hxxps://www[.]pap[.]fr/cdn-cgi/challenge-platform/h/g/fo/2742036881[:]1786712418[:]9P1XIAW6-QVsWOLIyflQN81gE5SM_tH0V-DF_Cb0x1w/a2b069a49e32f440/69e_yIt9UJGsIoB6dBIufKTtmVFQBzfBN4KBHvSO2zQ-1786715259-1[.]2[.]1[.]1-SX0NpI0BGZBiWNXZlBTiJnIMVAtaxFq65kmkLF[.]8HAaGTCTQPliRtn4Stskz06R7

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.pap.fr/cdn-cgi/challenge-platform/h/g/fo/2742036881:1786712418:9P1XIAW6-QVsWOLIyflQN81gE5SM_tH0V-DF_Cb0x1w/a2b069a49e32f440/69e_yIt9UJGsIoB6dBIufKTtmVFQBzfBN4KBHvSO2zQ-1786715259-1.2.1.1-SX0NpI0BGZBiWNXZlBTiJnIMVAtaxFq65kmkLF.8HAaGTCTQPliRtn4Stskz06R7
Sample260814-rn7alswamd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311908940297852"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{89014DCA-D43A-42F4-B66C-46FD5DB30DF6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 2460	3900	msedge.exe	87
PID 3900 wrote to memory of 3288	3900	msedge.exe	89
PID 3900 wrote to memory of 1368	3900	msedge.exe	88
PID 3900 wrote to memory of 3288	3900	msedge.exe	89
PID 3900 wrote to memory of 3288	3900	msedge.exe	89
PID 3900 wrote to memory of 4528	3900	msedge.exe	91
PID 3900 wrote to memory of 4528	3900	msedge.exe	91
PID 3900 wrote to memory of 4168	3900	msedge.exe	92
PID 3900 wrote to memory of 4168	3900	msedge.exe	92
PID 3900 wrote to memory of 4168	3900	msedge.exe	92
PID 3900 wrote to memory of 4492	3900	msedge.exe	93
PID 3900 wrote to memory of 4492	3900	msedge.exe	93
PID 3900 wrote to memory of 4492	3900	msedge.exe	93
PID 3900 wrote to memory of 2692	3900	msedge.exe	94
PID 3900 wrote to memory of 464	3900	msedge.exe	95
PID 3900 wrote to memory of 2692	3900	msedge.exe	94
PID 3900 wrote to memory of 2692	3900	msedge.exe	94
PID 3900 wrote to memory of 464	3900	msedge.exe	95
PID 3900 wrote to memory of 464	3900	msedge.exe	95
PID 3900 wrote to memory of 4824	3900	msedge.exe	98
PID 3900 wrote to memory of 4724	3900	msedge.exe	99
PID 3900 wrote to memory of 4824	3900	msedge.exe	98
PID 3900 wrote to memory of 4724	3900	msedge.exe	99
PID 3900 wrote to memory of 4836	3900	msedge.exe	101
PID 3900 wrote to memory of 2668	3900	msedge.exe	105
PID 3900 wrote to memory of 2576	3900	msedge.exe	106
PID 3900 wrote to memory of 3128	3900	msedge.exe	107
PID 3900 wrote to memory of 3964	3900	msedge.exe	115
PID 3900 wrote to memory of 3964	3900	msedge.exe	115
PID 3900 wrote to memory of 4616	3900	msedge.exe	117
PID 3900 wrote to memory of 4616	3900	msedge.exe	117
PID 3900 wrote to memory of 2088	3900	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.pap.fr/cdn-cgi/challenge-platform/h/g/fo/2742036881:1786712418:9P1XIAW6-QVsWOLIyflQN81gE5SM_tH0V-DF_Cb0x1w/a2b069a49e32f440/69e_yIt9UJGsIoB6dBIufKTtmVFQBzfBN4KBHvSO2zQ-1786715259-1.2.1.1-SX0NpI0BGZBiWNXZlBTiJnIMVAtaxFq65kmkLF.8HAaGTCTQPliRtn4Stskz06R7
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe7821c188,0x7ffe7821c194,0x7ffe7821c1a0
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,2285496583675341477,211835568910710036,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,1260911683495580932,4781405039058870505,262144 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,2449883534125434771,8518651513588870326,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,17861227053327590777,18084528509480788555,2097152 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3586791739224920723,14971186743846547063,2097152 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,9685223848056490519,11342549071452049675,2097152 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,12511568292741158429,5060294998178102572,2097152 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,43955953362632409,14339353267689491930,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,12044783025919419730,2511177441181172765,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,11007197733114144614,4845537200112680425,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,11007197733114144614,4845537200112680425,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,9628771519961383189,17266369390343940404,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,8333261416369429023,8089498358865587186,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,13179205176096716673,17082364766042627177,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,12765347694772510884,15231920904879255257,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,14628022086493605378,12533353111968708147,524288 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,9350898284260689075,3129618556605202995,262144 --field-trial-handle=2112,i,8703109810197667436,3975502375620541104,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 788f675d01bc26e86c1a51c5d8b8033c90a24389c7578f14ca19575aa39a2829
MD5 1e5f607226762cb7d5b93182f88c445f
SHA1 b89f34b3b3e7529b5340ad9778a68ff289fa80f1
SHA512 fad3b5df98797b278da2a4f23b4eebcb182b32b3f56ce11c70703e0d173b8c7c3ac543d9c2656dcd9c6baefe9efa0847fc9e9b14f49c256940b5e6213e6f6ed5
TLSH
T18E718FF4090B8B62EF73837AE5D2128471BEC5D8F9835F5E51E05B3D2088FA0CA79526
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589e1f.TMP
Size 3KB
SHA256 2a504fccb5bc6fb13bf4a57aa1ad27ebc8174dfc4ecc3b26d438d2260236b77c
MD5 72358550d6c31363bed6ad38e15e144d
SHA1 f4e7eed8c1081488410aa58f5f787ff144170e44
SHA512 e356f909780ad4d655a68536128438fa7d01bfb2daa24a6e522ed475b44fb335066d686353d52d5da9f4de15390632b9fc73b51aa8229e4516346d72824e2d87
TLSH
T1C87181F4090B8B62EF73833AE5D2128471BEC5D8F9835F5E51E00B3D2088FA1CA79526
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 47a87c31debb6e01c9f574f60b48e71fd4ed4bcb24e7bed7db1e5e92ed0f3b28
MD5 23c347e03271aa19a3316b6459dc1df7
SHA1 a93ec6a8c2eb86547195d3820f05f937e86ffb81
SHA512 f0b80b5c1b37e8282418d659b9b436ba23f2140e21a79225fa7752d52810d57ad1e45ab674474aeed936cf8c3a98cde22bacbeebf79a0a531dbe7e496f07faa8
TLSH
T10A116AF383E5C5AE8A0156F05A24AE2BCE2D0606832C7C1989D4EF27D3E3465E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d70580103759fbbf3df182a8e8debbd90091de571e2e599d53217907a240cb16
MD5 1c48a12f8e90dcd151d3ce6449003b6a
SHA1 6f0298b292f5d5f678bab7e35e0e9c1b420a6038
SHA512 3b5c9e44d72ee88f4f56ddb3779c272cc94b4560fea60a43acb78da07feda1e178f455cca018dc26cc15d23c0accb725ffa67e58220cb6889f3c4aeea3bd0ed6
SSDEEP 192:sxZBRbyM/jK1Ml8UQokO/fQsBBd3QIdp8p4HW6+WN6rA/YCH2rV+ibIg5/J:sxZB5qLO/fQsBBd3xjHb1/4Vrzr
TLSH
T12B52D751BA349A77CCDBE209F951BF53E6F5447291940E44AEFCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f850ee2ddd0f780cbe887ec36ecb0a77cc253b2342a39e0a22f6267cd55d12de
MD5 e4f6e579ed34046b9b83687dac2a8f10
SHA1 58e667393b38fde34db2c4b6a850a0e6e2639297
SHA512 93ca5f61f45d6fa877c3bc5c479bada64d5c3c319ca9082f1528d549b348dc824581a56fe339467c77c0f71471853a70bf9cd28747fbc4fdeeefa089998e8b08
SSDEEP 192:sxZBRbyM/jK1Ml8MkO/fQsaBdTQIdpOp4HW6+WN6rA/YCTtrV+ibIgrJ:sxZB5MO/fQsaBdTxpHb1/VVrz9
TLSH
T1B442E911BA34A977CCCBE209F955BF53D6F90572D2940E44AEFC9A1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 05e60cafab7fe34a7a4254a89675523917265bd31d0b7722e748c730f65257ff
