22a6d8dbd6cd8c5d8d857a865ae423f1f9a5a893821f314561cc32beeb05e3e7

Analysis

max time kernel
898s
max time network
778s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zenith-executor.html
Size 37KB
Sample260720-ydhmtsdv3j
SHA256 22a6d8dbd6cd8c5d8d857a865ae423f1f9a5a893821f314561cc32beeb05e3e7
MD5 c4831a596893658047981cad67cdb4ae
SHA1 e38fa8feed3958c54a07651e3fed64c0c46cc095
SHA512 e6374e254b8c80818d6afdfaf78f20de25f742177f8de413b5903b44bdc3faaacddffb48dac8e2f82b4e45e1fca5c718cf80f694280ba23a6279e6f1cbe7711a
SSDEEP 768:Xn6ekn+1W5T+eOTza7w2EI6cNaoplEXUch:KD+1eCzaIUC
TLSH
T134039322B2B151763532A495B799979F3740E213C2068FA0BADC4134DFCBAF25F5278D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290500238650032"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F563574A-A337-4115-B165-080F3BE3DF72}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
236	msedge.exe
236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5736 wrote to memory of 2644	5736	msedge.exe	88
PID 5736 wrote to memory of 1456	5736	msedge.exe	90
PID 5736 wrote to memory of 4944	5736	msedge.exe	91
PID 5736 wrote to memory of 1456	5736	msedge.exe	90
PID 5736 wrote to memory of 1456	5736	msedge.exe	90
PID 5736 wrote to memory of 764	5736	msedge.exe	93
PID 5736 wrote to memory of 5220	5736	msedge.exe	92
PID 5736 wrote to memory of 4728	5736	msedge.exe	94
PID 5736 wrote to memory of 764	5736	msedge.exe	93
PID 5736 wrote to memory of 764	5736	msedge.exe	93
PID 5736 wrote to memory of 5220	5736	msedge.exe	92
PID 5736 wrote to memory of 4728	5736	msedge.exe	94
PID 5736 wrote to memory of 4728	5736	msedge.exe	94
PID 5736 wrote to memory of 4380	5736	msedge.exe	95
PID 5736 wrote to memory of 4380	5736	msedge.exe	95
PID 5736 wrote to memory of 4380	5736	msedge.exe	95
PID 5736 wrote to memory of 720	5736	msedge.exe	96
PID 5736 wrote to memory of 720	5736	msedge.exe	96
PID 5736 wrote to memory of 720	5736	msedge.exe	96
PID 5736 wrote to memory of 2552	5736	msedge.exe	99
PID 5736 wrote to memory of 2552	5736	msedge.exe	99
PID 5736 wrote to memory of 1972	5736	msedge.exe	100
PID 5736 wrote to memory of 1972	5736	msedge.exe	100
PID 5736 wrote to memory of 3620	5736	msedge.exe	102
PID 5736 wrote to memory of 2876	5736	msedge.exe	106
PID 5736 wrote to memory of 4896	5736	msedge.exe	107
PID 5736 wrote to memory of 3600	5736	msedge.exe	108
PID 5736 wrote to memory of 2588	5736	msedge.exe	109
PID 5736 wrote to memory of 2588	5736	msedge.exe	109
PID 5736 wrote to memory of 6088	5736	msedge.exe	110
PID 5736 wrote to memory of 6088	5736	msedge.exe	110
PID 5736 wrote to memory of 3196	5736	msedge.exe	112
PID 5736 wrote to memory of 3196	5736	msedge.exe	112
PID 5736 wrote to memory of 236	5736	msedge.exe	113
PID 5736 wrote to memory of 5916	5736	msedge.exe	114
PID 5736 wrote to memory of 5916	5736	msedge.exe	114
PID 5736 wrote to memory of 4528	5736	msedge.exe	115
PID 5736 wrote to memory of 4528	5736	msedge.exe	115
PID 5736 wrote to memory of 1108	5736	msedge.exe	116
PID 5736 wrote to memory of 1108	5736	msedge.exe	116
PID 5736 wrote to memory of 236	5736	msedge.exe	123
PID 5736 wrote to memory of 236	5736	msedge.exe	123
PID 5736 wrote to memory of 1436	5736	msedge.exe	125
PID 5736 wrote to memory of 1436	5736	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\zenith-executor.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d4,0x7fff92e1c188,0x7fff92e1c194,0x7fff92e1c1a0
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,8683119010581904933,11238553086651990512,262144 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,11628837902033495840,15012478059550791309,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,4148633401865591757,16280882153703536257,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:13
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3300,i,9868461020954180316,6259404107397117881,2097152 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3324,i,16742644661059549233,17473605287787660865,2097152 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,18241938794580635446,14758453412541833025,2097152 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,1637212096395676779,1147070367332013667,2097152 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,12792710758902279379,4532776125886222807,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,17853809895119660651,7878750348608106222,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2252779696452260067,6919501623167140331,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2252779696452260067,6919501623167140331,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,10625807866941283309,717300911135553860,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,6019105255484062266,9534937409041061028,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,3547603494258050337,11782510024881298925,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,1608014718706040588,12306597911633469625,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,2020823374951589236,15248916872308309894,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11881069352127257450,1961405273046879336,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5348,i,16951099054467377253,17222556891623401973,262144 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,16072119619809395291,12565532057342049281,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,612163107965875222,4933280335297450255,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2892,i,17896098677901829813,1932161521274897779,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,7488067389302415677,16761159252095549887,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,2463653072738217419,2400237586205623015,524288 --field-trial-handle=2172,i,7449416433589946605,13958818695068892741,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1552

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 588bb188f72b9072305500a77ad0550f339c3234897d56f60fe20663beccb0c6
MD5 168ae20409dee941acee0a348a27c3d7
SHA1 41f06d569fee9b1ccf7fb34b93409eb96220c602
SHA512 486ec2f838b69c0df5c928d1a81ab43dc9123c713b121571e6a76b085d1c2d7eec5a9475173c28007e7c4108a8a9b5b42cbf01fe12871e356f384cbd5a305596
TLSH
T1D8E0268405D9C3AEEA10A4474268C34CE291360FA6C86DBA5B0984B5F645648B7F26B1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5cf964c12c3f6cb1e2cdc03984fa09cfb6820a0e639ddb9d7ec9639c7fa2875d
MD5 5b4cb108e452016c8d6e54e82d03ac37
SHA1 8be4123ab7a01b6516de3ad30a50002cd2458f97
SHA512 3b49334cbe897463c0d5e670b34a90a929ef97fc719d2019de45b0c0bcd14a1d28b66345e93993282e4bf66a1cc2479a01da760947ec5ba6eca54007c8f82a14
TLSH
T152E026A504C8C37EE706B44B43A8430CD2803A4F92C96A9A1B0889F9B646048B3A2EB1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 893ce78b23d76e0613d1a947af0cf2c3b9423dc88020ca3f0453f771ec3114e8
MD5 3343e497aefb52b6a2c09700809a68e8
SHA1 4c613335420dada11f7b10cbf55eed9b3cb18fd9
SHA512 a086efac8d190dff204e3cfc850c6dd81830734c81e12c4e519d6bb78a2d6fd9a1f56fa579564930e1ca08926585602b2f659d6f3bc6d962dabed67eca1823cb
TLSH
T10AE0209409C8C31DF50C68875274470CA39F364B93CC6D6517098474B54955CE791670
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c4f11c6131dbe9dafa590fe1a74b80df809a46d09ec026a824a4fb2bfaa3c6a1
MD5 515ecf30d91e95aa9bb8ea2125769f8a
SHA1 eabe6def0a780ad84c048a0b3431fdbfc17e64f2
SHA512 5d48f93f03604898eda1ec992b1687d6d8bfb90ec5a49b78b5609400e654757470d1bde9464b306627e4b159d016322cf85d0fc811809256456673f3f5309ab2
TLSH
T1C4E0268488CAC32EE610764782ACC30C92A0370AD2CCA9AE370888B47741088B3A26B5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4e5ab551455908f5e970c82484d7ebf10e425ee9642246d6b76ac0ba62770bd9
MD5 1adfb99fd8e4b3ced5674c766fc7b4d3
SHA1 a127ce48d5cc01b539171b469c2e0fdebaac95bc
SHA512 c9b102a67253cc8fcfe32c3d87ef602051789d396dd0e792d053074a45e2df7273eb8adfe80af1afb8cc8f4ef64ba012c8c03672fb8e7694b7981302a537e585
TLSH
T1A2E0789508C5C36EE500654763D4534CD390360FD2C5EE553F08C4FAB54154477D1670
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f1374bd1afacd0d6710ae3cfbe0ffc29c16a9e86777a572a018e64a2132cff3b
MD5 6b1e000844af3a2775576e38817882f5
SHA1 e87548724004d52d3e1047c5105d4adfd9406224
SHA512 5ea8ffdd9b3bc8e23a95c2929cda64d3dfd16bd437a79c6047d8eccd550a49ffee0232b4dd41422143754b8f20c74a53adeaec7301d36d090e7341ca0adf0ca2
TLSH
T14A3186D1432739FDCB9E7AB26FD1859A3A3CA4982E1BFEC24D80677456423341C2122D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e296.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e296.TMP
Size 1KB
SHA256 915f23252cc2a9c9872f3beed10935c06e1b6b8b9a364b0a08c58412e5adba2f
MD5 25ab70a30c3a65c3bcabe7121074b53c
SHA1 feccd30dff71c8afd4300fc6e3ee5c2f67564164
SHA512 090ee8295fea422706acc43cd144cf910a73bc121c8f50d9718cae891cbf54c8e67c04708deb64b43177bf8cb32e273fb1e5a90ecf92857e9edb65d55ce55c90
TLSH
T1CC3186D1432739FDCBDE7AB26FD1859A3A3CA4982D1BFEC24D80677456423341C2122D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e169d321275667924c81017dcf443f3f7640b19c90cde53bcc18290be6bf5137
MD5 fdf7f09f4b67c8d5ffd9e8474e17cf59
SHA1 c5dea61e6330c59cd13bc7ae2d8f48e986a2cf69
SHA512 9fe5569d3304d7a09b1fbac2d623dda5280890882c2914ce95f1298cf4065b584871865409204fbeaed17795678bba51e34530ce331acced31768e427d7f809d
TLSH
T12951AAF7C7E8863D890156F0AB157E2BDE19081A432C3C56C9E4AE1FA3F2871D14069F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e3d330b07915fe4d494afe3b070b7b6589a19fd618610f4f05aa17b617ce33d5
MD5 ea967621c32e59335f274d0143712cbd
SHA1 ae0d3e053c081dcac6a65d7155df6cf30aee2041
SHA512 41025ce0bc642def72eb779384c3dc282f40e9aca53abaea96c48f43d07ebd88ced960298a5a5721f73cb56e98cd051a86d9e81abdfcd4390aa0f7a74f9a61a6
TLSH
T101519CF7C7E8867D890156F0AB157E2BDE1D081A432C3C66C9E4AE1BA3F2471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b61fbac8fec6252bae471134d710a91079bdcbd2520850770a3351484e7277f8
MD5 8afa8617d17d4a693da97dbd3f946fcf
SHA1 c1d4ad1ddc3c9743a424e0eec8f64a4d881a5e94
SHA512 8d2af6fb0143acf3002b94d50c9b93019674d7b10924e709402e6eca93d578a0f1c31fc09f677d80bae06946ce4fda5b761f37b46aad6ae66b23770e8429c7d9
SSDEEP 192:sxRbmbe/fCsYdVZc1xDde5lSVzoA8p4A/g6+WNIYCyuO8GQIgIJ:sxRb4e/fCsYdVyc5l3B/5IQ0s
TLSH
T1D432A61A6A289D3B9CC7E20DFB56BF53D2F95132A1D06E48A7FC960C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 821c9cd3939c5fdcb1bed7cb973e20672f401dd5af8e152b5845b94abc406763
MD5 5e2675d7e12df01893447091f44e94fb
SHA1 12b9149fc70c970b71d24816614112d57d416320
SHA512 5337541e5756a9ed4a6946fa2c780510fd045e8fadd751b3d3eba2dc2c797c2041467817155d45bca5a52ae89bec881732a2d8e2277bf4ce2df99a69800568c7
SSDEEP 192:sxRcmbe/fCswdVZcqxDde5lSVzoA8p4A/g6+WNIYCTuO8GQIgDD9J:sxRc4e/fCswdVxc5l3B/5Iz0X
TLSH
T12442A61A99289D3B9CC7E20DBB56BF93E2F95132A1D01E48A7FCD60C15EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 117b3b1a0fa29320db61734f3af46c77514ef8fc3cdb0fc1cfdd8613d3039bcf
MD5 fef1036ab8d31ceb37bb8a31e8043229
SHA1 0f1d5345bbb5b25944bac0ff52cfed950c964f34
SHA512 0e125bae6ae1be2b526d5fe0919a813cf3b0ac26183e0c39f78866a7895d6391fe45059f8e3250e74fc780287d5bcb6492943c622da32274bd6ba50a63a14b80
SSDEEP 192:sxRcmbe/fCswdVZc1xDde5lSVzoA8p4A/g6+WNIYCyuO8GQIgDDrJ:sxRc4e/fCswdVyc5l3B/5IQ0N
TLSH
T19332B71A5A289D3B9CC7D21DFB56BF53D2F95132A1D01E48A7FC960C05EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f99c12caa61bdc24afae3d8c73e5e38726b257ef8fcf9020a83af352356c258f
MD5 655990a2169c1e5ea38162ed63b2da24
SHA1 fe01eae40aedad53961fee5921ebe31628421c49
SHA512 4f57f53a3d1a9992756d1a3c2d4665656a4f8e42d1f6707c78d3b8428387414fc57de80a67c819fdf102b43f12a1f2af56e72963d953cc3178bd5239211dc701
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvOroZSY:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VQ
TLSH
T16EB2EA2B600DCB7F4F800AADAC196FD76DA802CB97589D5047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 271B
SHA256 bfd5e90780c1e3b9d51ebac2d4c2918061042f27741ee0336606daf0d275985b
MD5 2f0796a1feb723b45115550440921569
SHA1 5e94b4a5292e869e0065c9fa927080b4a6f189c7
SHA512 33372c1c713ed75133b861846e6b2e8735b9d69cf387701341fd4040c452b0ef119a010f0b9e05ae86f39e120f88bf28cf3c813386a74350aa00b927e9389d77
TLSH
T1C9D02BBB2CA15810ACAFA3D6643167E4401DB9548A45BC8A205C91C714612723C26C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 77c7c973b4ab96283dd5b0f00fefbe16e952f12b68bc4240d269e2ceba464c24
MD5 3f0538f7eafdc86502f285203e4a1498
SHA1 89cbdc2c63653840635e56d4ddc3090d3339de90
SHA512 90d7c98cc6b1edc5ea7a3e873e728ebd9d0c6e8f323916d80ef2b8b609ec36c655461d72436f92b19ec9e7c6e2d96ef3fd55201944423dfd356573ada12fab46
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrzKtZ+Hpm3N:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpz
TLSH
