5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c

Analysis

user interaction
yes
max time kernel
298s
max time network
295s
platform
windows11-21h2_x64
resource
win11-20260513-fr
resource tags

arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
16/07/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/cmp.html
Size 5KB
Sample260716-tsa43sg14m
SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
MD5 17241946e51074e6877c43737b94ad71
SHA1 16918c53471fe3f35fcae1e9902870d91c50d957
SHA512 b4b6e030fd1abe19fa308b32f04571a7c1c1f78a7cb789f169b37b54f281ec66d16e4cf0bbbdad81642bf28e266a6b2af7c19cf5106c683fb7f443bfa3110e05
SSDEEP 48:tZrc0/GdshWpo1rckthAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4Li1:4V+8v4jHa2NGiivmmpWsBVuQFwlE5vSG
TLSH
T15DB1DB1A2D5914A80077E3385B6B6208F72AA1B72105CA067EACDE513FB152BD58FFCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3952	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286923587748714"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{0A7C4E34-9E43-4683-A5F2-7A1002E555C9}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3968	2488	msedge.exe	80
PID 2488 wrote to memory of 3952	2488	msedge.exe	83
PID 2488 wrote to memory of 1460	2488	msedge.exe	84
PID 2488 wrote to memory of 1612	2488	msedge.exe	85
PID 2488 wrote to memory of 836	2488	msedge.exe	86
PID 2488 wrote to memory of 1460	2488	msedge.exe	84
PID 2488 wrote to memory of 1460	2488	msedge.exe	84
PID 2488 wrote to memory of 4628	2488	msedge.exe	87
PID 2488 wrote to memory of 1612	2488	msedge.exe	85
PID 2488 wrote to memory of 4904	2488	msedge.exe	88
PID 2488 wrote to memory of 836	2488	msedge.exe	86
PID 2488 wrote to memory of 836	2488	msedge.exe	86
PID 2488 wrote to memory of 4628	2488	msedge.exe	87
PID 2488 wrote to memory of 4628	2488	msedge.exe	87
PID 2488 wrote to memory of 4904	2488	msedge.exe	88
PID 2488 wrote to memory of 4904	2488	msedge.exe	88
PID 2488 wrote to memory of 2620	2488	msedge.exe	89
PID 2488 wrote to memory of 2620	2488	msedge.exe	89
PID 2488 wrote to memory of 2620	2488	msedge.exe	89
PID 2488 wrote to memory of 3308	2488	msedge.exe	90
PID 2488 wrote to memory of 2208	2488	msedge.exe	91
PID 2488 wrote to memory of 3308	2488	msedge.exe	90
PID 2488 wrote to memory of 3308	2488	msedge.exe	90
PID 2488 wrote to memory of 2208	2488	msedge.exe	91
PID 2488 wrote to memory of 2208	2488	msedge.exe	91
PID 2488 wrote to memory of 5232	2488	msedge.exe	93
PID 2488 wrote to memory of 5356	2488	msedge.exe	94
PID 2488 wrote to memory of 5232	2488	msedge.exe	93
PID 2488 wrote to memory of 5356	2488	msedge.exe	94
PID 2488 wrote to memory of 5412	2488	msedge.exe	95
PID 2488 wrote to memory of 5360	2488	msedge.exe	97
PID 5412 wrote to memory of 5740	5412	msedge.exe	98
PID 2488 wrote to memory of 548	2488	msedge.exe	99
PID 2488 wrote to memory of 1168	2488	msedge.exe	100
PID 2488 wrote to memory of 3052	2488	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ff96107c188,0x7ff96107c194,0x7ff96107c1a0
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1636,i,12544383490948431446,7040876383137183777,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,18359150431361466471,3085502657023902792,262144 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,10569747280237845285,17972864057022989705,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:13
