hxxp://www[.]www[.]armacell[.]fr

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/05/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.www.armacell.fr
Sample260508-b75ccscw4x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_435063906\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_545537515\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_1598471897\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_545537515\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_545537515\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_1598471897\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2044_1863548336\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\mn\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2044_735361346\_locales\cs\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5012	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226785007630335"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{ACA799F0-00D1-47F6-B26C-AA1A6FB63490}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5136	msedge.exe
5136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4860	2044	msedge.exe	82
PID 2044 wrote to memory of 5012	2044	msedge.exe	83
PID 2044 wrote to memory of 552	2044	msedge.exe	84
PID 2044 wrote to memory of 552	2044	msedge.exe	84
PID 2044 wrote to memory of 552	2044	msedge.exe	84
PID 2044 wrote to memory of 3592	2044	msedge.exe	85
PID 2044 wrote to memory of 3592	2044	msedge.exe	85
PID 2044 wrote to memory of 5944	2044	msedge.exe	86
PID 2044 wrote to memory of 5944	2044	msedge.exe	86
PID 2044 wrote to memory of 5944	2044	msedge.exe	86
PID 2044 wrote to memory of 4396	2044	msedge.exe	87
PID 2044 wrote to memory of 4396	2044	msedge.exe	87
PID 2044 wrote to memory of 4396	2044	msedge.exe	87
PID 2044 wrote to memory of 5788	2044	msedge.exe	92
PID 2044 wrote to memory of 5788	2044	msedge.exe	92
PID 2044 wrote to memory of 5788	2044	msedge.exe	92
PID 2044 wrote to memory of 5328	2044	msedge.exe	93
PID 2044 wrote to memory of 5328	2044	msedge.exe	93
PID 2044 wrote to memory of 2680	2044	msedge.exe	94
PID 2044 wrote to memory of 2680	2044	msedge.exe	94
PID 2044 wrote to memory of 2568	2044	msedge.exe	96
PID 2044 wrote to memory of 1412	2044	msedge.exe	107
PID 2044 wrote to memory of 4228	2044	msedge.exe	108
PID 2044 wrote to memory of 3100	2044	msedge.exe	109
PID 2044 wrote to memory of 5268	2044	msedge.exe	110
PID 2044 wrote to memory of 5268	2044	msedge.exe	110
PID 2044 wrote to memory of 5020	2044	msedge.exe	111
PID 2044 wrote to memory of 5020	2044	msedge.exe	111
PID 2044 wrote to memory of 5232	2044	msedge.exe	112
PID 2044 wrote to memory of 5232	2044	msedge.exe	112
PID 2044 wrote to memory of 628	2044	msedge.exe	114
PID 2044 wrote to memory of 628	2044	msedge.exe	114
PID 2044 wrote to memory of 728	2044	msedge.exe	115
PID 2044 wrote to memory of 728	2044	msedge.exe	115
PID 2044 wrote to memory of 5136	2044	msedge.exe	116
PID 2044 wrote to memory of 644	2044	msedge.exe	117
PID 2044 wrote to memory of 644	2044	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.www.armacell.fr
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffbe4b0c188,0x7ffbe4b0c194,0x7ffbe4b0c1a0
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,12443540230098062025,12614049182850953715,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,13937157984500532293,6656074622651805784,262144 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,8027028904737233969,3782704994023892449,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6743393740822427687,17540612478410067258,2097152 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,18222513894499949564,2566067738174307121,2097152 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,15020062094274918276,12883485102287473526,2097152 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,1454949275474837242,31676727048222032,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,15226609893829786596,15919833749646103563,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10661226997641176018,15682435565367723454,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10661226997641176018,15682435565367723454,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,16926500367206406394,7570923500361759660,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,5113437129411978825,11142616361939764002,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,9213805936509194530,10097382700941005754,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,10264893188971941451,11738130155189554874,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,5381682188169693446,1271798375962434544,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,6207266450068903150,2392110705694190199,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,14533577367450237788,2983494021029809065,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,5355106047244506407,4160712291494148073,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5272,i,5953406223483744375,14470312425567842729,262144 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,16257093107753896645,9333696945720619087,524288 --field-trial-handle=2768,i,15048746521976495055,9970245923676836048,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40a64a56a478a0fd099a66c59798b6e279b6b7a22b9c8f9d0e45f56135026fa1
MD5 032db306dcef8996b2e04b1c5fb92915
SHA1 02e99bb7c04d80a0b1c444a4a3141092712f9615
SHA512 12a489ea13d1adccd0f85ea48f28ceabf79d50bb27aa46f0f1f6549e12735380b43d6896a6cf0d0fe25fa658a6b4710cab9bb1e977ad5ee1195bab21537d0a4a
TLSH
T1B7D0806C15715C35CCD66970059577293736C862AD5397561877243C0CC345119AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 52fdcf4985a2137e887568ba0ad9acbaf2386bfcecb47ed9c68abd471d20d132
MD5 ebc32b1cd1361148a45d63cdaefa8b6a
SHA1 1a535bd3689ebc4e1112df00c58aaec640450bd9
SHA512 4c15e6978f9c2587986d5403792156a8b116fa846c6a24a24190f3ecb824d6ebfe12314da70e0dec9dd6b12af68c8d2a603fad6d68c5b8e0a2ada102b60a3897
TLSH
T11CE022AFC9209C3718FD076C74540B09EB54131B2B81D94F363C961D8FB463A87D286C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9cced420654ae5e4a6f6e10f0714c9d84a479957c2c355c54068eb0c778d9c4e
MD5 d4402b619a7ec1ce2f711b03fa144fe9
SHA1 d344d2a45fd4154867cedfc376ad8cca9e6d9dd7
SHA512 eaec7b4f6d9bf3b58dd73acc3df9aefba1346985f79232815af7df8582fbb22eb95c428da567f8473859c41d7ad9d44b55f127d99d92091aad9be5259c49e45a
TLSH
T14C810B41645AB015EBDF8D756AEB758CB17C958CA0472F1A65E0C63CEA32F6F41C053C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5874be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5874be.TMP
Size 3KB
