hxxp://monte[.]camp

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://monte.camp
Sample260804-ss225ach24

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303306620646883"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{DE3C1975-6E60-4671-866D-C7444196E544}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4392	3284	msedge.exe	84
PID 3284 wrote to memory of 2136	3284	msedge.exe	85
PID 3284 wrote to memory of 4088	3284	msedge.exe	86
PID 3284 wrote to memory of 2904	3284	msedge.exe	87
PID 3284 wrote to memory of 4088	3284	msedge.exe	86
PID 3284 wrote to memory of 4088	3284	msedge.exe	86
PID 3284 wrote to memory of 2904	3284	msedge.exe	87
PID 3284 wrote to memory of 1968	3284	msedge.exe	88
PID 3284 wrote to memory of 1968	3284	msedge.exe	88
PID 3284 wrote to memory of 1280	3284	msedge.exe	89
PID 3284 wrote to memory of 1968	3284	msedge.exe	88
PID 3284 wrote to memory of 1280	3284	msedge.exe	89
PID 3284 wrote to memory of 1280	3284	msedge.exe	89
PID 3284 wrote to memory of 1308	3284	msedge.exe	91
PID 3284 wrote to memory of 2956	3284	msedge.exe	92
PID 3284 wrote to memory of 1308	3284	msedge.exe	91
PID 3284 wrote to memory of 1308	3284	msedge.exe	91
PID 3284 wrote to memory of 2956	3284	msedge.exe	92
PID 3284 wrote to memory of 2956	3284	msedge.exe	92
PID 3284 wrote to memory of 4876	3284	msedge.exe	97
PID 3284 wrote to memory of 4876	3284	msedge.exe	97
PID 3284 wrote to memory of 4876	3284	msedge.exe	97
PID 3284 wrote to memory of 3876	3284	msedge.exe	98
PID 3284 wrote to memory of 2356	3284	msedge.exe	99
PID 3284 wrote to memory of 3876	3284	msedge.exe	98
PID 3284 wrote to memory of 2356	3284	msedge.exe	99
PID 3284 wrote to memory of 4512	3284	msedge.exe	101
PID 3284 wrote to memory of 4272	3284	msedge.exe	108
PID 3284 wrote to memory of 3196	3284	msedge.exe	109
PID 3284 wrote to memory of 636	3284	msedge.exe	110
PID 3284 wrote to memory of 3948	3284	msedge.exe	112
PID 3284 wrote to memory of 3948	3284	msedge.exe	112
PID 3284 wrote to memory of 1884	3284	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://monte.camp
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffc4bc9c188,0x7ffc4bc9c194,0x7ffc4bc9c1a0
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,455717039864870314,5918071880284795749,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,3439525963660613389,17670794849066947789,262144 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,16608979268931427818,7675680787985050374,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,8160190629667026275,16507164661455104919,2097152 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,12732649616662547262,616088954649798995,2097152 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4457507486786315860,6112738231329629205,2097152 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,5442258135036422740,9482505845611224548,2097152 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5192,i,13314101222607993865,11475386973109989416,2097152 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,3883605314594415532,7615463224790165263,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,10935348267377003303,2664755277187301117,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,10425437137853204478,14744950592833204294,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,10425437137853204478,14744950592833204294,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,15279366517079905772,5071938891971516611,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,13578018190429725866,15071623419942194012,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,10551813047375588634,14946319164382883451,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,13822487678271143303,7488197077724847586,524288 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6320,i,2127398856804734702,12819694808422793699,262144 --field-trial-handle=2940,i,7974596692923966983,15331689794830177387,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d739bc2051f6d90c61aa9ee62ac0caefa41172eabfe8c0263e3b26c8824fc0d9
MD5 2c9bf4f38cb18ba19274edd081fade0f
SHA1 8c7aaec0edddecc482cd706c6eaaaf3c84ccc9cb
SHA512 d8358a809d976f5216920f7f9970da886461899292edf32b338e0b02e6cc9b680ee838d9e0327bbd2d39ad931d27f761f379a7d52baca604fba2ffa2ec7a83a2
TLSH
T18261F638056E04B1E39A1CB146D5221730B6BEEBFA5B5E74C2E09E37211FF26B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b820.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b820.TMP
Size 3KB
SHA256 629d88db3739f7f988a120f2f09ba6feb880016270a3157082b4e200e63333fb
MD5 e61cf1f9d5620bda14335704479c9ce2
SHA1 ca68085d872ed9c4321112495880f2b1c9e69ade
SHA512 17edc34c7264726ef82cb32be6aa68311e980f39ea80602f5a56a8175cae8845972117eff2a4cb9c361cef5ea3126d927aceb309d09ffc51c27c7cc121a6f898
TLSH
T11461F5380A2E0871E39A28F142D5320720B6BDEBFA561E74C2E49E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 44eea7be086076e6071663290e8cca8b4f1f192fb011a71cefbaca4eac513033
MD5 16dc23edbe5e4d9a7905b954adcaa0d5
SHA1 528ab8bbab94ac3cea2bb5cddbc59b50317a2675
SHA512 945a93c847a0066065869b146462f5fbc4c3533460d0f3545b4e0b6ad2b0296910110af8c138431460f116bebf2ed1c36c70fe7386bad4e255f7a4e8a640ec48
TLSH
T13E6179F3C3E9855DC85113F0AA286E2BDE1E0914932C3D59C9E4EF8BA3F2571D14154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bd6b0a6384758f123dee847f31819bcb2e2e9717a8b7136b4c4edc18ad741225
MD5 08e2d41413db10af0caf4e3aafb7da23
SHA1 8955d3c398db51f097dc75975a24bce1c225c3bf
SHA512 242633052bfc1841bfb227166de0eab97f49a646de13a3eac26eec7316faeaa586770fa9513b1311984a8ff4edd8b37615ba43d17fca826470f092962fa34279
SSDEEP 192:sxZWR9yM/jK1Ml8Mk4/fhskxxSIdp+NHW6+WNNTx/Y9IrukUIgrJ:sxZWLM4/fhskxFmHb7/S9
TLSH
T1254209126A386977CCCBD209FA55BF53D6F9157292900E48A9FCDA0C04E6BEC230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0878ea28c4e5bc455fe6c16d455486a7e461fee8074ed8465f4624d5d495bac2
MD5 c8db6e4415758429346e1a667ab23ead
SHA1 8d33e1028f75198f427aa74979d2bb7f54c8349a
SHA512 a8a50e44bb935b6b0028fa2c8133645d39de4d2ec1d8003626ea2ac630a99efceae1d6962b9c6c878f4d1bd1eecf30c65fa2eb38939dde08b9f881987f974a70
SSDEEP 192:sxZWR9yM/jK1Ml8UQqk4/fhszBCxSIdpsNHW6+WNNTx/Y9IgFkUIg52J:sxZWLq54/fhszkFEHb7/6w
TLSH
T19452FA126A345D77CCDBD209FA557F93E6F9547292900E48A9FCDA0C04E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e0be48b4431b29f84babc025fa39374ff9f8094d628ea698931214752f1c9b43
MD5 7470cbf283d85d40cd92bd96e2d21755
SHA1 f0b799587db22806d1d93af12788051f0b1ec54f
SHA512 7514119c71acffadde8d909c46c56f2344fe6e48ee98be570f133a52069764f54b0363c1193eb6648cab254ec96f0371f22ef79296a95ba4492fc8837b770910
SSDEEP 768:vEcv21wWvu+z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNEro8g2c:vEcv21wWvu+z+u1jaeFLeRNP8Q
TLSH
T174E20B2B280CCB7E4F845E9CED2A6F8A6ED801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 268675d7bb4dbd9cb6ca12dd892b9b4b17c37597946cf76ba6560fe3a833fc9d
MD5 14f6bc38f057face4867d19c18a873a3
SHA1 dffc25f743ceef0013ae6db318a33f255d4e4600