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3048,i,5969902759201788034,9147876379598811081,2097152 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3052,i,13425009252805561404,9277627848883272485,2097152 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3296,i,16845700771630747146,11647887189280568689,2097152 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3308,i,9835235569180497619,9509161585041195236,2097152 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3324,i,2080189524513738155,1923620080841396419,2097152 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3336,i,8438318707340526090,7758236666341736470,2097152 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4498931428290360167,6577671752705362251,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,169138510370714664,2835809924133265177,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,4262638526642177682,13593147616480162671,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13507595673456802917,15651856092599923853,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13507595673456802917,15651856092599923853,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,15756462833242957094,5604527954997189745,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,6293866737618500024,6862882865669983674,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,9262204725640442490,2623230387739464752,524288 --field-trial-handle=3748,i,10604160910368826770,10858608774730318024,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b245411ce9d68e7e65179b97abbc8c1e6591b1b9099ea7c20b2138bd8b0c93
MD5 a8bf181c9e74620d4dd03abec50618c4
SHA1 237636987fc2992ec73027d96bb51423ca898daa
SHA512 25783f23c2e201f17c036dea660c5345e2a3d0e546f1a01cc376a41db494b5c6edbf2e3b1ea4d61f1e41a4b7f888e9ef2d823c8be5c5bbd2fc49b67498ed9de3
TLSH
T1DAD0A7217678ADD1C176103280318700A6A811D6622B8585B194841E4C3B491AACD686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f03f6c403a9b33a5494621af8b6e6b874ec4fdea2aca74cfb4c89710e735c726
MD5 aaacbca217890bc62281de2c7ad8ba96
SHA1 a5ce3ad574b4ced21a1adfb70a42a899f6390ede
SHA512 3f1dc86a5c7f7e79fafc1fd81192e2589c8b269502381232c959526b544092c51f27e8e61a698bd4e988ff3180285e719a52f2b7c3aef44a53e993c233921549
TLSH
T115716225C2A548B2F3E0F23AEAF27512307DC24549674D389E687F7EF509B21F364958
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dbd55f1932e455ba5eb0c0d4557ed4f8f42e730ee16c05812bfe7c93dafe0dc1
MD5 a26e2d5acbe5588c9701b93e7423b566
SHA1 da47469fb1fb6341e238e40e1ddc80cd93b71dad
SHA512 cf2b759752e333a26069e6a968758069a1d324cde94b640d3c4bb55934ad93f4621c6a82f8a693d54867a96f17510ca73b7f65000ce972f91bf36da338f85dce
TLSH
T16C719325C2A248B2F3E0F236EAF27502307DC24548674D349E687F7EF509B61F364918
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 d5ef68c7a5e4a61cae37ade3b1da9eeb633d8c4671fac83e65a2ac34bd23fcb3
MD5 e5e9cc9b5e024e7af7b8f0ee7c8121a9
SHA1 d298e3dae03b169ddfc354b76e71ff3208bbe17c
SHA512 c4cccbda1274723af77d19c7b0167af412b8846294f74777d83187e0bfb714298edc83001e2de90d4ffd3e6601ecd0e9d1c91172ff2d14e3c619ca88cd590fe7
SSDEEP 3:MsEllllkEthXllkl2zEklxt/:/M/xT02znT
TLSH
T13644040D7FC00C15C5001030C531C3553371D4140511DF43347304177CC5DC00C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 943B
SHA256 1d70efe2709fb3cdb5b031ce7fe3873828d493fbc64b19ff79931fd3e087d0ee
MD5 19809aaa9c02805d4c45ddbd20f7a7ed
SHA1 dd86a2db8a5287861080b4cc6099be214860f286
SHA512 afcdcd35b32ddcbbf5d76f8f875e2042d022c3609a90969c4ea35ff8815fa3e1de72926fdfe977c976bb8c851a634c15d47d657d57795ee66365edbe81b810a4
TLSH
T1C5117DBB83E4467F8A0152F05A14AE1BCE2D0507431C7C5589E46E1B53F25B4D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e8bd353a24c984cd0802d67cdf413469d6675c8f9ca437e9d4cf87bbcd8a9d21
MD5 26545ed8b8c256c153f2d350d4011907
SHA1 96b878193fe48280f64392824d098320f7f15a03
SHA512 9a4aa11f7eb1df20d97edcbd4eb91bfc66d7d6b10047fb11db7ef6aa853c381b3a161e47e019c0cdc7fd517a1a2ce80bbe7ccd7ccfed659443ff15b0fcb84e9d
SSDEEP 192:sxZB/yHkKOMl8MFe/f5sjLcZIupy//W6+WNGY0YrEoYTIgrJ:sxZBEde/f5sjAVs/bG5X9
TLSH
T19942FC166B349D77CCCBD209FA55BB53E6F55472A2940E48AAFCDA0C04E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 048ceceff58ab79eae12db36460925ac2d131934f74351af06264121b68b4805
MD5 2a83930fbd2e74d000548f0045783add
SHA1 006848f6d937a4037e337e665026acbbb6f828ce
