5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/07/2026, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/cmp.html
Size 5KB
Sample260721-qc2ejsaa24
SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
MD5 17241946e51074e6877c43737b94ad71
SHA1 16918c53471fe3f35fcae1e9902870d91c50d957
SHA512 b4b6e030fd1abe19fa308b32f04571a7c1c1f78a7cb789f169b37b54f281ec66d16e4cf0bbbdad81642bf28e266a6b2af7c19cf5106c683fb7f443bfa3110e05
SSDEEP 48:tZrc0/GdshWpo1rckthAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4Li1:4V+8v4jHa2NGiivmmpWsBVuQFwlE5vSG
TLSH
T15DB1DB1A2D5914A80077E3385B6B6208F72AA1B72105CA067EACDE513FB152BD58FFCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291129943039425"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{4125BD34-4C2C-4656-9D3A-F933F91668E4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 1132	3268	msedge.exe	80
PID 3268 wrote to memory of 3124	3268	msedge.exe	83
PID 3268 wrote to memory of 1264	3268	msedge.exe	82
PID 3268 wrote to memory of 3124	3268	msedge.exe	83
PID 3268 wrote to memory of 3124	3268	msedge.exe	83
PID 3268 wrote to memory of 1100	3268	msedge.exe	84
PID 3268 wrote to memory of 1100	3268	msedge.exe	84
PID 3268 wrote to memory of 4092	3268	msedge.exe	85
PID 3268 wrote to memory of 4092	3268	msedge.exe	85
PID 3268 wrote to memory of 4092	3268	msedge.exe	85
PID 3268 wrote to memory of 2512	3268	msedge.exe	86
PID 3268 wrote to memory of 2512	3268	msedge.exe	86
PID 3268 wrote to memory of 2512	3268	msedge.exe	86
PID 3268 wrote to memory of 4056	3268	msedge.exe	87
PID 3268 wrote to memory of 2080	3268	msedge.exe	88
PID 3268 wrote to memory of 4056	3268	msedge.exe	87
PID 3268 wrote to memory of 4056	3268	msedge.exe	87
PID 3268 wrote to memory of 2080	3268	msedge.exe	88
PID 3268 wrote to memory of 2080	3268	msedge.exe	88
PID 3268 wrote to memory of 3700	3268	msedge.exe	89
PID 3268 wrote to memory of 1360	3268	msedge.exe	90
PID 3268 wrote to memory of 3700	3268	msedge.exe	89
PID 3268 wrote to memory of 3700	3268	msedge.exe	89
PID 3268 wrote to memory of 1360	3268	msedge.exe	90
PID 3268 wrote to memory of 1360	3268	msedge.exe	90
PID 3268 wrote to memory of 4512	3268	msedge.exe	93
PID 3268 wrote to memory of 3600	3268	msedge.exe	94
PID 3268 wrote to memory of 4512	3268	msedge.exe	93
PID 3268 wrote to memory of 3600	3268	msedge.exe	94
PID 3268 wrote to memory of 3400	3268	msedge.exe	96
PID 3268 wrote to memory of 1412	3268	msedge.exe	97
PID 1412 wrote to memory of 4912	1412	msedge.exe	98
PID 3268 wrote to memory of 1312	3268	msedge.exe	99
PID 3268 wrote to memory of 2156	3268	msedge.exe	100
PID 3268 wrote to memory of 3356	3268	msedge.exe	101
PID 3268 wrote to memory of 4548	3268	msedge.exe	102
PID 3268 wrote to memory of 4548	3268	msedge.exe	102
PID 3268 wrote to memory of 1648	3268	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbd7a8c188,0x7ffbd7a8c194,0x7ffbd7a8c1a0
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,12652302281163032525,5951544318991522043,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6880905093265280765,4614107723444954554,262144 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,14891286054728372019,17693260400406100712,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8149881059597566986,13634013587162731753,2097152 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14259788730993969578,1391357842011019922,2097152 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,4809070063721345380,497141029124172298,2097152 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,16052927401077991535,12756961693705626901,2097152 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,17193266412510704904,17864217523372681725,2097152 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4300,i,16129114743296956031,5620747914668157772,2097152 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,8442375859199189776,12157881381921845905,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,9032035976831219877,5274181233358552524,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,2816873732807812188,15958133864303115935,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,2816873732807812188,15958133864303115935,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4363809357231674018,12456359103481824106,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,17428005929453166282,14729126226087234708,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,11079730283438337181,14598787097115562469,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,999716449086487326,14527571680906817074,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,10311282300555585118,10097416509892422376,524288 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,15258705512192256342,8398358357560989851,262144 --field-trial-handle=2556,i,6024203744704867842,17520474234621593910,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9268c81dd8afa6fbdc34d051a638b4dce94ab92618da951ddb0bc7dc51433fef
MD5 861a6fce0d87692d2b4a1303e56f1a25
SHA1 7a516cdc72a0f568ccf931e78fc08ead146d8e52
SHA512 9a9d6e902af9bba26e1ef6ceb054ca9a19ea9e7ea145a221d8fbe629d7b20cfc76340fd3acdcccde9af66986da13da0c4d8c84cd8ce7106f1212135992e9ce44
TLSH
T166D02B21B7CCD400C0E30031C018931041A800C4642B8944B0B0842D680B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 adf1ac7ef6ad2f467814611b23b5905d27bfbc301c113cc0f42faa887b0cf867
MD5 43cfaffeaf5c46b9eadeebb1347c22e7
SHA1 d96f3ed6add4b5fd08b00be076bd99ac8c96b6d9
SHA512 d9c942c219d1021105ade146c164fb4fff35ac9acd0e85af945085e82c7ecd2ab6e92dbb4acf30d22ebeb0b2a7a9788fcf0f1d01f75408a2ec7523fc3c62a603
TLSH
T1C7D02B2177CCD800C0E30031C018931041A800C4642BCA45B0B0842D580B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 80efb85a7d1cd087c69402966b8727f1cba00e3914527af904013ddf1a094fe6
MD5 7513f89c674d1142b7c558be9c1c9389
SHA1 e39d658393f0ae1a8c86dffabd0cd13701158d6d
SHA512 889c354b7e41658ddbfbbae0010379f075d8409ed08f6bf259c393046b1d69a5e6455bf5181fbd994ea8f397ee3de3652e37e0ee36bf57809c5587e913ffd3d5
TLSH
T1B761509D26E649B3FB613630ECD021047D73BBEA09434D0612BC58BF199F735821E368
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584d11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584d11.TMP
Size 3KB
