hxxp://www[.]objectif-prevention[.]fr

Analysis

user interaction
yes
max time kernel
32s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.objectif-prevention.fr
Sample260706-th3fkshv6z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278274749690714"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{3D58ED5C-C568-4FD0-B29D-1E4095B252B1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{5122AC4A-0CC5-4CCA-A93E-7305102C9503}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4948	4240	msedge.exe	84
PID 4240 wrote to memory of 704	4240	msedge.exe	85
PID 4240 wrote to memory of 412	4240	msedge.exe	86
PID 4240 wrote to memory of 412	4240	msedge.exe	86
PID 4240 wrote to memory of 4680	4240	msedge.exe	87
PID 4240 wrote to memory of 4680	4240	msedge.exe	87
PID 4240 wrote to memory of 4680	4240	msedge.exe	87
PID 4240 wrote to memory of 1512	4240	msedge.exe	88
PID 4240 wrote to memory of 3312	4240	msedge.exe	89
PID 4240 wrote to memory of 1512	4240	msedge.exe	88
PID 4240 wrote to memory of 1512	4240	msedge.exe	88
PID 4240 wrote to memory of 3312	4240	msedge.exe	89
PID 4240 wrote to memory of 3312	4240	msedge.exe	89
PID 4240 wrote to memory of 4908	4240	msedge.exe	91
PID 4240 wrote to memory of 4908	4240	msedge.exe	91
PID 4240 wrote to memory of 4908	4240	msedge.exe	91
PID 4240 wrote to memory of 5028	4240	msedge.exe	92
PID 4240 wrote to memory of 5028	4240	msedge.exe	92
PID 4240 wrote to memory of 5028	4240	msedge.exe	92
PID 4240 wrote to memory of 3224	4240	msedge.exe	96
PID 4240 wrote to memory of 3224	4240	msedge.exe	96
PID 4240 wrote to memory of 3224	4240	msedge.exe	96
PID 4240 wrote to memory of 3768	4240	msedge.exe	98
PID 4240 wrote to memory of 4608	4240	msedge.exe	99
PID 4240 wrote to memory of 3768	4240	msedge.exe	98
PID 4240 wrote to memory of 4608	4240	msedge.exe	99
PID 4240 wrote to memory of 4188	4240	msedge.exe	101
PID 4240 wrote to memory of 2520	4240	msedge.exe	102
PID 4240 wrote to memory of 3036	4240	msedge.exe	103
PID 4240 wrote to memory of 2520	4240	msedge.exe	102
PID 4240 wrote to memory of 4912	4240	msedge.exe	105
PID 4240 wrote to memory of 4912	4240	msedge.exe	105
PID 4240 wrote to memory of 4912	4240	msedge.exe	105
PID 4240 wrote to memory of 1464	4240	msedge.exe	106
PID 4240 wrote to memory of 1464	4240	msedge.exe	106
PID 4240 wrote to memory of 1464	4240	msedge.exe	106
PID 4240 wrote to memory of 4512	4240	msedge.exe	110
PID 4240 wrote to memory of 4788	4240	msedge.exe	111
PID 4240 wrote to memory of 3268	4240	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.objectif-prevention.fr
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe3965c188,0x7ffe3965c194,0x7ffe3965c1a0
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11648467724157816873,11963135934808096304,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - System Time Discovery
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,7540998414143546476,9895052021237738365,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2272041408105184361,5285903357324648676,262144 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,3411057621410584342,16797640337815214167,2097152 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,1162738975974834370,10972732140549160594,2097152 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,17185013805508495596,7452254244621358244,2097152 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,5328998325628281456,7155545076310796994,2097152 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,13238840464640865237,705176511051062732,2097152 