SHA256 a140c830d6f1b893fb783776cabb657b0b5252b493e918d290b14d41ee8ce3a6
MD5 3097d7134fb5b57142bc475f4fa85dd4
SHA1 a7f59ca3376dfee4838dc54f7c70e6b1d02e761e
SHA512 5e89c5d1fe47d151276da2cd55628e42b3b42d300a3793cc8b90022fdcd15c24b3ad3621140e0ef1247fb68a13a647856ac5afc4a7d0d9cf8c00ab3e7503bf61
TLSH
T1357108802959B429EBDB9D746AE3758CF27C548C60472F5A62E0CA3CEA32F5F40C063C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 51eaa571532ce4534f0c7237765c18c72145ccab268a70657855d585712740cb
MD5 2b7dabcc231ad276c21649b7b8a25012
SHA1 6278b8de995101e36a6bd3b2cfc60b85f5491eaf
SHA512 f41b11d7cf7d085db6afa8b6a4b9ba2895084a9e42fb0c8f2730d24ad8e588d163e8db7f2c05ccd6fc1d5cde55d2296768999fb0f949083d318241b40a283194
TLSH
T15F71ABF3C3E4CA6DC91191F0AB292F2BCE6A0924536C795F85E4AF1BD3E2461E14194E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 750beeaa2d6fbcc6dbc5437b1d438c103df653535b116fc28b618611946a7acb
MD5 0ce8ca6a2ce913f373fd13d0f8db6cc9
SHA1 ac9e98d0a35b282c058940fcc7c30b8204c0850c
SHA512 b865c62a6d5484e65d0ca2c82a82a187c313f72066e8c22c54ab93b3ebc5f8b885f6764b6b6409713cb960e289242c5b80f295f207bb7cbe6beb611535cf497e
SSDEEP 192:sxZIkRUyMqZ/K1Ml8UQLkC/fU/sdUqHpqZP/cyXzodpIuHW6+WNeZV/5SfL2DtUw:sxZLhqgC/fUs2qUNSrHbK/6ZtJw
TLSH
T17072F817AA3849778CD7D219FA45BB53D6F91523D2840E489AFC8F0C14E7ADD620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 220e63e5ec641c88f0917dd5e80c02c235a92169861d575db28656f371310a77
MD5 3a9e217aaaa4f001bab86b18dd45f6d0
SHA1 cfd705903c9a3450b0b4cbd368c81fc40530f113
SHA512 d64b419f098c8717c09a838aad2c7bf8f2af6a0327b2ae8e556fd7f932b6a3908dbdcfca9a225ff3185ed4307be63cc83cc27815dea5276151f8bc3aa14c2c2a
SSDEEP 192:sxZIkRUyMqZ/K1Ml8MkC/fU/sfcHpqZP/cyXzodpIuHW6+WNeZV/5SfL2DtU/B8p:sxZLhMC/fUsfcUNSrHbK/6xjE
TLSH
T18D72F8066A38597B8CD7D219FA45BF63D6F91523D2944E489AFC8B0C04E7EDD620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1261209b35aadebaed68b2d5831a73d17bdb303844cdc0f960e6072b2acc3b31
MD5 80798d90306ffc933a380798c8edd2a9
SHA1 b4eed4641c48f811e39b67b4442f3ecc7d5303f9
SHA512 0ef54d8673a858209a071dcde6bff4fb1b3787cc6e871d3f3ccd64b53a9d0823477b3e6b9c1f48c1ecb7e45daccd420c30b487307441f445ca88af6abbae1868
SSDEEP 768:wsk8n557pLuL/PvWvP5OF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLI/eLlkqHdvroc:wsk8n5PE/PvWvP5OFu1jaiI/eLiId8yj
TLSH
T1C1F2FB3B280CCB7E4F800E9CDC2A7E9E6DE802CF96D8895447E9984C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 50f977b22a7d5dcf92694d3b8947176deab2926910c530cc0558baf5e9833713
MD5 d2df9ec73d42d0f902672ea38eff66ff
SHA1 477fbbcf0e4b8df1c02a4e93d119239b66dd9066
SHA512 84b2eab3ff29661a55bab81d09bc61b533c0bcf3125a752295e1c36f39485a435ce34182d90e716e09f5458138eefff3ab30ad34b1bfcde9680edeae489dcd05
SSDEEP 96:KcKoKziqGxeK6wyKawKfKAtKKOwSqSYKDCE9+KOAauVOK+0ZwQKpK+KKEKzCssAe:eflBf6532xxBzXcn5H3POrXQ53N
TLSH
T100A23751713A12913A7EB9CA9595B91E52C331737018E83B7BB900A64F6BE20CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4d6af22bd070b27c7f400384af9ee53d6ad3d66efde2f8095fd31b813b19b108
MD5 548ea692105c30281437ce55432e19ae
SHA1 1191613d9184f53e0aa0067e5471daea1faaf361
SHA512 3306e2cd0f0edf5641e5a5a3afb6c89fecf599389d01355a60d5bf39169af39dd05a76f654a697b23db5d0832d2f26c18900797c5ef18f0da9a61c87789c25a8
SSDEEP 768:YFccpc3nwg74AYYYNODtO+0IhkoFYS/NKm:Qc3t4agTIhkoaq3
TLSH