MD5 dd3f4b33bafb6c270b8adb0b2fa26680
SHA1 6dc7e82b134d87ff7a6b7894e4fadb8c389f1551
SHA512 cc162337c35879f9a5f1bbe8851d25b7efedbfca8c5ccc4bda0920ed4a344f22af387a95473ee22b1a73a464b3159d381c8c78335155f025775c4eb6a95d7023
SSDEEP 768:s98bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVbro9:s98bqn+WvSCt6u1jaCZLbWVo9
TLSH
T170D20A3B280CCB7E4F845E5DEC266F966ED801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e7f4545-e913-4874-aac2-e8f74a72e2bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6e7f4545-e913-4874-aac2-e8f74a72e2bd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f9508392ee1787a7d08f32c95efc5d0586e9aa605b83bd0ec37a8fea075074f8
MD5 e5f29abb0a0bd452fc953a3412fe651e
SHA1 12c7136e00bc7c726f2804c267741f1aada7bcfc
SHA512 43d5e547fb7754140c93b85df5f029f1f9ac9f4c30aa75b37de63d02e70f4969562bea0fd1b90f0aeb19dd180b0f45efdc4f1f93fa3ffb13c43e58458a54ab2a
SSDEEP 384:EZcIhsNbUJ3UCVLCEa+9O5n/enOOPrXLpe8C/zB+:ihx1paMO5n/IOi9PU+
TLSH
T1D2928D32B9786C676DE2B685F88636079FF84073E6C82B94E5ED9F0C04DA5581307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4b97335fb31a9e32b93430bb792e3dbeeba598ac433b3e5bf1f3e859ba4189b5
MD5 f38ef1c7d204bf28b4fc4c93b3871544
SHA1 24fc077714ef60e8f74fedb15ae0336cb0dc66ca
SHA512 d1a800cd0f0888e8ff3c2c0f2248b00b145bb84eff12d7747d2e230a179c9260a4c93cc0b927a18dc5333077c00f978643eff5046d6fcf75a45d648433aa19d8
SSDEEP 192:vONa6Db6QmiUyvXHBa+jpOmZvxRg/JFU6:vONa6uCHBa+9OZ/vU6
TLSH
T14702F83569786CBB9EE26E49F88727279FE4103BD9962B50DAD85F0C00D764C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 805b58a9cd0fdbd94a679fb7c1914cbb58c3253ee2564f77f161160865a90aaa
MD5 7cbdc7f4921f61adad2757215be1a5af
SHA1 8db1ce854d4992e6aa25ff7d23c758d84ab5d208
SHA512 f7fead48352b8c92cf2de4963a3bae67cd4aad8073cf0582c0cf00f6c246344b3892980033b8c0e2854f779f752feca6f16b8d0b2427a605377b47192374426d
SSDEEP 384:oZcIhsNbUo3UCVLCEa+9O5n/enOOPrXLpe8C/zB+:Whw1paMO5n/IOi9PU+
TLSH
T114929D72B978AC676DF2B685F88636079FF84073E6C82B94E5ED9F0C04DA5581307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8b87ea1369137fd0fb9f1658e626c7c6e6bb973bac2e6418017b3689fd85b3cc
MD5 fb962580e478a0e9f9efe29fd8cb54e3
SHA1 b5d555f5d89c292413f39eacc6d5a97c487b7d93
SHA512 5c5a3363c5186dbd95b4c37c4ff0a25ac8b872158586e34aae0041c2c17fe8be6ac5e34feb2277d4f79eb87e69e7b5e2efe516887d65d18c27a6aadeef579754
SSDEEP 384:eiFiZcI4sNw8TUNTUlIlo3UCVQCEa+9O5w/enOOPrXLpe8C/zB+:1FQ4Vwg+epaMO5w/IOi9PU+
TLSH
T131D219F258EB9876EDAD9B47E77D2E038EBCC063B5845650B7989A0CCC9617FC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 81cfe9c4ada664c06981ac46dd1b2222957fa5583dbb44246224b8a3cec5cff9
MD5 60fdf7d3c6297376020bebd42af16253
SHA1 15e63992f8c6f5a8206141d4957d2cc6caa71b84
SHA512 f4a778b2207fc8e098c63e5b5ae54b189dbd57e3ce3db39c2f933451317bc2f1b759eebc5849f0d78935fead5669c50550ff540eb8440a87dc9dd6685073ccdf
SSDEEP 192:YON56DbLQmiUyWXeBa+jpOmZv63Nz/vqDnU6:YON56V/eBa+9O5R/enU6
TLSH
T195122A3679789C775DE27584F88736139EE44067DA8A7B90D5DD1F0C00DB99C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9602a0b6b2df676f5e6619ceea4fa76b230d9fd1742c3dcefe8eca54652924ba
MD5 3a705ef005035184549cb63ffd20bdb1
SHA1 63cf6eea8ab43067626b7b8feb19b32d671f8253
SHA512 58e3a62c3ceba922c1335c35036481b46f36c0aead31236a520f78e32428c7fb5fea13955cc1b3e8713f530a38d17afe35da738485e2c65de1534453cc539de7
TLSH
T11D411A58AAFE1154B3B76F1A9BF2A86D487A79672E06E45E00110D4E0633B40C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download