hxxp://www[.]orleansactu[.]fr

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.orleansactu.fr
Sample260717-sd558sdz2j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1624	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287741032642168"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{5EF4DF3C-DB9C-4D85-94E5-90B62BC09967}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2616	4200	msedge.exe	84
PID 4200 wrote to memory of 1624	4200	msedge.exe	85
PID 4200 wrote to memory of 2736	4200	msedge.exe	86
PID 4200 wrote to memory of 2736	4200	msedge.exe	86
PID 4200 wrote to memory of 2736	4200	msedge.exe	86
PID 4200 wrote to memory of 2524	4200	msedge.exe	87
PID 4200 wrote to memory of 2524	4200	msedge.exe	87
PID 4200 wrote to memory of 4792	4200	msedge.exe	89
PID 4200 wrote to memory of 4792	4200	msedge.exe	89
PID 4200 wrote to memory of 4792	4200	msedge.exe	89
PID 4200 wrote to memory of 4160	4200	msedge.exe	90
PID 4200 wrote to memory of 4160	4200	msedge.exe	90
PID 4200 wrote to memory of 4160	4200	msedge.exe	90
PID 4200 wrote to memory of 4912	4200	msedge.exe	91
PID 4200 wrote to memory of 4912	4200	msedge.exe	91
PID 4200 wrote to memory of 4912	4200	msedge.exe	91
PID 4200 wrote to memory of 4636	4200	msedge.exe	92
PID 4200 wrote to memory of 4636	4200	msedge.exe	92
PID 4200 wrote to memory of 4636	4200	msedge.exe	92
PID 4200 wrote to memory of 4148	4200	msedge.exe	95
PID 4200 wrote to memory of 4148	4200	msedge.exe	95
PID 4200 wrote to memory of 4148	4200	msedge.exe	95
PID 4200 wrote to memory of 3368	4200	msedge.exe	97
PID 4200 wrote to memory of 3368	4200	msedge.exe	97
PID 4200 wrote to memory of 2784	4200	msedge.exe	98
PID 4200 wrote to memory of 2784	4200	msedge.exe	98
PID 4200 wrote to memory of 732	4200	msedge.exe	100
PID 4200 wrote to memory of 4788	4200	msedge.exe	109
PID 4200 wrote to memory of 4744	4200	msedge.exe	110
PID 4200 wrote to memory of 2652	4200	msedge.exe	111
PID 4200 wrote to memory of 3520	4200	msedge.exe	113
PID 4200 wrote to memory of 3520	4200	msedge.exe	113
PID 4200 wrote to memory of 2604	4200	msedge.exe	115
PID 4200 wrote to memory of 2604	4200	msedge.exe	115
PID 4200 wrote to memory of 1296	4200	msedge.exe	117
PID 4200 wrote to memory of 1296	4200	msedge.exe	117
PID 4200 wrote to memory of 1296	4200	msedge.exe	117
PID 4200 wrote to memory of 1520	4200	msedge.exe	118
PID 4200 wrote to memory of 1520	4200	msedge.exe	118
PID 4200 wrote to memory of 1520	4200	msedge.exe	118
PID 4200 wrote to memory of 4012	4200	msedge.exe	119
PID 4200 wrote to memory of 4012	4200	msedge.exe	119
PID 4200 wrote to memory of 4012	4200	msedge.exe	119
PID 4200 wrote to memory of 1756	4200	msedge.exe	120
PID 4200 wrote to memory of 1756	4200	msedge.exe	120
PID 4200 wrote to memory of 1756	4200	msedge.exe	120
PID 4200 wrote to memory of 3236	4200	msedge.exe	121
PID 4200 wrote to memory of 3236	4200	msedge.exe	121
PID 4200 wrote to memory of 3236	4200	msedge.exe	121
PID 4200 wrote to memory of 2380	4200	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.orleansactu.fr
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8bba5c188,0x7ff8bba5c194,0x7ff8bba5c1a0
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,5400386572589044482,17829460538462278375,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1359345009492979476,1843086051017583630,262144 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,14805526253025319821,10247817067611928120,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2389783659868420443,14882710509724580781,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4616310496929588714,11806634173746862765,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,2586297876858058907,15887733164919887622,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,517894869967174490,9037596642001241401,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,18340172727091369128,4222743082260368917,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,3749545628928836327,7113338927973245377,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,15421498660677475099,15272619617374492348,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,3916059327897414838,17037430234417287886,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,3916059327897414838,17037430234417287886,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,482522312362618028,9765693004195580948,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,3652970743644534918,2421239128398008296,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,16871778074981075077,4305847382502350903,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6141640546335127007,16001373576048153182,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,482994436134223530,2905460813432163009,524288 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5296,i,13982524810449177321,14797428085196603991,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6412,i,15125095430528194786,10755925985472897141,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6504,i,11425468256053209226,2062530577447107605,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6624,i,3560912161727957052,7074755783446631712,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6752,i,3626452340402163928,10448871647673420072,2097152 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6764,i,17643574133365540753,13834489666692076945,262144 --field-trial-handle=2236,i,11961811949462814134,10477404897878081887,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6d55c45943c8df4ac26b6527350c887786bc3eae597e7b5c6b5ba0f46ef95c2b
MD5 f3b459e07a67c43a853f5dc5ed0cef85
SHA1 62386afc4e7093df6eb0c339657092275b44948a
SHA512 e00ce41260d79889436799b82ec3d636c4052cda4d41034b8eba1c3acb88480ef5ff8fbfadc17107b793b374590ba9fbcd3d89fd23f58ba5164adaa75b8904e9
SSDEEP 96:4cs0LdaKFpB4rnyYDUDBko74aIWN/C7LON2drauNfqTpYWwnNN9naOizMj9g9kAF:XYnoyama9wRfx2u0
TLSH
T148812B14DE96175EEB602332DCD22DE435B506E609AF4F52007ABAFE280BBE4FD35844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5981981b26aaa7743f665f41001d9d74f8a1c9765dcbd10295988cec360a1b37
MD5 716c0980adac1489fc017901fff5cfe1
SHA1 1622b2bb14304a0930e16866dcc0cf909facfade
SHA512 30572895a8968f35e628200ade4138f0936b1c18accd5058091c856fe963a940288f7ee960cb2b22f4ca410e349dd6cfde1e922dc848a08414c3dd0b30fe53a7
TLSH
T1D4716059CE92575EEBA00333DCE22DE535B644D80A3F4F52107A7AFE2812B98FD36444
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 0a40013a9f9266ebbfa3f4c71674bacdb227d7a565f9f4146300abd8a61aaa5c
MD5 b4c5973f348610996f96ff038af64227
SHA1 fc7e78a5efbdbc8df6555e6b262acc0c7932aa6f
SHA512 0447a54c665428c5374de8d54086f77d64c5a995902152b89727754f281c6f53b038bf689427eacc8ce50b9d4081d232afcc67f814449cade39777ae41701a7e
SSDEEP 192:DIT57hheAJBn8IJuJL3e5JGQj5+rPc9SiV8tWvH8sk5crdBM2nIJ81PiYJ1QwJXw:DIT57hheMBn80WL3e5JGQj5+rPc9HV8T
TLSH
T1F7329FF782E4CAADC86531F067552E2ACE1E0515472C3C17C9D9FF9AA3E6872E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 64943e2ee125318b5cd20df2d4069315371d0846062014ca40839f1f665679a1
MD5 e21908cebe61f720e410f5c9c43a406b
