hxxps://atelier-rgpd[.]cnil[.]fr/login/index[.]php

Resubmissions

03/09/2026, 14:42

260903-r3a6qaan213

03/09/2026, 14:42

260903-r24rmshh543

Analysis

user interaction
yes
max time kernel
116s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 14:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://atelier-rgpd.cnil.fr/login/index.php
Sample260903-r3a6qaan21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329201661089657"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{FB7C5FAE-F2FE-4FEA-99FA-8F0907FC49D3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4984	556	msedge.exe	85
PID 556 wrote to memory of 4232	556	msedge.exe	86
PID 556 wrote to memory of 3464	556	msedge.exe	87
PID 556 wrote to memory of 3464	556	msedge.exe	87
PID 556 wrote to memory of 3464	556	msedge.exe	87
PID 556 wrote to memory of 1536	556	msedge.exe	88
PID 556 wrote to memory of 1536	556	msedge.exe	88
PID 556 wrote to memory of 744	556	msedge.exe	90
PID 556 wrote to memory of 744	556	msedge.exe	90
PID 556 wrote to memory of 840	556	msedge.exe	91
PID 556 wrote to memory of 744	556	msedge.exe	90
PID 556 wrote to memory of 840	556	msedge.exe	91
PID 556 wrote to memory of 840	556	msedge.exe	91
PID 556 wrote to memory of 2752	556	msedge.exe	92
PID 556 wrote to memory of 2752	556	msedge.exe	92
PID 556 wrote to memory of 2752	556	msedge.exe	92
PID 556 wrote to memory of 3276	556	msedge.exe	93
PID 556 wrote to memory of 3276	556	msedge.exe	93
PID 556 wrote to memory of 3276	556	msedge.exe	93
PID 556 wrote to memory of 3400	556	msedge.exe	97
PID 556 wrote to memory of 3400	556	msedge.exe	97
PID 556 wrote to memory of 3400	556	msedge.exe	97
PID 556 wrote to memory of 1228	556	msedge.exe	99
PID 556 wrote to memory of 1228	556	msedge.exe	99
PID 556 wrote to memory of 1252	556	msedge.exe	100
PID 556 wrote to memory of 1252	556	msedge.exe	100
PID 556 wrote to memory of 2028	556	msedge.exe	102
PID 556 wrote to memory of 2736	556	msedge.exe	105
PID 556 wrote to memory of 2872	556	msedge.exe	106
PID 556 wrote to memory of 2944	556	msedge.exe	107
PID 556 wrote to memory of 3016	556	msedge.exe	108
PID 556 wrote to memory of 3016	556	msedge.exe	108
PID 556 wrote to memory of 2456	556	msedge.exe	115
PID 556 wrote to memory of 2456	556	msedge.exe	115
PID 556 wrote to memory of 2456	556	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atelier-rgpd.cnil.fr/login/index.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe6ef2c188,0x7ffe6ef2c194,0x7ffe6ef2c1a0
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,17415996234945380039,6024723238261320222,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,18338583322605705240,8593358412175095367,262144 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,15185269774517362374,13855011111648361824,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13102694198768272642,763093320779350386,2097152 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,11164161851502755257,6380905291374528894,2097152 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12204134325228439994,349282285785564326,2097152 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,1395038136956454600,16980131221621882626,2097152 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,6418196575518921457,15030131972588993877,2097152 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,7017613309034427024,1384439106510685662,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16924558661537436914,17362939933705668578,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3450748723805220481,1510303301841373320,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3450748723805220481,1510303301841373320,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,4702780756569631323,2883687535304016519,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,4465497697848035273,15965167553229218206,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,170086559698971972,16823505142781567872,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,16144461179131771062,6209465541536429177,524288 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=760,i,13980255405617365323,11687857553898436866,2097152 --field-trial-handle=2348,i,2046420216243392866,12603663804297148197,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e657031f90273c5bceb11b2d971c7a37e88a7bc7e72ba676d0b9597760ef849b
MD5 155d6aeb9fc2842249d79736f4cf5202
SHA1 18c99e044c051877cde8de98ae8b29f6d164d2b0
SHA512 17cb704d8d1e7bdf4d6e404bde52e81f0a6d4244246b955b87a19730002388602d3341e27a16345d110ce53334998460a3031dde8a53a6930b3c2e984ad2ee28
TLSH
T14A715F302202C06EDBB3C23374E22EF3B07250CAF95FAE751160ADB53946B91AC1E5D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5881cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5881cd.TMP
Size 3KB
SHA256 7d6ff2cbd3c4976ed51e1fd5cd993ed5624d8979b3303a44908093d30d9cc066
MD5 f80d436d03adf08815ba41ce6893a6fd
SHA1 10fc86b71d034d78ac220f5267afe7bf65afcd52
SHA512 abbc421e30824c0542af732d0f9aace0ae1698afe59c6710dc2716438abd8a3f5cb0f82b864155d5219337f2fe2383cc08d6228540c03c898aa52a535ef879f5
TLSH
T16C714D302206C46DD3B3C23374E22EF3B47544CAF99F6E7551606D743441B51AC1E5D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d101a089b67991d00d5dee8293323367c461a3bfd9c4fbc1dcd8fd40cb392c5d
MD5 b392b230c5c69286000c41b526fdf304
SHA1 7a2dedc63062f0d5d01a52e1c796eadd8cb0fa88
SHA512 17dc5feab4203a19440cb2e8406c9af6541ffd1559bf579ff37bde7622e2ecc7254db740912663d51ebbe793930a5ef610679bd86f97b80c275ecb17dbef70ed
TLSH
T15F216AB383E185AECA0156F09A14AE2BCE2D0516436C7D59C6D4EF2793B3475E00695B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 131c7b2ae5b5842135332d1f1430a1a82f69827567e88ba94d5e7f5c1130d45e
MD5 242e1c71c34785e185ee2ef63474ac02
SHA1 b199c3aa06504c3b5e2c2973b3265ce9313d9e38
SHA512 f6894148836d7c55454c879325964908120feb66d5a54b322ea042393b94128d1166da9dcb3ed818599cd29998d38f9ff914e8af9c7e2cc0bb73eda8b51e2586
SSDEEP 192:sxZCRbyM/jK1Ml8Mkj/fgstFGIdpBWHW6+WNEyh/YIqxu+pIgrJ:sxZC9Mj/fgstFnsHbL/fs9
TLSH
T14B52F8016A34A97BCCCBD209FA45BF53D6F44573A2901E44A9FCDA1C04E6AEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9770656755833e9aae97f7369b0229a9c71f6b4c493e638477656b884a914af2
MD5 50993cc94e9a36a5e9c17cea69476a47
SHA1 df6639f638ced0753ee3bdd5590ca0e85c0b63da
SHA512 c5c911ba26e633f5606281df251edf8e143c8c8bad1c77c1a2aff6b28330c515a0cc7fc6d4cc249fbd8a1b87601bc76da98529e96a0353a0b2ba7b432cf0bef4
SSDEEP 192:sxZCRbyMojK1Ml8Mkj/fgs8gGIdprWHW6+WNEBGXYIBsDoS+pIg50J:sxZCQMj/fgs8gniHbJXHsTsm
TLSH
T1A452E801AA346977CCDBD209F945BF53D6F84572A2901E44AAFCDA1C05E7ADD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 820d4c5887221bd115509cff29dec7924c07b0d59494ce5ec84d9073314d6603
MD5 40a136b5a36ddcf0f8d5e751b0371416
SHA1 e5f10d68312e95e234c1f5bb7833f68ed7927bd8
SHA512 9cf104643eda52482ec027c380d5f2086f702c4f61cacb4a37abd980b7f394a4e6f8958f031c5e92e39b883d4ade9df2e422c6270b6d93a6b6f4da6fdb2f3fe3
SSDEEP 768:BpsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9iro0la:BpsqxXlWvJD6Tu1ja54LAs950o
TLSH
T170D21B3B694CC77D4F840E6DEC266ED76ED801CB96988D5447FA880C03CB3EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c07bdbfb4fc495cd35b91ab69158625486d4c4f4e7e7200205a8f9ffe0c5b96f
MD5 23ed7fd58dfc5abf7d156d17ca7f40ee
SHA1 5e1621a5dc181fa3eb818c7538cfe70a6c57576b
SHA512 eeb680df76c5858f59caabbf7d146fa31d39b2e6dc00c9bff347b374b4ffe5b8864a89414fc39a56c53a1479a0b627a703ef73407bd1ced6dd5a213f798fef7a
SSDEEP 96:KYbaKYIKGG0Kra2qyQKXqgPSKA0uSMAKhml:ExTjHOJz+
TLSH
T190E1771A713A4652397E2898B3A686775F4236633008B46F3FB840B54E6FE125DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591795.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591795.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 290b8301fa0d1ce99064203255d0046970a9c2bbbf51c53311468d1500c454c0
MD5 e35d2e8abf5df0f6b014edb08ddf5c07
SHA1 13235dfe70c63801c3214c10130a2d920cbe3d62
SHA512 00d97a7e154df9d28f61135c1419f364138c1ad621ef4665d91b0790fc5db37d4f400b768e0e8ade3ff5a7195f4d1a1a16f0ca88268781d005b3c1c11a75c071
SSDEEP 384:xiiFiZcIOsNz8TUNTUlIlGKanUbbYHPVRNEOz/9aVM5xuvzxV+Mhdp6fLoI:xpFQOqwg5Be9HEOj9aVM54184p6fLL
TLSH
T13AC208F258D75C7AD9AE5747EB7E2E034EBCC063B584A950B3885A0CCD961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d41c2d6c651fd3644b01b9351714f9dbe9018af4348a199284ae1f52b128a3bb
MD5 d343e55c216091fb10e0bd54a610d35f
SHA1 5ccc7c46c5549e53575dbdd4e7236959f5f0eb6f
SHA512 99e2315ae87011f626f6acafc440f3d2744e9d5c0fdcbdef5c5212b4229f9e72313b5e43ffa7e2d8ae41783843d405f75e1f4d5e1d29854591e7228a50b1fc9b
SSDEEP 192:tONnd6JkRtQmiUyXPW+RNEOmAeR1h3MNRAU6:tONd6UrYW+RNEOzoM8U6
TLSH
T15802E835AD382C7B9EF2AE09F94B37175FE4106BA9852F80DAD81F0C01D765C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7135d8fd32499b8ca7b0fd26e370181f21b535cb5d1bbf01a843e9d15a7497d2
MD5 7fe0a192862a091a908486eacc6f0b85
SHA1 a36210634641e87bd5accc1089808f25fb748612
SHA512 f5dbb0d31209e5046fc9aaec3e4e4470d6cf8389583ecc32ede31767db6c4b3840ba71c660a16c15c9fa25873b50b8e46e193591d412f878b72f425e480cb309
SSDEEP 192:u8LsNuUvQ7aRBUdKkRb96QmiU1P7g4VRNEOmAeRi99anSRMODqwOU8:zsNuUvKanUbbYpPVRNEOz/9aGM5U8
TLSH
T11B3219327C386C7B5EE3A544F94736135EA49127EA892F90D5DC5E0C02DF69C130E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 acb938ffc01a606aa7ec13d641f035ece55cc1e187ecaa8d12741d8113b719a6
MD5 5ca1ec3df118983acecead43597c4107
SHA1 2014372dd09b2d65a5574c1e604113b41afff2b6
SHA512 6d86190f08330f4c148dfbbb2d322e953e55df9d5327b4ab93b1b94d651c498771d9bcd3434c85bc87e1f1f63f2607251d1e07649aa7f5329519b3ab95d09c56
SSDEEP 192:uBLsNuUmQ7aRBUdKkRb96QmiU1P7g4VRNEOmAeRi99anSRMODqwOU8:EsNuUmKanUbbYpPVRNEOz/9aGM5U8
TLSH
T1364219327C386C779EE7A544F54736139EA49127EA892F90D6DC5E0C02DFA9C130E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3dd577f24d5a76517d29215fdbcd4abefb97d1e4eb8685ec1b1ce8c4bff03fe6
MD5 52056e9fda95c15070b0421fd71c60bd
SHA1 1759fa54d9bae15c1d303e25f100e250ac787eb6
SHA512 464de3ffe403d65dd3f98fb0d02ccceacb92666da6d3bcd953e8448d1de723806110116af2ae3d6ca0536d5b8d3890a3eed4f2e7a5f09582f78049a7b03ca78a
SSDEEP 192:WON86JkRKQmiUyNPN+RNEOmAeRi99aFVcMODqwOU6:WON86UGEN+RNEOz/9aoM5U6
TLSH
T15B122B36B8386C7B5EE26845F88732075EA85127EA897F80D1DC1F1C02DFA9C130ED26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7be4c9ff-e663-4f86-ab0f-b4fb5f938326.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7be4c9ff-e663-4f86-ab0f-b4fb5f938326.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1bc6a6c68d5e2f116f8cf2ba338ce3844e4ac0e877ecaa0198a5a7664661db86
MD5 6b3552cea141f20e2697bb79e6bd80a0
SHA1 34e5ac2fbf67fad684cb50f13521e347ff75086e
SHA512 f2e713f3fb76abde5d00cdba521d3e58fe4a46b8e07aa3fc72dd632fb70d7a4ca94ccb5bd8d62b7ff0f2f9dd67c4209ebbbcb668592d97005d0716cf24705632
TLSH
T124412B58B6EA1148B3B76E5AAFF7A86D447FBD372E0AD45E00110E4F0A66B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads