hxxps://www[.]parapromos[.]com/mag/fr/contact[.]php

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.parapromos.com/mag/fr/contact.php
Sample260722-qqj3esam21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292004831085911"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{E8329C04-AFCC-4BC8-8487-0F6423008FBB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4772	2684	msedge.exe	85
PID 2684 wrote to memory of 1036	2684	msedge.exe	86
PID 2684 wrote to memory of 4400	2684	msedge.exe	87
PID 2684 wrote to memory of 1036	2684	msedge.exe	86
PID 2684 wrote to memory of 1036	2684	msedge.exe	86
PID 2684 wrote to memory of 1332	2684	msedge.exe	88
PID 2684 wrote to memory of 1332	2684	msedge.exe	88
PID 2684 wrote to memory of 1576	2684	msedge.exe	89
PID 2684 wrote to memory of 1576	2684	msedge.exe	89
PID 2684 wrote to memory of 4936	2684	msedge.exe	90
PID 2684 wrote to memory of 1576	2684	msedge.exe	89
PID 2684 wrote to memory of 4936	2684	msedge.exe	90
PID 2684 wrote to memory of 4936	2684	msedge.exe	90
PID 2684 wrote to memory of 3504	2684	msedge.exe	92
PID 2684 wrote to memory of 4688	2684	msedge.exe	93
PID 2684 wrote to memory of 3504	2684	msedge.exe	92
PID 2684 wrote to memory of 3504	2684	msedge.exe	92
PID 2684 wrote to memory of 4688	2684	msedge.exe	93
PID 2684 wrote to memory of 4688	2684	msedge.exe	93
PID 2684 wrote to memory of 4280	2684	msedge.exe	97
PID 2684 wrote to memory of 4612	2684	msedge.exe	98
PID 2684 wrote to memory of 4280	2684	msedge.exe	97
PID 2684 wrote to memory of 4612	2684	msedge.exe	98
PID 2684 wrote to memory of 2976	2684	msedge.exe	99
PID 2684 wrote to memory of 2976	2684	msedge.exe	99
PID 2684 wrote to memory of 2976	2684	msedge.exe	99
PID 2684 wrote to memory of 2112	2684	msedge.exe	100
PID 2684 wrote to memory of 2112	2684	msedge.exe	100
PID 2684 wrote to memory of 2112	2684	msedge.exe	100
PID 2684 wrote to memory of 1676	2684	msedge.exe	102
PID 2684 wrote to memory of 3812	2684	msedge.exe	103
PID 2684 wrote to memory of 3812	2684	msedge.exe	103
PID 2684 wrote to memory of 3812	2684	msedge.exe	103
PID 2684 wrote to memory of 3980	2684	msedge.exe	106
PID 2684 wrote to memory of 4684	2684	msedge.exe	107
PID 2684 wrote to memory of 4544	2684	msedge.exe	108
PID 2684 wrote to memory of 472	2684	msedge.exe	110
PID 2684 wrote to memory of 472	2684	msedge.exe	110
PID 2684 wrote to memory of 1324	2684	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.parapromos.com/mag/fr/contact.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa6ec8c188,0x7ffa6ec8c194,0x7ffa6ec8c1a0
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6606890544488217584,2265697907653512886,262144 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,11902540600742724147,166418873853963118,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,17078672965675460042,10381954684492198806,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7621120293521866766,5299610895879421625,2097152 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1960021819255877650,17542629295645665031,2097152 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,15420238104757554630,6257094762663777726,2097152 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,3809889576736193472,9311879092036540696,2097152 