SHA1 d63344fa3456513e9eb785baa76361d9ca471c57
SHA512 47f55284db81bbdf1b6f7470b07f039169a822b20b8d2287e0de51a6713899d199a2e87a4fa2c76c0a3f508fbb005a2c3d48d689bdef0e0f6c1d7d69278f5131
SSDEEP 192:DIT57hheAJBnpj5+rPc9SBQRV8eJf8hJGiZvH8sT:DIT57hheMBnpj5+rPc9cQRV8et8hciZN
TLSH
T138E18BF3C2E4CE6DD86162F067556E2ACE1E051487283D1BC8D9FF9AA3D6472E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8183eb009c21150b6acf62dd17e6b161fc20c105c9459605cd5a00dd97cffb9c
MD5 303ec2ba22f822ffdab5aedc015ca6e6
SHA1 18142f05105a6be4e32acaa1b2702db153c7f9f9
SHA512 abc0b741878e0a68f4f15d6e6aa3c4472f1f06a41db75ceecd7e819817441d178baf4882751dea7832c6ffdd0b034ecfd91496988417dbb5715849a59b2d5fac
SSDEEP 192:sxZ2RFyM/jK1Ml8Mk7/fRsvE/IdpWsHW6+WNCNK/YHYPdpWIgrJ:sxZ2FM7/fRsvEwzHbx/tu9
TLSH
T1AE52EA12AA386977CCDBD309F9557F93D6F54472A2901D48AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b7118e29a8ba84e90bd64d05522d2d84b52d9ebc3192809c1b08d31d0891fe83
MD5 fa2cf0c1bd4d0e7c4ddf1eee6d6f43d5
SHA1 847b267120ac88904b4bdb81fb433fd7b43f5855
SHA512 98018bc5e9edac95db52d537c455053435a109f423d2cd341f8502d5005536c9e986a820c4bb963df68554f5ae886ba2ec8ca220c2ec6d781f0a7e687ebca669
SSDEEP 192:sxZ2RFyM/jK1Ml8Mk7/fRsSq/IdpWsHW6+WNCNK/YHpFdpWIg5lJ:sxZ2XM7/fRsSqwzHbx/mu5
TLSH
T1EB52D916AA386977CCDBD209F9457F93D6F5447292901E48AAFCCB0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ae4b43b92fd3436ea4aa3078c0beccdc0fa773a8a3e3ec3c4877aadb7ee1891d
MD5 3db769462104c36d7ab9cfb4e1cb8c28
SHA1 bc8bc6e623b677180ae812a123b3901a85b914e9
SHA512 968aa906ce993b5a2ed3dd21a7cbe1eedca6b2df55f1f444fd862bcd9d7d0c9537d3fc202a6da59900516355ebd529827ba2dc7b755acdbc7ac92797ca096d61
SSDEEP 192:sxZ2RFyM/jK1Ml8UQnk7/fRsSq/IdpIsHW6+WNCSZXYH7ecpWIg5upJ:sxZ2Xqk7/fRsSqw1HbdXcuAT
TLSH
T17752D916AA386977DCDBD209F9457F93D6F5447292901E48AAFCCB0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4e2b252ccba41b53503dd5ee49424abaf0787a5c748d9b937477dad8086037cd
MD5 3cf29c6b59afb1b644bf443a2d610d42
SHA1 77e523203f32883352bce1a440bd99553eed1311
SHA512 db41aabac4bfdd33a682d934fa903b8221cfc31c223172fb773c6a37d713fea9ca2ff84afefdf8b6117f660378b3fc7dd9aa903100247f2d51a4291bf2450476
SSDEEP 768:FoUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RaroVZ0Y:FoUZYTMWvg0Pou1ja7eLZmRRcY
TLSH
T1CBD20A2B680CCB7E4F844E5DEC2A6F967DD801CB5A584D5447EA884C03CB2EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4aa650ef3946a21c912d988ca684fb37977c1bd47cc14454e739790a6f90155a
MD5 9f69abf596e8f35ff06a3ceddb2b5df9
SHA1 35bc2195fad07c01c6080d03641eb560bc1f7211
SHA512 2aac336100f26e022a5755e267f1097f21bd579c149ad879d995b51f9161b297ef10b2618312ffffedd01d69c525d4ab8f1d03b5bc390b5d133f2470743f6da5
TLSH
T114A00251858D3186DC00167A104532C1F3509D2111091E256994A69CDDA5240D2C1503
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a0df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a0df.TMP
Size 48B
SHA256 1c73e60d1816ab3a76e7c4d81211fcb0ba6abb0930a7fcfe5dd529e7e4c99c1c
MD5 b2494cc08680391d0491766fa305d577
SHA1 6d9bb1739254a53bf6663da51e663f83b4617d45
SHA512 7bc3948b0df894db4409be229f7194518f42c0b74fcede17292d672e8d4028cef16dc4b65ef2f629a87bebfed01bbdd73a507e2532130478ff12cb471c26b96c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 5e1a60229f667b6cb4d3f33ddddda06ea770c016ae07e9691174768226b37556
MD5 aebcc87830fb7fb89f1a8f0a5444e706
SHA1 541aed985f1db23cc9437f29e5d384bf7f563be0
SHA512 d6eb63137718f6e81009ff3a9604771579ba6037875dc383e2f5963e38049592575958969c3ceaee19ff71dae6929c578d234cf6cd1630188d01397faaa5178a
TLSH
T16AA0022131A04655E901F275208682953775BC100101534575D549878A611908591700
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 aeb38e05733c79b2205d776a7d5063f7dada3921b746a404b0ded17e3a5f8fa1
MD5 6cbed6baf91eee2e76843ce60b9d6f05
SHA1 043635c6a9f1b380d163198fe59b525e0d99aec8
SHA512 59a1545febc89adece13acf9acfb37b46bb66c02907aaa384ccbbcfedc764e302badfc2679ff8b4d178b0723f1d42d480f9ea740945ddc59105962519897df6a
SSDEEP 96:KA1eK2AseUKXqlmd+KuARvmK0UyiQAKliz:EWE1r9n0
TLSH
T161D1C31671BA03113C7D2A1C86B59B668E41B563702DA52B7FED00B54E2AE209FFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59337a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59337a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 426d4b9d66f926f52aaae6993f1233b8ba20e68db112fad5c98fc0144eeeefcd
MD5 fdfa6c6de3c5f316cf5114527dd6fc6c
SHA1 968385616e8a99289512e40506490b3d58cf4ca6
SHA512 65acc0875cc11341dd270201e3644f8f1c021dcad3f074716d88946df1021083efa4a9cef8c9eefc73edd046c070680a2d53ec3505aa63e008cc381df9dfabfe
SSDEEP 384:UtNn/s3n9SfsNuTDtAljEubI+7QUzX5od+2d6/Id+2CLZDOObjI9G6w7R5:Uj+9UzAlNbgMOv3lCLZD29MP
TLSH
T19B929D32AC286D338EE2A565F84B36174FF4417BD7C52F88D5ECAF0C01DA6AC5316915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a31475c3fb269eb8f4e66870a8e65d0961224e46b494a53821bca62bfbd40acb
MD5 8f367bcb06e3110d861976f4cc97ef12
SHA1 500877dbd90a255efec5802cd7abf45ae7fddcb8
SHA512 90bf7db4c444ea0dc670f6962588453ef5b3fcf7553524cbe56c9114b19949cf872d878090afb161a27b45d6f654dc69b125df67acc11649bd06fe288b193619
SSDEEP 384:PiF1tNn/s3n9SizsN+8TUNTUlIlgDtAljEubI+71UzX5od+2d6/Id+2CLbDOObj3:aF1j+9RjwgkAlNbFMOv3lCLbD29MP
TLSH
T1C8C229F258D79936C99E9B57B73E2D138EBCC067B6852A44B3985B0CCC861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9537674dd6d226c8c9ded9a4521cb5d6dc28dcd15b306b4c03471cda67512dfe
MD5 25a69540fc2ec670fd4d847421cb0405
SHA1 47a06f6a788837f80c03b8d53d22b40c9c63d4f9
SHA512 0c578a66a140f2f544c2686cc9ad471ae1fddf9d9d7f365a406c312e77a669f07425fddf7f76b23a058817dfc8cb90b8673515ad7cafb882df6f8a86c903c935
SSDEEP 192:yONI61VWQmiUypEgGX5Obd+j1+FdgX/t/ag3PXU6:yONI6WjgGX5od+2d6/wkXU6
TLSH
T16502B735A8687C6BCEE2BD49F48777135FE41067EA952B84DAEC1B1C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40c6314c0c8ebe99f08b1c9186d5d05f1e4b9a994c82b73db36ba80a0d9f5d62
MD5 2e53a144714b3ebdda8e35cc38c9ae80
SHA1 c5846d1879bcc27171a33dc2270217844aa21624
SHA512 3b86ef5f13941646ead90ab52ebf773081fc6586051143e78946a13e6fc2794cf15b83511915166cbebf6bb88ed653abe2f892c66a7744e6f42336cddc86ea8e
SSDEEP 192:LONH61CWQmiUy8E0GX5Obd+j1+FdgX/oxFd+2CL6jJrQqtU6:LONH6To0GX5od+2d6/Id+2CLWDU6
TLSH
T143120932A8686C278EE2B555F48736134FE45167EF897F85D6EC2B0C01DB6AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7f0034a4ce71763aab83d2645213629e823c94b96a5a75868feb94d731bd10f5
MD5 b81d62a99c2b92992084243c069a6bf5
SHA1 874cf572b0c5a74997638a25e5c7a60baff04dfc
SHA512 1807ecb8de47e56f66eaedac225902a643ac1bd0aa9c3955e7b1642a9ed24b0dfe6af40e13be5c786d2954b851f43b2ca559c21305ae6b2f415ebae710407f39
SSDEEP 384:gtNn/s3n9SfsNugDtAljEubI+7QUzX5od+2d6/Id+2CLZDOObjI9G6w7R5:gj+9UAAlNbgMOv3lCLZD29MP
TLSH
T12F929D32A8286D338EE2A565F84B36178FF4417BD7C52F88D5ECAF0C01DA6AC5316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0889d5a984c318f01f64be930389a44900963b9f3deafc286d5b5bed501654a
MD5 cfdd9b4fbe67a923844167b3c0becbe8
SHA1 84910bd0a0108b2fde243973e4d6a1b7e4cdc6dc
SHA512 c5b30a0cfd62dcb2d4eed7bd890a3e2f6e02acf8300495ba89be15dc6a534cd6c58809f6bed04ac42696e7bf700eae1dbeddfc43e0338151ffef28c5705eb6f3
TLSH
T180412658AAED114CB3B37F0AAFB6A86E487FB9332E06C45D00110D4F0636A40C9B1773
MD5 SHA1 SHA512 TLSH

Submit Download