T1A9C25B36E8A8CAA7EDE64FD6F75A7A07DEE00067858C99D8C9D91D0D00DB1DD134B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 88d7d362ce8859d5a25fdf36c832c43b88cf3110e899dcbd5b34f8da0ba4c830
MD5 aca491f66082de1ebaa2195f97ce978d
SHA1 f2073bd3575c648c22e2920782aecf54237f9073
SHA512 e1e338a43f9e661610e6867695afa65c2c0f6b0516690105e48820367c694fc214db705e8a57dbcfd6292f99be66dac435a40a7d977d007c375522b814a707c0
SSDEEP 768:pFccpp3nwg74APYYNODtOf0IhkoFYS/NKm:dp3t4JgsIhkoaq3
TLSH
T1FEE2B2F598DB8977E9AE4B87A77D6E029ABCC053B5884994F7C50D0CCC861BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3c29cb86249456d5a5ec2c3775caaa300f0aac841439ade22b1c986c9d3c365b
MD5 9680c94322fa7cc0c82339270b46a26e
SHA1 9a9c9855933b36520d948d618c4403b4ece518a6
SHA512 0d2646f0d24ecb2369125defe6e72773416cfdcda32b111a889e98cdb6d8a8c141763f8050cb0d3fc4d11fd89ffc443990b565e55a927c314fa4e73042da914a
SSDEEP 768:QFccpc3nwg74AVYYNODtO+0IhkoFYS/NKm:4c3t4XgTIhkoaq3
TLSH
T107C26B36E8A8CEA7EDE64FD6F74A7A07DEE00067858C99D8C9D91D0D00DB1DD134B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 31215a5e573a6981c3bf1fd15a92d4a5dc7d4b01bd4f4238e0e6dba6b9aeb2fa
MD5 74e01f2e3f1dd8edc7b6b13326071de2
SHA1 beb4a740ae14760a0eb5f8fe2df7a26cf14a6b97
SHA512 b684ecd259a61fe71a074b7808156d38caf0a2e80b608080f532e0c5a8bb5626baeaac9a661987ddeee7ecb5b37c362cb0e1e1de82ab03fbb45487d6f6a3c3d9
SSDEEP 384:nmiFavqMg3sNM8TUNTUlImkrqOABAp2VTvf7YNilDj07cRYV/Vw1mRxdUQrN1k+Y:NFayv3xwgRSpYNODj07cRYk1mFFu
TLSH
T142C24B35E858DDBBEEE64FD9E7497A07DFE000ABC59C4AD8D9D41E0E009719E134B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2417bff498783121327b091347a6146714c2f639de88cdcd81f9638741538e06
MD5 34ca6ede0d4391d5ff343547e567b1aa
SHA1 b80b16557c56d0abe9ca104bf0131c4655e9b544
SHA512 7b6f738e5b14d42ac5a8f1edf7f9078de065ad2c38be12bbab75f4750ec8f40b9373f6c4a263f042d32d503577367cb29fae427fcb6686a73a9d8e949ce37008
SSDEEP 384:n/iFavqMg3sNe8TUNTUlImkrqOABAWqjTvf7YNilDtO9308lRYV/Vw1mRxdUQrNw:KFayv33wgRLrYNODtO10IRYk1mFFu
TLSH
T1E4C24B36E858DDABEEE64FD9F7497A07DEE04167C58C4AD8D9D81E0D00DB19E130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b93c3edcf15a7a4d6e8aeeb4e0421bf9cb8fb114b3385fee5c7f9d96126557cd
MD5 57d2e3eb0048deb027c02104f5ca8bc0
SHA1 d5ec94fa1ab32784ddf5a29a9b38aabab9266c2c
SHA512 88c97d9985d099e0269ae98079d446a0121c4a73495baf0ea2cc2af857d3de6fc940730faa8817e5751643aa2eb297e18315a045b9b9f5ea68980e2d3b945ac1
TLSH
T10F412FE15C3E2AD1D4FE0A6E64A738FC95D8C72AF4B4707D6864DE98073960E644443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ba42e57dd0cb05403c94224757e144a0ae72237c8b047b9b988367f319892a3
MD5 ee8a569d113c36a9eb6ffb7a9951f409
SHA1 8a23ddcb915b9160112f3f9b0c20d8c2ac99f673
SHA512 5566a53767938c8c5e8fae05b4f19ee626c0ecf8ec22ac1fe4578bf3c7be3806085e46ccc3d2eebf3e2cafc1939375fe85e71ff75cb40caa8fd86af59bf00cfc
TLSH
T144412FE15C3E2AD1D0BD0A6E74AB38FC95D8C72AF9A4703D2854D998473960E654443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5a011292de77df36ca4eab3d8af6b74ff4ec657489f6d4c3e0e23c843bafe91
MD5 6f6d9e0f0b367099952987947cc556ad
SHA1 5ea527622a6bd38f21c0e9b64a2397cf65a9df13
SHA512 e20b2d27d6ed1d366e3b3c97f88c2b41be58e69c119ff2e58265301d9c2d2a4c61a1eeb728c068627066b685a705b6a51543ec66973d5422c80792bacbd355ce
TLSH
T1DD41F758B6F92148B3B77F5AABF6A46D987EB8372F06C45E00110E4F4A22A45CC61737
MD5 SHA1 SHA512 TLSH

Submit Download