SHA256 446ec6764d75e97102ad6829f2efeb4a57b093ebf31eda8833e97ecd6b276e0d
MD5 8c754095a3dca663c193c1429f690abe
SHA1 2b87f4dad2a046494b71eba4563306c923a47c52
SHA512 2fd1ba8bf2d2dbc5387ba6fa29f6faae051d96bd5625108e1316b5cbefb449bce109c2b053df98b8e2eac4560a2847e619960bb6c30e8911095742068aa0a8f0
TLSH
T1F6614F9D66E649B3FB613630ECD021147D73BBEA09834D0612BC58BE199F735861E368
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a11cf9b74144852866f6c00ef15f81f480e150444047653efeb606484b9c4dd1
MD5 ffe666807fe497be4c328250520c3716
SHA1 73903805d48e44887e4a83776edbf93f4a63e633
SHA512 cbea69f142b14b611a569dbc96ffc27abfc938186ec2f839a634e67f019ec2b89edbcd2ed7d40fe884aeccb4be21af9ff29cb1ba8ae212dd47fe8e6a87f7abdb
TLSH
T1C5218BB7C3E486AEDD0116F05A24AE2BCE1D0516832C3C5689E8AF1B93F3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 64ac24e333a2a63ef06e5e599225a3d20ef5a190cc2d0ed10373cbe2eeb613d1
MD5 34f5aea04b705d87906fd77c08dfd6ff
SHA1 2c3afd012eb9535a0b629e1ceef4564bee970aff
SHA512 659f225f2aca8e6301d32508b2c0defaca20323ab66756eaac7bab9dcd0e1739554be965be5d1fdbaad96dc2373c1d5be1b6eaabb8164f6a33c92b852d6270f2
SSDEEP 192:sxZcRYyM/jK1Ml8MFK/fFsqZH+Idpy6/W6+WNGY0YYqJQB6IgrJ:sxZcidK/fFsqZHvJ/bG5h49
TLSH
T12342E7056A346D77CCDBD20EBA45BF53D6F80572A2940E44A9FCCA1C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4bf377d3bc1b98a8fe38c10736d37cbe46abf5772c0f5f75916849af2b3e06b3
MD5 289399f86dc2bc0ec841e71b94db6093
SHA1 268ca71755e54e452a98b3fd83f082e804270fed
SHA512 566925a47de780110134735522c2eafe0ae4495e2a474f65ed1fb6495e96e5fe7756c27128cfb195acc1f3687804f869105ce5b58fd45a31f3c710c417f8b9fb
SSDEEP 192:sxZcRYyM/jK1Ml8UQgFK/fFsxZV+IdpE6/W6+WNGY0YYeirB6Ig5KJ:sxZciqWK/fFsxZVvn/bG5h+A
TLSH
T15C52D616AA345D77DCDBD20EB9417B53D6F81472A2900E44A9FCCA1C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 db50d3a72f33305f5d9a620bd65704b720d0fd930e1b0cb4446b8145a33e0f41
MD5 4f0e5fe870a6ec9e7b9d54740f49f64b
SHA1 586dfad3fb8fb8c055bfe0762869db5463d3bf38
SHA512 d2be48256b21e8d280d9236feb2735eaecf8628e078df37ccbe3900d0a0ac6893f24180e95523455b42138a93996ccd9bb43b983e4627f3ce0cadd3c7800820e
SSDEEP 768:ctl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/p3rocK:ctl1j83r2pmWRmeKQBCu1jaK3ALpCN/2
TLSH
T10BE22C2B680CC77E4F844E5DEC266F966ED801CBAB684D5447FA494C03C73EB511A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6fb0600608163ef1aced9782e480b37551176fe6890c4be1ad2f77dfe5eb0ee6
MD5 0d0f7ddb5c4a2c772f522dbe5d314ffa
SHA1 17dca82a20ec495760b79d22512d798eb8de97ff
SHA512 fc091d97e139d338547be44ecbd4c77d9515324d5a2d58d2518d599439e36b9ade1947ed1aa454cb52c21b392dc9e3f381194835d6d88f2d09e38307658c06a2
SSDEEP 48:KkUIHKtecXyuWRGw9EAuK+gqCrzInYgKA1YWg0owpb2QtyF/IpKQocz:KkUgKtem9WRJrKKs8ee/eKQok
TLSH
T1AB917A5731B703473C3E7848A6D1872A074272A7306865AB3BB944714E2BE344EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ebe3240-22e6-42ac-8236-6ac9d4fcbc5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5ebe3240-22e6-42ac-8236-6ac9d4fcbc5c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4b5e3bcbabde41ebe55bbd83b6ba4bc749522953b3206e93319330cc3156cbf0
MD5 921aafea0aa596fed15ca4bb8c995a89
