ae4c37356367938b7c7f09b92047603faead96cbe45a1926d27de7b09d9f2f222ae7cb1df3c3621b4acbe2d9c90c1ec393761
TLSH
T107117DF3C3D5856E891116F0AA24AE1BDE2D0506431C7C1685D4EF2797E3476E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cc6c91c0dae48944046708d7644cf0bdbb465e650d63a4d8b5ad32250d4151dd
MD5 5cd88fb80960dfb571fb418e2de6cfbe
SHA1 44da5cfc1cb41ed4be6504f46a2fc562c717bbc4
SHA512 cc0a2a105de6b29090fe2788993b87d7a33127e3c2ff8a01ff729ecf6b16ac961da0bb23c9b4dfe49bdd4173b3a40119989b4847eed2de04511b2de947e004f8
SSDEEP 192:sxZfRuyM/jK1Ml8Mko/fCsl5AIdpRJHW6+WN2Ez/YCgPan4IgrJ:sxZfMMo/fCsl5BHHbh/PU9
TLSH
T13A52D9126A349977CCDBD219BA557F93D6F55572D2900D48AEFCCA0C04E6AEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e3fe1097920470671205ad7317e8cae4c6802b3c9f190442bc202a608d970a5c
MD5 1ac0ca3799552e3c70f1092aab6fd4ea
SHA1 409b2fd3e6fc59808e0a56a7c542be326d269396
SHA512 75580cacf3b7414cfc0321135ef8f32e550cd4e7714ebc9faee0be3ce4fd4340375adf27370323a1ad954033942e208ef8cc2b980e93f827b02ba692ba0b9208
SSDEEP 192:sxZfRuyM/jK1Ml8UQcko/fCsDyAIdpXJHW6+WN2Ez/YCkMKn4Ig5oJ:sxZfMqno/fCsDyBZHbh/2UO
TLSH
T11C52D9226A345977CCDBD219B9517F93D6F5447292500E48AFFCCA0C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 236e740f4165be40430c7062c7b449069e2eb6518cca3862a25e66bd1e73f8f7
MD5 87dfd33903857f7358715a4f08be8cf2
SHA1 7dc12c62536b49d38fdfde0a3e0b2b5b260db4d6
SHA512 0776223add42b7406ba47beb6a512c53e098e09d6d566097177df501f994c8e106469672f62d7f778f54411e5fdae206880dd284fa1888255ac62a6071aee3bb
SSDEEP 768:iP8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV1roc:iP8bqn+WvSCt6u1jaCZLbWVOc
TLSH
T162D20A3B280CCB7E4F845E5CEC26AF966DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 fd979111a2f88b286e65aca52bfc2dd885d061553f587461d4187aac62462341
MD5 79cbecc92fcb7620ad953e88f4eadc95
SHA1 bcfaa487663d7ea10ca57ff957151c8690f2202a
SHA512 54e24c1161a477ae0bbebcf4dd5efb7f38f8acd87fc2d0630e07896a50787a7f788e2b7bbf40f3b23eb4689b7cd3981b310f307cdc4ef92912cc2a80bc7183b1
SSDEEP 48:KoXIpK0g0bypQIHKpOXwI/K92c7yfa/Q0CkQzPg9CI4szKpqBOzVqj+lYd:KoX6K0gCKQoKpOXwgK92SWXOKo4E
TLSH
T19EB1E312303F124638BD2528A3B6953BCD41B2573915A8FF3BB920618E66E524DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fc7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fc7c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a257d0db98a51e39709a2d37056d43c4205c2b8e8d203d10c3df57c3bdc2267d
MD5 2d6523e32432d6f31302cadac8f33f5a
SHA1 a55b99f09f01a90334a45c6308dcb66685ad1927
SHA512 ccd3602a20f270c300e21948e437bb5e2e9c1dc621c344e8e8719af01d6500c55ebe5aadf66cf03fc3665e5e9cdd7cbe5bdbd76ebb88c8431113cc08defa4ce6
SSDEEP 384:KtNn/s3n9SfsNjHW6kgEa+ld8KkOObjI9G6w7C:Kj+9UJTa85k29MC
TLSH
T160929E3268285D775EE39559F04B3B2B5FF491BB86CA2F84E6DC9F0C00DB6AC0306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d81e886408fc12d001fa9e9c0eacfd57418d4bcc2d1539d5309f9224e9e5466
MD5 acf4f1cfac7fce0894e13f5de3bdaaab
SHA1 789da811f60502b4a19c07a7fafeff486a0a5da9
SHA512 b13c56240a188421026b7027e8d0397e1be46b051953d8aba398a7171099f67be03132203b39c7984dd40c44bcdc00bebf5896a77ba51d759c613c410ab98e45
SSDEEP 192:vON3p6Db6QmiUypJHBa+j2+FdCrtm5Rg4JWU6:vON56uyHBa+ld85YWU6
TLSH
T1F502DA35687C6CBB9EB2AE49F4873B175FE4207B9A962B84DAD85F0C00D765C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea3acf1ed302e4007b5add0f87403110b92d59dcca4126da8baa2145b85684ef
MD5 6385bc8f038da5102b42fe0881ecf6b1
SHA1 4062bf011760188cf2d786c85a970d9f9c4b71c3
SHA512 b7bf8aa104be6153c0d0d59460be88cc2a33bca6afd524d7d00709ffae3a21bded58f2b881bfb34708b763c1b826bfc7d58c661c6bc85e6a359d48d087e576c9
SSDEEP 192:eONG6DbZQmiUyHJABa+j2+FdCrtmEpe4G2Nz4qqU6:eONG6/+ABa+ld8rkU6
TLSH
T133121B3268785C6B5EE2A555F48736179EE49167DE8E3F80E6DC5F0C00EFA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e4574602cc96dae36a035ac8cde92cf7efa11157da36c7ecc6268a5b96f4b98e
MD5 3b7ad5993b7323d934da3cfaf8fa4078
SHA1 934ddd7a2bca770035a4d4c614d000c14754fb48
SHA512 29fe7fab0ddfdfcfcb3099bcea8df59cad2f406f0e6469c43e5deeea9bfd8894c7c8faa671b15ed397a751df573d62dfad90d564225a9005a4719a1945bec033
SSDEEP 384:1iF1tNn/s3n9SxzsN98TUNTUlIlaW6IgEa+ld8zkOObjI9G6w7C:8F1j+9KIwgVTa8uk29MC
TLSH
T1D8C24AF248D78936DAAE4747F77E2E164EBCC167B5852A44B7889A0CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 64ed80265a856f489ceb41be9dfa8e219b6c529eff3e9ececad4458bd4db27d2
MD5 d57a868d57e8c734b047f3143262c48e
SHA1 46837b8a0b2592d9e56fed1272465c8a0b340818
SHA512 7eed0a354910a60287ab673ad0daecc6ed21da7ccf3481f2b4429714b215ef5b074d68855261a6e36c6f2fc1664e6c34119c2d6db7ffebba134a9da844cedcf5
SSDEEP 384:OtNn/s3n9SfsNjaW6kgEa+ld8KkOObjI9G6w7C:Oj+9U8Ta85k29MC
TLSH
T122929E3268284D775EE39559F04B3B1B5FF491AB868E2F84E6DC9F0C00DB6AC0306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0dea4cc7677c77959badc355023baf9e46facd362dcf83f81f019fc0e8ad196c
MD5 97ae7dc56fb90e131ac2294c7f2bf335
SHA1 3cfdf89aadbd4bf54d67541b374014d23c36b4f5
SHA512 130398693c3875096e14cc40ab25a1e66f8ed1363eeb980984891557f19fe2b9db6228b04fcc84a12ca7f738473b3b73864f413d84e2fa03c67ade06812632ad
TLSH
T160412658AAE91148B3B76F169BF6B86E487F7D232E0AD09D10110E4F0A63B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download