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,15104284950242931851,7275847996309121224,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,14841073814834954031,7140185033293614671,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5520,i,18150025495739554653,11419388250473707113,2097152 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5684,i,13202868165446984348,332567891430054013,2097152 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3850166017857422972,14514492629179064909,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3850166017857422972,14514492629179064909,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6348,i,3262471969667877829,11085370915904679520,2097152 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,17608589364408600670,910298542784174139,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,1338098684749217414,3214324549851880032,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,17005987926367856103,4834697654596907690,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,88858957584553979,17390975672520640679,524288 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5436,i,2850259408288467615,1897030301517683143,262144 --field-trial-handle=2964,i,15402106101702323976,11122689097269584319,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 374KB
SHA256 b26ee5be0a3d0e8f55ff99c09142763975c79d6363cbf33cfb420a5c1f6b96e6
MD5 e7f8b5f79395958eb9e086d97501a861
SHA1 210f5c82fd01895c3a8807ef61de474924cd72a1
SHA512 9a908062a1d694995d9c532ca81063e09615d63a4e8dcb52adb1543e85abe74dd4dc98ec85ba5c97bbdbcd0ffb9e5330fe9ddfd356459ca6a7468f4600616006
SSDEEP 6144:8DdzrOj5wBy5dsKG6GqLiNFuQ2Tp+6gLmiN+AJO3W5XvEPtzq/Lh5cW/TSsIfNNx:8dKoyE+JTp+VqiNhJP9EPk/LHcWLfIfd
TLSH
T1F3842385B1B89EFDB3BD258E096FE2F9AE49058CB8610D2758667820E75FC85357CC02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 be50264b272c6a66555ed5f2d46dcfd876e917fff4fa32042d7cf55328e02985
MD5 6b4a50c90b6e910b34daf88244b14fed
SHA1 375b26b71826a02f55d6b54450cdef567f58d8b9
SHA512 b94cecdd6cbf19090aeddcae2cbb2d18d0fe50dbb30acb37a013d4dd342be98cebfc7d1dae28b3c1ac6d0c911aeb765fa742e0d80e9b89f53b831c6ffa52cb3c
SSDEEP 48:jdaW45YB0J1W9GrNRkAEmZRiPDv6GkNU6ehH7g20j6dNg2jVSoVVYk:jPyJlkrmIiGew4j6dNgwSmqk
TLSH
T116815F68F67A9C81E7B55730CAD26A0D79F0CF5889878E5203C860BCD4963BF44B1C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 7e9bff119db35b7491b8b3dd64115955eb048c88a103c368634cd14a52267012
MD5 b6eaba3c6e99a99dce96b7d876277c2f
SHA1 6703876622d659abe946a47df21494f2bf679289
SHA512 a37f45c97fc3720cf88183735193393305dd7fa636aaad61e5a9f8b662f78f14259a4763dbd308909bddc5b278cd18f2a91171e13bef676407b064ecf9ae80b3
SSDEEP 192:DqTtU+IdaOZJdHKE13FQM75lXW/3a3pu3Sq77NxV3YX/LjEk13TyJC3pfBBoJ2HT:DqTtU+IdaOZJdHKE13FQM75lXW/3a3px
TLSH
T107227DA6C3E4CA2DD91156F0B7212E27CF7D0524467C387788D9FE8A67E2862D68064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3f41db3ceffd78b082121c45b533ebc42914b45a4018bfb0e33365d2add7c7aa
MD5 8e3e9a94029409c503fbec877cb38b59
SHA1 77c771c1fe3793e680a43710dea6bf26a5897c84
SHA512 6a7bb1d2ec7261788c37515d734cd2be6f45beba8757f6002854235d3f322bb1404a81edf96c2d42ffcfb6bcf7378d3ec9158f8fc456f8f0ab15f118752f0717
SSDEEP 192:sxZ+R0yM/jK1Ml8MkQ/fpsKFgIdpu8HW6+WNuQk/YL9qaN+0IgrJ:sxZ++MQ/fpsKFhDHbm/DOr9
TLSH
T15652F9566A345977CCDBD209BA45BF53D6F50573D6900E8499FCCA0C00E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 de3682d9f18cfc6bcdddb24f0f75450291b991d176d42fa6edf99a05d57eee2d
MD5 7f31602d02f33435ef4ea062dc0274ba
SHA1 9fd421539d0d4ff9be714b50ce700fd5187d2636
SHA512 82d4b7aacbad038cd126403a07180cf24b1162cebfc5b26a6f4f1daaa8f8d77581ec54a6efa74420b09419af669029ff52aee084235c3ef7427ae0d471b96ae8
SSDEEP 192:sxZ+R0yM/jK1Ml8UQjkQ/fpsc0gIdpQ8HW6+WNuQk/YLqqph+0Ig5BJ:sxZ+GqIQ/fpsc0hVHbm/mnrV
TLSH
T11D52E8566A349977CCDBD209BA45BB53D6F50573D6900E84AAFCCA0C00E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1561a46077d6e0709b25d2a4e506782044359caf3b1f402128f28e61f3d0b206
MD5 8332ef737156e0eff563a80b4e39a276
SHA1 882092f04a3b932b7a3777b6654799d38790afb7
SHA512 ca434ee9fa50beff779284321149d4f505a254c97903b949acfeb7bb9b8c8ea40a06c367f8510ccb8a58516382148d496f1bbfde716d28d81aedbcd3258107df
SSDEEP 192:sxZ+R0yM/jK1Ml8MkQ/fpsc0gIdpu8HW6+WNuQk/YLTquN+0Ig5BJ:sxZ+GMQ/fpsc0hDHbm/9CrV
TLSH
T1B952D8566A345977CCDBD209BA45BF53D6F50563D6900E84AAFCCA0C00E6BDD231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5a076aa863c3ac70f15720aff30324753f13384ee2ed77778a14ebd4b88531fb
MD5 3d618412777660de3563c33ff02f61f6
SHA1 2cbdec00ca005e870c03e3047998be7b63cf2bd9
SHA512 4741b7a4a4bbe5b16ec600a1e0f3337a1866771ab44f75f808657300dca49168e82f43d7cc168840b84a187f4c4bce042b48326bc8d28a424873e4e438f7d7ba
SSDEEP 768:QOs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNfrojH:QOs6pD1WvxzWju1jahILIsNMjH
TLSH
T128D2EA3B680CCB7E4F841E5CAC2A6F977DD801CBAB98895447FA844C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\881369c8c9cb8c97e00eb66db80197c906095f10\index.txt
Size 145B
SHA256 f5edf4389d49b96de607d649432a23138cb44048ff40bc8a3ccb78d306b6dccd
MD5 2f1976fb4a3680eeb83b143f26eeae3f
SHA1 28f95edd1da05c07f5202e7579df9478e766a145
SHA512 735cab76029d56b51774f5851ab7a22423dcee7a7c0d6bf02f93c4846db39687fce938dd4e717c306e71da2a2b5b3f0357458eb306a3d7af1b0e1defbdda69ce
TLSH
T167C04CAA83A49E41AB908D945635A9ABAA0F3654DCFB99ACA82612D509810564023562
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58337f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\881369c8c9cb8c97e00eb66db80197c906095f10\index.txt~RFe58337f.TMP
Size 152B
SHA256 370f729736cd195411fe491bf26858c16ab079f68c635c844e2b0f87f2aeedcf
MD5 e27d97fd9125b875cb6458031a130f72
SHA1 1b35af432ce33816cdffcc30b265273b35b64d37
SHA512 96365f832b59d817442aa15728e90f538bd1418db763b81eb52daa34ebd0ea9a85bcea0514e279cb038e9b0d31d86149048f4cf977ddebfe1836c5f112ad1780
TLSH
T16FC08CAA83B44E00AB908C814230A89BAE0F3E04CCEBC5ACA82731D109700034023062
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 d63990da1e59563bff32fa10de56b7ed15d437c6a186a164ff499b1f0b23b108
MD5 5011abc28a5547f1a4376eb9eae39f45
SHA1 782ed4734b6836845ba0b693dabb4181752e027b
SHA512 4eaf46ce46afa08f96465590eb4bca238c7b746436ec91e35431840ca8927f76fb9b5daf5d28d6095c44c3abbccaa4b56ef4893b81120f3091841206449f1ad0
SSDEEP 96:KUAAKtePtYhM46SS+4iDlqY+KyLqO+2QYr+ofuVKKOAJ+IKHKS6eUKry80:iitYhM46SSPiDIYYLqOzQYr+ofdxXvs
TLSH
T1EDE1E85771BB43023C7E2A5D8794C7268E42B5673028A42B7FAC01B61E67E204EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab8bafb7-3de1-4cf5-bc88-358e21ef6a82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ab8bafb7-3de1-4cf5-bc88-358e21ef6a82.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3b4971c7e2ba6253e795293297866c766a66ee489f42634ea6fb61106c51683b
MD5 b0733c2c4b99e9d5ed05fa50c20652ba
SHA1 35b4e539c20d28358fde65e0e27b3c6330b5e788
SHA512 cb48d7fa9de5186474cd144c19f73fe5ecf9943d4b355c8bc796d6b7b4bbdb47ba5abaff8fe7776eff5e03f06b8b13f693f84c99e59e193f92e329aaa2809788
SSDEEP 384:ViF1tNn/s3n9SWzsN28TUNTUlIlWkTZBtHwzfa9lOaaR39UScjmwy:cF1j+95DwgBV+yvOaaR39U1je
TLSH
T106C218F258D78876D9AE4B47B77E2E038E7CC0A3B5811A80B798590CCCD61BFD346915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a4d33bb289474fcc4276fcb67bb5d2d50d78fadff10b66a8556fd898440f6d70
MD5 c44ab1dda37df9d66102e088948efac6
SHA1 909526facf386161f93d0d09c2b649376eabd88b
SHA512 252f7d6539c4092dddfe34a0df33600c5eef53ccea9c6d55c4591cd01a94412367b004bf2827512d9d78091f9a4151b3eff6cbb8403ecf6012aa76a3655f404e
SSDEEP 384:EtNn/s3n9SfsNFUWkTZBtHw8fa9lOaaR3iUScjmwy:Ej+9U9VpyvOaaR3iU1je
TLSH
T132928E376C289C775DE29085F94B3A179FB840B7C6851F80D5ECAF0D01DB6AC134BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f44af89520a8b1191eb9443fa675947ccc4aa43fff26611964ac07f5069aa6d1
MD5 cf2cc75cf19c89aafb8438a5079d7297
SHA1 e4d0d23a7489e9449f03c0ab87200a2527f2c4b7
SHA512 e55452ddb1dd4111400510172c0cafa561ebd39bb5059f090fe44325a5b0dd3cc50bb05fdb71c76cabcf8efa19795d290381ca3307742e36bec698e4d347f38a
SSDEEP 192:qONy6O7+3hQmiUyfBGttb0cO2coGgGH26U6:qONy61WGt9lOa4W6U6
TLSH
T1ED0209357C686CB79EF2AE45F98737139FA8103BE9912F40D6E85E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c5274dd01d49fcecfcf257a35292e8430f3c7aea15297ae5c5aa3f28d3b0f3aa
MD5 bf359acff6ea4769efcab04d13432946
SHA1 7db8d1e14a7a1231f15304265e7597fccf9e35ad
SHA512 781a49e1160b6f1dba261748e2f79951998f63de90c835faee16ce4fdcda9409037a5e1908c0f676d669646ddf994fd7ebc55e43074945d0fb630bbf3cb4b70b
SSDEEP 384:xtNn/s3n9SfsNFUNkTZBtHw8fa9lOaaR3iUScjmwy:xj+9U4VpyvOaaR3iU1je
TLSH
T13C928D376D289C775DE29085F9473A178FB840B7C6811F80D5EDAF0D01DB6AC135BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1eef3b4c7c464adf83f61078e14fb32c3bf02838fa677dd01c36c77ac162d0a
MD5 ae2db52e3950c9b3901b1afdf7e147d4
SHA1 204805f97cd1bec86050e370262bee36e6b890e8
SHA512 5b978bc22e18147d872ed65fe7a6d6680a0d3ca2555fed3deb373b628b9eecb9c1fffd0779f244b3756ba44ad34d959bcee651e39e445943a86237e06697727d
SSDEEP 192:qONv6O7+31QmiUy6B9ttb0cO2coaR0EocNVqrr1U6:qONv6dp9t9lOaaR3ZUU6
TLSH
T1FD121A367C68AC771DE2A545F9C736139FA9013BDA466F80D5EC5E0C01DF6AC234B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fb6bb56-c86b-432e-bede-92d0783b079e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3fb6bb56-c86b-432e-bede-92d0783b079e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c5819381e69ad5d57363008d30e7dbc861c7f6dbd8e0aa9327c64f38c051f493
MD5 d673da38d53389a4cf31b8defed435ee
SHA1 10f184bdae570d6ee4aadf57a0e38a29b5892d32
SHA512 b6608a22877d839dbb34110e94a5c69cc82ac4b349ab44f86f3f05f1b7e195157522e7b36f6ec7e07c6a3eee5cd0886700a49a29d4070b9d84bfb5216df6d4a5
TLSH
T1D5410758A6FA1148F3B36E46ABF7696D843FBD772E06D55D00110D4F0A67A40C971B33
MD5 SHA1 SHA512 TLSH

Submit Download