SHA1 c03137fc3503f450745b2f8d35d90a7bc411b84c
SHA512 fa2cc0a42d468b2dac6ed63763292c889fe2fd8a9d38e0d7fbb054b786b9e848745a82dbf7f3596407cec2ef0e25d845fadb5715377387e92f9e99327260277e
SSDEEP 384:dtNn/s3n9Sm8NLjsXbnRfF1gX532oOIVEJr1gDVcl1lIO7w/szNN:dj+9lHjadOIOh1gDVcLCO7w/y
TLSH
T120926B32A565AD375DE6A989F45336075FF89027DAC82E80C5DD7F1D02CFA9C030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7f8fa8d9873460e5206307d521fe948889881a86734afe4c2b30efabe7f49f7c
MD5 2291f861249bf1ff5d307f98452fea19
SHA1 a63f14440c82ce14d8daa9b9eb892e0a8be9e443
SHA512 f87ab82dfac9a9805382490588c3196c9f0bcd7013599f81d1d7c4c47965bc3931029fc08a6e80adcdb6b8018546f64adfaa547519d1150df9761b5eb37919de
SSDEEP 384:XtNn/s3n9Sm8NL/sXbnRfF1gX532oOIVEJr1gDVcl1lIO7w/szNN:Xj+9l7jadOIOh1gDVcLCO7w/y
TLSH
T1A2927B32A565AD775DE6A989F053360B5FF89027DAC82E80C1DD7F1D02CFA9C030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5a97f5c233258205dc9ed3c0dcb7ec5c545c3d9b74d97b30c17ce010cfc93a7e
MD5 1e743f379557109277961c2ee7640eed
SHA1 a0dd3278a3b3564795afdf71d2a75a035932a02b
SHA512 7b9b200180f275075a9aec98dbbff77a1aedbe57be389eb0b0823ff08cbed926722bd16c2984ee3b6efc90d20e03b4b65cb4886e655a1d5ed586f092bfb6549e
SSDEEP 384:biFftNn/s3n9Sr8NV8TUNTUlIlasXbnRfF1gX532oOIVEJr+gDVcl1lIO7w/szNN:2Ffj+92swgrjadOIOh+gDVcLCO7w/y
TLSH
T153A28D33A9A4DD3BADE69E89F55732079FF84067CAC56E90D2CD6E1C01CB69C030AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 19988b0c23fdc7a889b9fcd389da1fdbe4314cdd1d2385d26ebc09e5f0fbd995
MD5 5713d33dbce43079d8bca74135d421fc
SHA1 f8bb5ec158ccb930b90ada209e804358ac453b5f
SHA512 13c673ee84a69737e5db1d8713ad904ed7c202e77ad9b62b86e94137e2613ff856109041f2921f107bee1673ccf7f7374cc2777f7da2e6207fc4b21a525aad05
SSDEEP 384:htNn/s3n9Sm8NLasXbnRfF1gX532oOIVEJr1gDVcl1lIO7w/szNN:hj+9lYjadOIOh1gDVcLCO7w/y
TLSH
T120927B32A565AD775DE6A989F053360B5FF89027DAC82E80C1DD7F1D02CFA9C030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43a5788214a32168f9d62abc03f88d3e8ce013c1680db559b658204a4aee9071
MD5 ba745f72a1449c368e8d83b23c969ce1
SHA1 3fdf3789395ecfaf9d8f75a1e157cc58e284bb64
SHA512 ff01aa0a216b9d40ad14bb9a20106262f53dd018cf972070a40741a12bc5f7e24287f0fbcc454ed14020760eecc3a8a7047f4333039b02006434d7772309013c
SSDEEP 192:6GNr6i5fQmiUyZdRO7X5zPr2oOA4mGajEGBgU6:6GNr62habO7X532oOAfBgU6
TLSH
T1CB02D835B968BC779FA3AD55B58637135FE8102BDA946F84CAD82B1C00C769C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 633de8f378c037952db48cd004093529f47c9125fc343b6e6f204ed259eac59d
MD5 f21144143551892bf08b6cd89285b06d
SHA1 2235af83a39d8d95e33ceb12b9707ef2c11575de
SHA512 d59aef3e7069b132c8b50d56fe0676dbb4d13ecf9c9539d04637b6cd167625da1cc47dc917befaac69cbd11564400bf5c4d105c496f1c96d5a18c5bd8616e52d
SSDEEP 192:2GNO6i58QmiUyyRH7X5zPr2oOA4m9V1SJrpGQcqhYU6:2GNO62M1H7X532oOIVEJrhgU6
TLSH
T18312F931B9A8EC775E93A585F08736135FA8512BDA88BFC0C5DD2A2C05DBA9C130ED17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15bda620-3eaa-4305-bcf8-5fd38cfd38dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15bda620-3eaa-4305-bcf8-5fd38cfd38dd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download