T133914300303B1684397EA94C8478882E96C270767519F56F3BA841A61F27E479EFFCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f5f643c3-9475-4fdf-b361-38f85d0702b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5f643c3-9475-4fdf-b361-38f85d0702b2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
MD5 dc2dabfd9cbeadca467ec254d1aafed1
SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
TLSH
T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7c94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7c94.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 306f02ce891c451e4282229d8d40a59ff42caa3725dcaed5eaf59dfb39ad2a5b
MD5 447d97da9a323198ed6123e73323e1a0
SHA1 a04c06a96d0a85a00ed12adda558c11102df43db
SHA512 6bc0df874e1b5c34e511fc3e10558fcb1d08946829940f101483f4588bd1e88e69ef27be93b87a363264767c8d0e32f9448b4a9d136626e431a8beec129c1c38
SSDEEP 768:zj+9F3nlkRxp8+p3bd66j+4BRv86aLIWh4b9Mq:W9F3Kv8+p3Z6n4yMb+q
TLSH
T1F9F2BF36E8A98E738CE6C654B2473B436FF551B792C01ED8D8DCAF0D01971AD970B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 38a0cc584e5c5e28785cdd865e1cf0f545b8b83fa5568a460e8478e18c88ff5e
MD5 5c37db6c183be20e4457035177ce1c59
SHA1 4df8a1e520682e05c6f6f47a4cb86dfab1689cdb
SHA512 86e07c616e1937100ced99ff07f6a8709ac314d1605c45fe9a1a24d650ce42b2a90b9278fe4f730a371e345126bcad9176fb932a5dfdda7fc7dd2d31854c8fa4
SSDEEP 768:Irv+4UNbdD35ckzNp8+p3bd66j+4BRv86aLIiN2bwCl1:Ibsbp3pL8+p3Z6n4yL0ww
TLSH
T1F403BE33F8A899739CE6C644B2867B437FF851A396C10EC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 48bd4446410a209940a535613ae065be5fde2eed792c4af7126137a31ddc3129
MD5 120934679a5711650683c15936304ef3
SHA1 79f4ef75f3e30f9cb1358362b4354d637a564891
SHA512 9c191f05435b13735d8b4e38f2c3aaa09d6b4613b7341f64c03030cb74b34888e34d8fe6cc00b5cf7bbb5d9fb3e8bf8e4fe2462e0c0f6b201f04c8f1c99dc8fd
SSDEEP 768:Jrv+4UNbdD3nlkRxp8+p3bd66j+4BRv86aLIWh4K:JbsbJ3Kv8+p3Z6n4yMK
TLSH
T18503BE76F86899738CF6C644B1877A437FF8516392C01ED4D8DD6B4D429B1AE230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4011bcc77635ba487e42b431825f60640b14ea5332b72051428aadbc5f49727d
MD5 2e2000636c8bcbd969b70cad9559fba8
SHA1 f6bd05f2e73100888f857629f1cfba1c7e0ffa45
SHA512 24f500bdc9d8003cb8a4788a1645aa66f0b7063a6011b64e1c48ff5668979a79dd7806ed1030ad56444a297c78f61fab5e5b5e0c6f698b301c58c1e6ca80be1e
SSDEEP 768:Sj+9F32lkRxp8+p3bd66j+4BRv86aLIWh4b9Mq:h9F3Fv8+p3Z6n4yMb+q
TLSH
T1ABF2BE36E8A99E738CE6C654B2473B436FF551B792C01ED8D8DCAF0D01971AD930B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 44f32f4f064efbfade54a0f26241b601811acd5fb678cb04090206ed096442eb
MD5 0092236b028bbb7fe6c575ed13161131
SHA1 13c072ae025b2d58eaa5474cd0158f7b84d367d0
SHA512 b96d6443a552f416928e58f986970facbf886613f308f39fbcd2fa07f18fc96c3106fcb11588c528808b84e3f5ae6e72824307af378dd152b64a9800429e9468
SSDEEP 768:06F1j+9N3+wgylk/Xp8+p3bd66j+4BRv86aLIWh4b9Mq:09N36Z8+p3Z6n4yMb+q
TLSH
T131039D37E8988A779CE6CB44B24A3643AFF511B7C6C02E94E5DCAF0D01971AD530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f49c1606-ce60-410a-a7af-e0d7f7c88492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f49c1606-ce60-410a-a7af-e0d7f7c88492.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download