SHA512 d4885f8d970b5251766efee6dfbdc01f566cd2ff22b53c988ae84cb69f1ae69fa9a68b7a109cd7140f388ad1c1a49a032e1823aeee6fa0bb2b9f1f6be567b4c4
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqAoKRef6KcKDyCd:mTLqHPd
TLSH
T102917712313B12A2787F6848A3528A368E4636A3381CF56F7BB850B54F27E551DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594627.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594627.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 35f3fd49fc56fb9dc9dc4649f7de863bb13f20d5c8eb370e69b8a46c7c023f75
MD5 38931d352c1f1911e1f5ac22adedc419
SHA1 14ecf19bb330178e5abfacb67a2bb90637a941ec
SHA512 fd0a05dbad12dcd61cce9eb410646dd7b64583429eb5f9dbd50c0e20b76bd1dcbdb904e307b9de18c398c0822f36a8c99fa9dd785a07885e62c354689710e491
SSDEEP 384:jZcIhsNYMigEzit83e+CMOfvYcBeRs9JKgqijUCh:7hrLukOfvzTjKgqmUCh
TLSH
T18B928D3058781E7A9AE7A681F58B3A574FFC5027E6C02FD0D1DC7F0C01DA59C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5f5e376d11c8c69128108e09e571c2f33c00f8207452efc6092b27db9438ef45
MD5 12cd213089265255f083b6d2fa74b38c
SHA1 5fb9244dc384ed5d4ca56bc8bae472059028b960
SHA512 2abaf5b1b43c55b598d942734395db7aa056bd709f4e53d583fbf65031b9efba76e644a71471860f3ba0fd7f95a1a35b968da224b71a4e63139126566e371c8e
SSDEEP 384:RiFiZcIQUzsNI8TUNTUlIl9igEzitt3e+CMOfaYcBeRs9JKgqijUCh:4FQptwgIiukOfazTjKgqmUCh
TLSH
T15DD229F148D7497AD9AE9B43A77E2D134EBCD067F5806A90B3C8690CCC861BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93d9a27ebf1b5efcb777313ec0cd55a56f99fd61cbcd9f7d66da7e79d910bbb1
MD5 7efd2a15a2fc8679128364ab3c78fe0f
SHA1 4c26ade21e3192612bca159f89a99e81841777b2
SHA512 256ec2b973d56aa9e5dbae5fb1664f23220b052c9ca7e49f54c8d977a50ea6a44d97ce662b25e4fad799020e65e55d41124022ae3743496ca88ccb4ce0444ca5
SSDEEP 192:JONVh6v+YLNQmiUybmZh+CGlOdmuusjEU6:JON/6vz/DZh+CMONAU6
TLSH
T10202FA357D782CAB9FF2AE45F58737275FA8213BE6912F80D9D82E1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e2d8604ec4fb25580dbea27ee981ba737d1eb2aa6437f99315017b2d26e88d14
MD5 47ca4ecf7b11b83b1456a753185f742c
SHA1 8862679ca84f56951096359ab51c65c9cfc0e3b7
SHA512 b7da979a1c0c3a5e79050754129fd415f5cb2a3e07cbfd4e8fc991e15d0cbb1a0c6fdfd7cb670c3ea72c4322da46b7e74ab26e87730b4c96f285a8505073d919
SSDEEP 384:aZcIhsNY9igEzit83e+CMOfvYcBeRs9JKgqijUCh:YhuLukOfvzTjKgqmUCh
TLSH
T1FA928D3058781E7A9AE7A681F58B3A575FFC5027D7C02F90D1DCBF0D01DA58C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3a2b21f0de87292d416d761c515d6726c551a15f3eec99027302f3ed1b54ea42
MD5 d2df015c95763869846a0f3a0ca32b34
SHA1 c796416d8fde1c5547672e0363e2aa1d58eb2b81
SHA512 1ca47a98024d7ac98f40b0de9597f77faba51b341fbc35cf90d298f5ec9d1688f32e27a9e7860af6348ab5e6eb5f0863f0541bb15bc130f3176ed9632003a501
SSDEEP 192:uONZ6v+YLXQmiUypmFh+CGlOdmche7CHRqxcU6:uONZ6vzFrFh+CMOf/YcU6
TLSH
T1F7122A3179786C6B5EE3A544F48735239EA85237EA857FD0D5CC3E1C02DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7df8c5e3-7a62-44f0-ad09-b65568cd71be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7df8c5e3-7a62-44f0-ad09-b65568cd71be.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9da4d7ece71a245076bb90959d16186ac65764ce06339bd00a6bf56a9df7a59c
MD5 318db3c749853937eec4d857d60b4b19
SHA1 bf00e7b89af4f9f5682c1b34dca7edb31d3f7007
SHA512 a9e5137e398d013baf26045a0ec08e6d81af9325a167b43b3268e079f1a0fa40f7d95980c1beb396a3f0315cb7ce078951821a83c41801561133db58410fe1e8
TLSH
T16A412758AAF90149B3B67F56ABF6A46D487EBC732E57D05E10110E4F0A26B40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download