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5686334489890348032,9747795289819244382,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,1921501289191951401,11184960062551354344,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,16056775194099624500,5461513584079974101,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,16056775194099624500,5461513584079974101,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14202345691688753891,2214111213749757444,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,11346184756033392901,5456608798495290748,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6504,i,13964316605532826643,10166700267106742575,2097152 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5172,i,17864289167203905976,220088137426480371,2097152 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,15466331967132351030,8353439968923383856,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,14263271427967828109,18139770304655835406,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,811243085194460829,6572429147293951307,524288 --field-trial-handle=2488,i,10943420025373980293,10163911957114839557,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 57KB
SHA256 6303475cdd19a7c08d011c6c6862e3789b39f95797602963a78cac17ff73d1e5
MD5 73fe08c0771b0b44243114c8ea8b86bf
SHA1 03015c3d3ea5bb634dd29a50623a6147d206dc0c
SHA512 f4fe1b7b7562c4f1187ca0621ff4006be0fad055e41d772a1ff4a421eb0d18794e3c21dad72cc469b889c6ed9642616ab9c8b5bd27d87d8fb5b8f228c96407d6
SSDEEP 1536:5HBwP9e8JdgrDq3W2leMPq1AOFgHDU3kQj2W:5hc7grO47C9Du
TLSH
T1284302CFF0D8C6FE215052556E6E7628C261891FEB118DB2443F2FB2999D04172FBAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed4f608e8368042ad6ce812146a5a6fbcc61b3b2f7492ab6cfbdafd0fe9d4cd4
MD5 937260ddc8476996dd30627162ee929d
SHA1 b3560adc1bfcc53cc3047bc61cffb8088e45181b
SHA512 fadf3b76a495c7524013d2afdd7eab01ea1cd930462af8361a31837b9d7a99ba08c2d4a1ffcfff89946bc89353864d928f187251aaa0b9fdb5ada997d1597291
SSDEEP 192:sxZoRm3yM/jK1Ml8MkC/fEsOq9GLIVoIdpmgHW6+WNFuT/Yvz+jz1Ig/3J:sxZowTMC/fEsvcL2zHba/NNh
TLSH
T19252D812AA349A77CCDBD209FA51BF53D6F5146293900E44AEFC8A0C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b901250bedd11973b2441d170271f25bb6a81ea27a76ff237ea1a1b95ec21a4a
MD5 8d170960d66fbd388f6a47e924cc3ebe
SHA1 40a8f7e4ae66971ce7309dd45e50525d7228e1f6
SHA512 6803c6cdf7daa959dc878d85a8f25a4518c6c7011d1cefe6f3d92158c8d17b85dce0675124200e1dcaf013b96708a439ae069a081731c1a91b9e085914a86bc3
SSDEEP 768:dFseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppAro5C:dFseJ3xWvhfwnu1jaVcL88pLM
TLSH
T117E2FB2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fef9e43850312f170adc6bd34b98e309452c8ad0496e64226c911ba928225e92
MD5 9ff91ed46808e78e28f2c50c11610f33
SHA1 780b29ab663db4b774adb1968c64f49242c361db
SHA512 b1d28b058e42bc637f70548af1fe91c3e59232a2006ead835668ce3f34d64381da61a9d9752c6ecd4749c8e8918df7f8b83f2492c95dd309f10c3125170f392a
SSDEEP 48:KYHIhKggkXyFjIBKEYcXyBuIXKTagMyX+SkEN:KYH+Kggm2jGKEYGCusKTaZyX+SkEN
TLSH
T166912357343F0202387D244CA6A5A9369E8271A37454A4FFBBB844A24F27E214EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 98B
SHA256 25594db8da2b373f98fd254ee64eb1bd4bb383359089664c001f98c95bc92d65
MD5 8555a076103ab783b6ad880f760d48f1
SHA1 8a3c8a3c453e751efd4d8e149f4aeba18d86126a
SHA512 606de960f339bfa695d070db8ecc792729431b10c7719e338a98a2deaec11aaf83927f73a95241a6297d22599475762b0f8d62ec301b60e9906eda726b11b65f
TLSH
T1BAB012F3898040BE9A305DE53020F20CF007404C8DC0CDF88C0480437278A3700018C2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 179B
SHA256 3a32a231639a5bf369d6251cb623c7ad641dd4a0937a9d09375413bf3ba06344
MD5 3013db5c06c9100b1573870bbe834143
SHA1 ebd3bcb316b8e7bb1ba6791f042016b905049bbd
SHA512 75cff295ebe4470199de21a52f998034d7f0a6608971a2c1acd577e8a8e675ea7ae4b93891bf8fde697b9db2826f7940f116e4f9a455da7336ba5af47280cdf9
TLSH
T1B8C080E3455002DF477069E57024710DF5474C1C8DC1CDEC5D057043317492744059D5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 256B
SHA256 7b55d447275fd61837d333f5aab9f907554eb284d2bae734482863306866483f
MD5 8c2c33e3a772d88b7307ce041b85eee1
SHA1 064bd732dd1a5a08ee7104b7d21c4d26d86680fe
SHA512 02ebcce4f15f234272456949788ede5c25f28ddc2bc6d103d04c573c9efc4d228176536c1c4fad3abbc5537ca82503e45d61e20b5d1dc2f308313887d14fce36
TLSH
T1DAD05ED746A2869EA270AAA6B065B00DE5524D288D81D9DC8D48B15626B8A178402AF5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 172B
SHA256 edaa303a112f19e73bff75e38f3660bb80d695415d4a915c1ccd7fc6568f6cd6
MD5 ef5d1f82df9758042ed05ea38241ea8b
SHA1 245bd5a2a4eeaea7b1fa55c41a5c82127354540c
SHA512 17992a47a24f6d462d342f18ab8f998144d16b6e0973bd1dd9a890c5b4d40b12f538d3e80624adbefbeabf211166799a232efb2cd35622fa8473f5843d19e108
TLSH
T1FAC08CE7499042EF9670AEE97024B21DF907845C8DC2CDEC9D0440033678A274402AE6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe585530.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe585530.TMP
Size 182B
SHA256 dcab22ad25fc36690bacc49702b908754f201bee9c5067eabff1e9aba4fa3028
MD5 6efb4de551ea57d716f4c3fd8a45b044
SHA1 03f3c0fa060e075b1379f5f801b33090ec632b30
SHA512 02180a18a10e05494a892cc3ee185d2b5c8b845291c6105385ea736f6a1d3da87bcee1bcf0021b5ace8bd1c635da2c028efd7c5412454726480bf2235f23ac77
TLSH
T10AC012A796A151796A745A956121B18DE1175C489DC2DAF88D00F092B5B872280159A2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5def9cfe9a139893c83f9e4f09b4e9e43fb1f7d9070c4377b33003f87286d63f
MD5 3ae5e9293407e5f482819876ff6f1708
SHA1 ccc319b486726cfd42a9d87ef3304703e0cbe201
SHA512 b018fb1ea3250b0dd9d722c53d9e6cc4567ada6028b5696a08ce6345da4077bc601a78595e871f69bce069767105f773f44f0574d6678146673e4ee4cf5336b2
SSDEEP 192:uifsNprQbWM7nqGQmiU1Mjw4MThcC5KopU8z1fq1fR:/sNpr27qi4/I5KGVGfR
TLSH
T135420872AC689D3B9DA7E146F44A32039FB4816B97C46F90E5EC6F1D01DF1AC130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5fdbb3c56cd959ad71ef9c21ea73923f3a20a44f0b0209c432ea3a183147002c
MD5 5ddf52090e63cac42c8ef17bed5f6f9d
SHA1 c22df66359b4c0057fa658fc088e6837050ef176
SHA512 d809c67ea1ff2f93218c9dff591d2b567bcdd8ec377a5bde5712596bfe54d05c739fd71d8ad131aa2512224ee4bb18993ae4c755f7914b9e4249ed3c11c21c6a
SSDEEP 192:lONny6vMtPQmiUyafThThcC5KZ847JtU/u:lONny6UtRJTD5KhzU/u
TLSH
T1EA020875BC785C7BDAA3AD46F48E27171FF4516BA6905B40EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 431f2b874bf1db087da7f3461b401db1d2de302170e8c76ab13adb2bdb34c975
MD5 d37bfbca72ef12fea148f2f0b8140f51
SHA1 3fa01802c22ebbb136efcb3afdb0ad780dbd4dd2
SHA512 8cbceed34e346085721c4089655bdcb5b6fdcbddeb24933c2d3eac8ec9863d038d5e8acb1d1b633c5a9734591a72150e1d934ca883fad31e0660f908528d8949
SSDEEP 192:BONk6vMwPQmiUyJfdhThcC5KopX80Ifq1U/u:BONk6UwRkdD5KGIGU/u
TLSH
T1D5121A72BC689D6B9DA3B451F48A32071FB4826BE7849B50E9EC3F1C01DF56C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d73e787df04911a9ed89e38211b2f05211724c5f4b787b1590439c26ffa7c58
MD5 540dde17cb5bdc98a90236ba57a6b2ac
SHA1 ea88f842a90d6aa119222dd2cd0fcd6e3f3eab61
SHA512 00fbbc59593fcd44e6333fbc4e2be09ef163e3adf99a334d68aa9282ce2c56ff943a49965f176bb7d00020f4f9be36cdcf0d3716fa9fdca64ad2d3e48cea14fa
TLSH
T111E00203E700009AC014033000831F103EA2C06142D302864B30016C6C313407D50554
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588690.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588690.TMP
Size 392B
SHA256 590e04f9dcaf1906f65e5cd6f9f46c4f1745300b5f8c63632241b5fa091d7528
MD5 7990d4dbf5411bf6e79258ad48cb970e
SHA1 f5c5817a388c4fd8459941cf6fbd4cc8ec34f865
SHA512 2363b1c5f4a33de7ffe6b3681f48c3a7a65e304f6bd4eb129771ec39255fd8f3884d58ba2aa1ef2782d379a4cedf42b528c8443c1d86ae2a0baa6826c3bf2f52
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a4815fb508ef470094f56a8c4d7c8d989211212249829e5ddefff19c39b0356
MD5 63cf37edb121d0c43b9df5c1425366e9
SHA1 0aeb9789bc03bb2419f6cb4eff29ecac26b1a698
SHA512 0e0b79cac2e9de7a75c7c43703b30d3ab13072891222d259582aa99296b67162f4b09f880194619960cad3c20aac0cee85fdc04dd62deaa44dd127bdb628e365
TLSH
T1DD411658A6E91148B3B36E1AABF2A8AD447F78772F06D05E10110D8F0622A40D9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads