hxxps://cummingdark[.]com/cum[.]php

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/07/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cummingdark.com/cum.php
Sample260728-mp2pasvwew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3388	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297088119514983"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{BF243AE4-843F-4F85-BB55-FBF7FF645D26}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3500	2840	msedge.exe	80
PID 2840 wrote to memory of 3388	2840	msedge.exe	81
PID 2840 wrote to memory of 2040	2840	msedge.exe	83
PID 2840 wrote to memory of 2040	2840	msedge.exe	83
PID 2840 wrote to memory of 4152	2840	msedge.exe	82
PID 2840 wrote to memory of 4152	2840	msedge.exe	82
PID 2840 wrote to memory of 4152	2840	msedge.exe	82
PID 2840 wrote to memory of 4188	2840	msedge.exe	85
PID 2840 wrote to memory of 4188	2840	msedge.exe	85
PID 2840 wrote to memory of 4188	2840	msedge.exe	85
PID 2840 wrote to memory of 3780	2840	msedge.exe	86
PID 2840 wrote to memory of 3780	2840	msedge.exe	86
PID 2840 wrote to memory of 3780	2840	msedge.exe	86
PID 2840 wrote to memory of 5072	2840	msedge.exe	87
PID 2840 wrote to memory of 5072	2840	msedge.exe	87
PID 2840 wrote to memory of 5072	2840	msedge.exe	87
PID 2840 wrote to memory of 3096	2840	msedge.exe	88
PID 2840 wrote to memory of 4176	2840	msedge.exe	89
PID 2840 wrote to memory of 1680	2840	msedge.exe	90
PID 2840 wrote to memory of 3096	2840	msedge.exe	88
PID 2840 wrote to memory of 3096	2840	msedge.exe	88
PID 2840 wrote to memory of 4176	2840	msedge.exe	89
PID 2840 wrote to memory of 4176	2840	msedge.exe	89
PID 2840 wrote to memory of 1680	2840	msedge.exe	90
PID 2840 wrote to memory of 1680	2840	msedge.exe	90
PID 2840 wrote to memory of 2692	2840	msedge.exe	93
PID 2840 wrote to memory of 1888	2840	msedge.exe	94
PID 2840 wrote to memory of 2692	2840	msedge.exe	93
PID 2840 wrote to memory of 1888	2840	msedge.exe	94
PID 2840 wrote to memory of 1096	2840	msedge.exe	96
PID 2840 wrote to memory of 4780	2840	msedge.exe	97
PID 4780 wrote to memory of 1520	4780	msedge.exe	98
PID 2840 wrote to memory of 2684	2840	msedge.exe	99
PID 2840 wrote to memory of 1280	2840	msedge.exe	100
PID 2840 wrote to memory of 4172	2840	msedge.exe	101
PID 2840 wrote to memory of 2440	2840	msedge.exe	102
PID 2840 wrote to memory of 2440	2840	msedge.exe	102
PID 2840 wrote to memory of 2632	2840	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cummingdark.com/cum.php
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffbd762c188,0x7ffbd762c194,0x7ffbd762c1a0
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,8909319062572900975,15750270216204417104,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,3034343317423487227,770403587060262872,262144 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,3726998516849375404,5536003980537917038,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:13
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,13381587043342700921,4278022899945480433,2097152 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,7504569827922269204,3738784278485506413,2097152 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,9164106427552970477,16686805260617504708,2097152 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,5791624619737358566,9647812238502407157,2097152 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,8263924159019510498,11758141036598400399,2097152 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4280,i,3516812880960791008,3146452121112722721,2097152 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12567565791644745732,8390159016684481487,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,1500142757242306874,10441496936749246682,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12283503961246725056,329098007939552183,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12283503961246725056,329098007939552183,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,1474987922410442017,14989302874683870970,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,13958856322766549460,9764812310437921514,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,13036527040757970052,4294019871478744133,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,13937497747160299949,13911725148906103861,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,2071146718609399039,15773613208108577180,524288 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5624,i,6906123841040154905,744276636537964016,262144 --field-trial-handle=2124,i,12728802363439796196,764570917949769586,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 36cbee9a22fe037884ac52a1708ab560c7078128f507afb53fe8651951e6f2ff
MD5 22384073c097844f7a95b2aecbe1f465
SHA1 bb0d4cb4966f40e818eb9677e4714bb1be43c510
SHA512 2a165bedfb2ee975d5e560bb8b770d02e1389df40b67c5facbc4edfb1ddcdc8ae7606a8c980b64946a2ddb1870d2b8d5cb1e5cac9c45c3bd1ecf3e9f637b08d1
TLSH
T169713C9901961FA1F3640134B0C2E6D870BD81A40C335EFF11C448BAA7EC754F5178EB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bb5bf58ee4a32b94f1f601e8c90c45a55a7c5840bd38700a694fe9175abb708f
MD5 99ec16ee91b1a4c52f361f76ba9a6fb5
SHA1 d0c3eec75824d08df50704474190a8071eb5cf78
SHA512 0c299a1418af8c827376a9bf5fd2e945b066f772475b7876a02e881d8e3c0fbc495d52b9cfd0cb2a7f17865556b4980b0253b77a5d7cb96be6f8a756a667104e
TLSH
T102712B9901961FA1F3A40134B0D2E6D874BD85A80C339EFF11C449BAA7EC754F9178EB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d52d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d52d.TMP
Size 3KB
SHA256 8eb4f370537f831239e95ae430fc1f3196d2f715455ad3cc37e8f99466186dc8
MD5 dbcb62fe39ea2f8469b9b6d51be4e27b
SHA1 82db73f6df70d94d321566afc5908baa7bfa882d
SHA512 3609bfd8f2eaf815798452820faa0e6211a0c17479ec9d830bea0fd9a613ba447c9edb949087ea7746a7d343034d3ed1064ff407dfecd57650021a6478903952
TLSH
T162711C9901961FA1F3640134B1D2E6D870BD95A50C375DFF11C049BAA7EC718FA178EB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fec5032a00502771ff6ba60baed89f297192150daa9de2495d934f8a2b6fd92b
MD5 2943e3f9feeba3a5512f6a60a9c829d7
SHA1 5d8e68765e382d6d3e3110cf4dcc1a2a0b68db2e
SHA512 83dd8eea0d49f98ad95f8966628f1d914d18643f13c72dae75dcb8e25e6226be37cf453f12e21196f2cc7995cd4afb0e7a688eae9218e46a6d27962d0c007fd9
TLSH
T1F73149F786F4896E8F1156F0AA186E1BCE2D0919431CBC5AC5D4AF1B93E3472D10158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 65833a1f6033ffadd2ff7014952b6ea6ff9bdfa3764edc77c0ee130b3c8f8640
MD5 49ebde358eca7ad5a1e52d424150148e
SHA1 28b4bbf19345a4b012258d7eaba7c2dd7c9ad1bc
SHA512 b44de749fcb4a0c437ae55edf6f612578ea415cd5baf2b773bdfe8e7667d6dbff89c0cbd44cff23cb59e39c6974877ee23b2434bea686fe2a39422275cddb404
SSDEEP 192:sxZSR1yM/jK1Ml8UQBF5/fpsgL6p53IdpPJ/W6+WNFCR/Y0sjTXyIg5MJ:sxZSHqH5/fpsgL6p5YB/bi/5N6
TLSH
T1F052C816AB3859B7CCDBD219B945BF53D6F5047392900E44AAFCCA0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 16bb7804b5ca362b63e6f18f910f2325278a4dda2ec172af748ea073e8bfa1b5
MD5 f1b62d570f02355078a00c46b15dc204
SHA1 7ab604d15da26d7b6a33dc3af8f634b3672c6bdd
SHA512 971352a79f34fdd9c7ffcd5347bc3ad7319c71a94f44bad61f9ddde0900f68a90044c5821436944ea91562132193f3c70748707ca6e6addc4943498926b80582
SSDEEP 192:sxZdR1yM/jK1Ml8MF5/fpsUL6zZIdpRJ/W6+WNFCR/Y0sit9yIgrJ:sxZdVd5/fpsUL6zyX/bi/5K9
TLSH
T13A52D8166B386977CCDBD209B955BF53D6F90972D2900E44A9FCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e93e0cde3d8129f1499609d9ee99688cea07a698bc61276cd98bbdd0e32e004b
MD5 8857b23e0881fe8656d2225c31aa8176
SHA1 d24056652e082b5a15026bdd16b4fc419ebe249d
SHA512 f9ef1941072a17313635441fdda92601a33a31bde35a47937e19b924b25c2c431d163ba7a50acb3fafb1e77b74774960f855966e22a23d96e217fbce44dc7d86
SSDEEP 192:sxZSR1yM/jK1Ml8MF5/fpsgL6p53IdpRJ/W6+WNFCR/Y0stQ9yIg5MJ:sxZSHd5/fpsgL6p5YX/bi/5a6
TLSH
T1CD52C816AB3859B7CCDBD209B945BF53D6F9046392900E449AFCCA0C05E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 b48c0092ab515ed6b2319a0f577e8e6ecd62ff4081a9803b45d9d024195e9458
MD5 4144c3e3edcbf6944f9f658bdb2e4396
SHA1 ab566902b648a697f5e3db2c4fe236a67608fdcb
SHA512 7e702408670bbf246522410bf1668cfe64ebe2e9924668d5e8398b6cce9bf583148cb21e4fb42db3eb406334d12e2461a790b4c70d1677d2036fedf5b7b4c607
SSDEEP 768:9M/Xh8dF27kWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601gCro6U:9M/Xh8dF27kWRmwcQDwu1jaKmjLpkD10
TLSH
T1D6E21A3F280CC77E4F844E9DEC26AF966EE801CBA6584D5447FA494C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1c9a1ee436b77865f6895bb8e29402a38d3f5ba240807fbcccc2d84b8b025d38
MD5 eca331a926d37002037bb674caf119e0
SHA1 7d37cb55f7d131615fad1954331f9c20b2eec167
SHA512 911d7aee146ca386d06a979271609deda495dfa55921c5c977d628d9edff2769c486cda56fb03ca4c9943ebcdb63fc8f1d13c31c76a38d88ced2bafcdd11cc35
SSDEEP 48:Ke5CVpT3Lkb3EPIEBkK9B1rkxJ0SkTJ5y1DIpKkwUkFIhK+ksTyRd:KkGEK/a62D+KkwXFWK+kSSd
TLSH
T1F191394674BE06223D7D290C9655872B9AC271633156E93B37AE05B19E2BF230CFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d624b325-e504-4c24-a593-9d505aeb06ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d624b325-e504-4c24-a593-9d505aeb06ce.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d32def986d453298b8ba3a9a4db3a11768c397185f9bae1e6e759741f59e3806
MD5 eb12bab7e9b6a34d5a405c9192e77cac
SHA1 d6b9e87ef6b66474264389c9c143d758bebe9425
SHA512 29eb409c175d52eebbebb3f157e05845a76ca5d3d6e4535b07f77cd168eb9a7a49200a0dbc2ade4af1a27f5c1798ca897e73275a34c6337a404eb4b66940240b
SSDEEP 384:DZcI58N5geglXiLlZr/E5lOROObjI9G6w77d:b5uh/EeR29MR
TLSH
T1FB929E357C78ADB699A3D511F4873A134EF8913BD7D85F84E4EDAF0D06EA4AC4302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 02a3808b1ba2ce359957ff6de4d0f864f20524c841d114b8af37e052e3d5faff
MD5 295d70272f17236f2ff7ee88ff506ca0
SHA1 3e328f998fa740ea7a81f1931e864f6f66f9a86b
SHA512 b6e32f340b2e7990ef7a69a92d6aee45d6615ce8dc467c0e4aeacd6168f906f2e93cfdbe36579217dc7eeef97a2d172b1483ca0fb2ebd255515de4c5adc1f6ad
SSDEEP 384:niFcZcIo8Nb8TUNTUlIl3eglXiLlZr/E5ldROObjI9G6w77d:iFKo+wgQh/EtR29MR
TLSH
T13FD207F258EB8976D96E8B03B77E2D134EBCC067B6945A44B3D95A0CCD960BFC302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 565bb5187620df72d5ff597c7a5f709adcdc456c00ea95928563f46753d6a95e
MD5 b544f058231c6a060ce50b9240019913
SHA1 b0c4dfedaa87385b21ce60dbf87f61478b9c774b
SHA512 98b6e9e6cf55e2b9963bc91e685a6a9e3352a6caadd85cc1fd13603736c6e5abaaa186a6703af971405afc4f93eeee0a3292ed783c0d049000cbc69c5444de92
SSDEEP 384:/ZcI58N5UeglXiLlZr/E5lOROObjI9G6w77d:X5Oh/EeR29MR
TLSH
T1F0929E357C78ADB659A3D511F4873A134EF8913BD7D85F84E0EDAF0D06DA4AC4302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4ea28a58a9b15ca6e0fbaf4388eca0c5dd3250ac3145a7fa21aab1a8f0a084f8
MD5 95424398cc36a6716e4095b6907aaf6c
SHA1 8f339d2b479cde48f6595dae523a0f55c0b15df3
SHA512 12d3530718c15dd4830bdbc6a72834dee6e7495a03b9436bae9dc1144f174b0012364c1ae99d6d2e9d0dc0f21db5afb0685b51505ed56f8a194c6e63d5c735b3
SSDEEP 384:uZcI58N53eglXiLlZr/E5lOROObjI9G6w77d:M5lh/EeR29MR
TLSH
T151929E357C78ADB659A3D511F4873A138EF8913BD7D85F84A1EDAF0D06DA4AC4303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 58272deac02be69aff11dcc303eaad9fa97327c49e71b9d135c0b01bc0f0e5a2
MD5 e27fbed2b0a1ec8ae7672634ff7a2002
SHA1 233d9f0d5747abc63458d79c7acfeab036f0dd07
SHA512 19baa85e8e351e8581de1c700fd7434074059a5cb91316b106a863da8fb4d4f08f3fbbd7051e8a0bcfc5aa986a31b688523917ad7b734a901d178b961918459c
SSDEEP 192:1GNu6t6H3BQmiUyJHBHS2Qq/rUH5moRjD9MVZJU6:1GNu6MXfy02Qq/E561U6
TLSH
T1E302E934B8A8ACBB8DA3AE45B48777235F94117FE7D55F88D9E81B1C01DB69C1302836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1bda3535c19b5b2ea1f07e6fe1414a2ffffae9b817f1ff780fc460a15f1cf6b
MD5 1fb6ef4730accb9c1fbe29a09901ba33
SHA1 54629ff9beb394e2e0e196f49db136a719ed1baf
SHA512 9df5bd3dcd2bf10abc46faf063251d4b5a2fefc631f7e39b92bcaafd4e28f515b5087abe5d1ae3f0e4104a9d0ab162b07d49a8ff01e28c285e33319fb9d84a19
SSDEEP 192:zGNU6t6H3sQmiUyu0S2bq/rUH5moR5f/9nfquU6:zGNU6MX8r2bq/E5ltRU6
TLSH
T1BD12293578A8BCBB5D93A940F48736134EA4413BDB895F94D5ED2F1C06EF5EC5306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13d8e56a-52e2-4711-baba-78195c4af2b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13d8e56a-52e2-4711-baba-78195c4af2b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download