SHA512 389f784aeeb2fb0d72a9412a974b6076dfe60c7e9de016bf3197218e8719f5a47d500ee395686d67730faef157a7ee68101a5b0d9cdb66aac43c2e62bfb1bb7d
SSDEEP 192:sxZB/yHkKOMl8uFe/f5sDWpVAncHIupy//W6+WNGY0wr2q4BIgb0IpJ:sxZBE5e/f5sDWvAcrs/bG57vT
TLSH
T1B752FA16AA24997BDDDBD209FA55BF53E6F9042292550E449BFCCA0C01E7BDD230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 7afdd907f5975053d8ebaaaae42436381e8d93283f44f7ee1a6fe9c03ed73206
MD5 f09c5bd6e48a1c1da1df393a29623b3a
SHA1 f1900c4494fc78ff58ad8743f7460dc74fd31e20
SHA512 c5bdd032f886bb8af919a13c39aed04b9eaa9c101e338ee92d7b050c6985648984677dac6f98747c14c68aacc88ca92343b03dab69ec3e7c023afe0c8a43d482
SSDEEP 768:9Cl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/WKrocZ:9Cl1j83r2pmWRmeKQBCu1jaK3ALpCN/z
TLSH
T1B7E22C3B680CCB7E4F844D5CEC26AF976DD801CBAA684D5447FA894C03C73EB552A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 506391ba9945e225c4047418d522ef15c94a292e7352055d348af39b53b71c7e
MD5 5f8ae5afa33d0db5ef088098cd9aa71c
SHA1 4945725895918e5d32b4d8f179ceb51a744d8d10
SHA512 0b98f0793399d69085de1a9a4867cd80b3086b55b16237c969a8156958204cadb83b5b28faab38bba06dcf618d2c6c8a4916ba29f2c761bd2da7a02e72ccc01f
SSDEEP 48:KkUIHKtecXyJsIjK9icvyJYIXKhec4QHsw2OB:KkUgKtemKsgK9im6YYKhezQHsw2OB
TLSH
T17391C99271B612413C7D270892E0871F8E83B573301469AB7BAD51B68E2BE115DFD4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b892b27c3bfeb1d72815b3f28df801707f6336a6c091b64e44a4b7ff0ecc48ea
MD5 6f902ee07f6841741671ab4c6e0fa741
SHA1 611478f6eb48d0eaa12f0b5da7690b023038079a
SHA512 a182cb38d3edb453d9085605a7d4bc9c1cd5feb1c078aef2df615a4e35b03b635c7c0df059928532cd56831cbce227cee3968fb1a72b1bb6e0853b47d9ee7a86
SSDEEP 192:uvtL8NOPQpn75RzvQmiU18FaP4gX5zPr2ljzormtgdJX5ywCQNtKqovkD9:S8NOPaNRltggX53258mtgdJX5yX+Qve9
TLSH
T153422C36A8B49C37AEA3A595F0463213AFF84027D7C86F5496ECAF1C01DE69C534AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 16fd79b9af7ca1169c652c888eb4eec9a1299165d708d065c3d9d7f36abd4a5a
MD5 aaaf8ce9f881d2e543fab9e5f8ecccfe
SHA1 f646a63d06ce99507a92c30f9ef73764c926635a
SHA512 1c613b16dc14fa8fb5103a4b9ea8f855e0eeb9a8b15e2ac69d72ec0d621ac6c5a891b99e69f46f9da59904188ec54ada5b3485517f2730632c9d821d60c0ea4f
SSDEEP 384:utNn/s3n9SA8NvuaNRMTggX53258mtgdJX5yX+GjZ/3zxKBb43yf0veD:uj+93MNcvh5W+c/lKBb43yf02D
TLSH
T1C4A24A7D9CA59C3F449FBB48A64E26339DB8103BD5F45A48D3E85B0DC0B668CF346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7fff9b06131f2cf7c98c65504accb075a8ecca9c9040a0b8027b10fc68776964
MD5 95c3a4a21b0d9f2c7c18263dc2138d05
SHA1 87749a768758dc82f96683be799bbe8487fa2505
SHA512 b5257867f5c1ffb7336ebe1cf863d0c0a196adf093199ab9647cb7d875c938a61780d06293bff651901bdad60069d939a770493d1c9f9e93d0ae56639faf0be0
SSDEEP 192:6GNO36i5fQmiUyfdjO7X5zPr2ljzormtgdMajOjSU6:6GNQ62hUFO7X53258mtgdBcSU6
TLSH
T1E502D835A9786C779EA3AE45B48637235FE4112BD9D96F90DBE81B1C00C7A8C134AC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e719e5401d3f149618beefee56b7d68664e39f8c62ed5eea6b29e9a330078d80
MD5 f8a3e139ed506093a095df3964dba73e
SHA1 1a07f140446c46809bc6bd4819f512c1faa711a2
SHA512 93d8584d53ab5b37953a001f7126cf7759d5db245839aa3f04d31cab2d0527fa3a17b63cf9aec4d0047298fc1f63c68027ec7bc3538b896a22bc933cce2835f6
SSDEEP 192:wGNP6i5CQmiUylgjA7X5zPr2ljzormtgdJX5ywCfGQKqoU6:wGNP62+LA7X53258mtgdJX5yXnQU6
TLSH
T10012EA31A8A4AC275ED2E955B08331139FF5411BDAC96B50D6EC2B1C05DF69C534DC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 a5afd41417a5236ce878b93dfec1fd870011bbc5814523a4d45b13e8dc63fcd0
MD5 12a49c4123db5d52412321d73438b335
SHA1 37cb76e05062204b35004f07a2f469af7d394444
SHA512 ad585cb5ff3a9080470a701d4bbef487f1b35de3113ade71a3adccc929f2d8923aa4fded3d21cfda3ca6a7417ff7f776d34da376fa5ccafceecbdbb0c65e8bab
SSDEEP 384:OtNn/s3n9SA8NOuaNRM/ggX53258mtgdJX5yX+QveD:Oj+93/N6vh5W+Q2D
TLSH
T191726D32A8B49C279ED39985F5433213AFF8402797C92F9496ECAF1D01CE69C131AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads