hxxps://tixeo-qual[.]technicatome[.]com/meet/join?email=sam[.]cuvilliez%40edf[.]fr&action=createAccount

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tixeo-qual.technicatome.com/meet/join?email=sam.cuvilliez%40edf.fr&action=createAccount
Sample260916-thy36a1tft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340482569897988"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{D2413F5C-6E86-46F2-9518-6B083AD42E96}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
532	msedge.exe
532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3192	2240	msedge.exe	83
PID 2240 wrote to memory of 4356	2240	msedge.exe	84
PID 2240 wrote to memory of 4256	2240	msedge.exe	85
PID 2240 wrote to memory of 4256	2240	msedge.exe	85
PID 2240 wrote to memory of 4256	2240	msedge.exe	85
PID 2240 wrote to memory of 4260	2240	msedge.exe	86
PID 2240 wrote to memory of 4260	2240	msedge.exe	86
PID 2240 wrote to memory of 4708	2240	msedge.exe	87
PID 2240 wrote to memory of 3292	2240	msedge.exe	88
PID 2240 wrote to memory of 4708	2240	msedge.exe	87
PID 2240 wrote to memory of 4708	2240	msedge.exe	87
PID 2240 wrote to memory of 3292	2240	msedge.exe	88
PID 2240 wrote to memory of 3292	2240	msedge.exe	88
PID 2240 wrote to memory of 4292	2240	msedge.exe	90
PID 2240 wrote to memory of 4292	2240	msedge.exe	90
PID 2240 wrote to memory of 4292	2240	msedge.exe	90
PID 2240 wrote to memory of 1328	2240	msedge.exe	91
PID 2240 wrote to memory of 1328	2240	msedge.exe	91
PID 2240 wrote to memory of 1328	2240	msedge.exe	91
PID 2240 wrote to memory of 1156	2240	msedge.exe	95
PID 2240 wrote to memory of 3352	2240	msedge.exe	96
PID 2240 wrote to memory of 1156	2240	msedge.exe	95
PID 2240 wrote to memory of 3352	2240	msedge.exe	96
PID 2240 wrote to memory of 3012	2240	msedge.exe	98
PID 2240 wrote to memory of 4508	2240	msedge.exe	108
PID 2240 wrote to memory of 3068	2240	msedge.exe	109
PID 2240 wrote to memory of 2764	2240	msedge.exe	110
PID 2240 wrote to memory of 860	2240	msedge.exe	111
PID 2240 wrote to memory of 860	2240	msedge.exe	111
PID 2240 wrote to memory of 860	2240	msedge.exe	111
PID 2240 wrote to memory of 4208	2240	msedge.exe	112
PID 2240 wrote to memory of 4208	2240	msedge.exe	112
PID 2240 wrote to memory of 4208	2240	msedge.exe	112
PID 2240 wrote to memory of 3920	2240	msedge.exe	113
PID 2240 wrote to memory of 3920	2240	msedge.exe	113
PID 2240 wrote to memory of 3920	2240	msedge.exe	113
PID 2240 wrote to memory of 2132	2240	msedge.exe	114
PID 2240 wrote to memory of 2132	2240	msedge.exe	114
PID 2240 wrote to memory of 2132	2240	msedge.exe	114
PID 2240 wrote to memory of 2328	2240	msedge.exe	115
PID 2240 wrote to memory of 2328	2240	msedge.exe	115
PID 2240 wrote to memory of 620	2240	msedge.exe	117
PID 2240 wrote to memory of 620	2240	msedge.exe	117
PID 2240 wrote to memory of 620	2240	msedge.exe	117
PID 2240 wrote to memory of 4736	2240	msedge.exe	118
PID 2240 wrote to memory of 4736	2240	msedge.exe	118
PID 2240 wrote to memory of 4736	2240	msedge.exe	118
PID 2240 wrote to memory of 3200	2240	msedge.exe	119
PID 2240 wrote to memory of 3200	2240	msedge.exe	119
PID 2240 wrote to memory of 3200	2240	msedge.exe	119
PID 2240 wrote to memory of 2004	2240	msedge.exe	120
PID 2240 wrote to memory of 2004	2240	msedge.exe	120
PID 2240 wrote to memory of 2004	2240	msedge.exe	120
PID 2240 wrote to memory of 4988	2240	msedge.exe	121
PID 2240 wrote to memory of 4988	2240	msedge.exe	121
PID 2240 wrote to memory of 4988	2240	msedge.exe	121
PID 2240 wrote to memory of 532	2240	msedge.exe	122
PID 2240 wrote to memory of 4144	2240	msedge.exe	123
PID 2240 wrote to memory of 4144	2240	msedge.exe	123
PID 2240 wrote to memory of 4144	2240	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tixeo-qual.technicatome.com/meet/join?email=sam.cuvilliez%40edf.fr&action=createAccount
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe28f5c188,0x7ffe28f5c194,0x7ffe28f5c1a0
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,13659954711877915660,6955364216691574261,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,15411781389142312824,9119200252270731015,262144 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,4876540142823135476,3113736280554524005,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13828207663825573231,15551267472561901331,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2388490909048817816,7361798254305809238,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,16053630885037337685,16217240129011574085,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6860457771344476476,2213160290899709220,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,8061184487790108082,16308701394824413213,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,12250411910358328129,13544355317128678038,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,3546786626826254773,6534199997750509856,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,3546786626826254773,6534199997750509856,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,7191130120886331305,17148186806782764293,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,15965746345265358143,7111469429145851909,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,10482325901137328555,18055896156502953899,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2624,i,7419666281851128204,10011265973762216971,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6324,i,17101704406894122028,2302972673441693093,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6292,i,6143800861968631768,16385720601057191932,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6120,i,18374287399167065444,7697447555578194284,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,8221142549981508379,15996569410214437785,524288 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5332,i,11781256451530394556,6442910054119553736,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3644,i,14997027268751559642,16348121723653639947,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5332,i,9815789335668289899,5202927902485286739,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6456,i,8154518400390704959,4120827396368561967,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5348,i,12232222475157722420,11573065542416564888,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5884,i,16924934234434275856,5125932954367082310,262144 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5680,i,14003966146967637293,6003045934072036688,2097152 --field-trial-handle=2796,i,11297804402192959974,18215206974688743419,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 edd9d48661c733142555000989a15e7ca94a24de1a8e9b871e6a65c2fcef7987
MD5 588805ef73cebb59bea5d996b6680472
SHA1 30b27ecb52b4a94efe951db1023a5d28db43a5fc
SHA512 8ad12d72a72e319720d41de00528b203935a10f7cb782a95186643abd7c24045ce09f314fffdaa2c87fe86e2982529b7fccb7f37466a77a1b81f6d892c6db7ab
TLSH
T19D51A4C0A584C161CBA854F086D126A33737767BE9C3DE830D48D9BEDB4A736D0020DE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 35fd4f5db317cf17d7a9339264c94d04fb08c9414f8c0b3fe15b13c9fa8e5cda
MD5 e744f05fdc318ec5f901963c962c9ba5
SHA1 b3d5a6f45b507498a97268cf99505a307478c4c8
SHA512 576ed6843bdf1e44ea6406b3bbb1d82189b8f915f24159827996cc2a8a17e4228d47e0ad30298014eccf3a07147749816f20bcfd8772154d6c6aaf2ea380adf2
TLSH
T1B7019CF7C3E8956E8E0156F06A18AE1BCE2D0906832C7C1AC5D4AF2B93F3475E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9ee41a1645ebfee1c4ba1bfd17379b89102c9b3b850a8ef76601b0ff1571fbec
MD5 f89f2ad48c5508e18536b873af9f5323
SHA1 a1cc2dd6ed3870303ef37105dcba6dc0b6fc1137
SHA512 7dfa483ee9d336a5626b7a2dad21a398229621c6625d40d1a6fdeeb207255518fc108c6be8fde659deaa3702bc5c2943a2160153977db22fa55fca3273c27ada
SSDEEP 192:sxZiR7Wx/f3sBvOIdpJHW6+WNGY364nkIgrJ:sxZigx/f3sJfJHbGX79
TLSH
T13F12D7566E28A53B8CC7E20DBB29BF53D6F9503261D51E48EAFC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7c1ba06255fbb2ddf1af09ce6e8f76138985a79ccab83216ae8ffbc5f1cf1bac
MD5 b8fdb57622aa94b721dccfc45331c67a
SHA1 0c3d7c41f5548581b70814e0fe23796b1fa637bc
SHA512 9aa71dd2c0f145faa897a8012d0a08ac5dbc649b5cf76e712d849cb6dd93c136c86204e3f480490066f6248e088d5fe255c574d45e959400c25866b56279212d
SSDEEP 192:sxZiR7Wx/f3sivTIdp8CHW6+WNGY36AnkIg5TJ:sxZigx/f3s4MfHbGXjX
TLSH
T1AB22D7567E28697B8CC7E60DBB15BF53E2F9503251911E48AAFCC61C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 08d306991c26d4ba189b5f75140eb91f8cab7b7e31ceea20d537b6a695ee1a1e
MD5 57342ad49d68345b8f09a51f2425568c
SHA1 2cd31f95c91548fc981598a2c6db184076c22382
SHA512 a9765c1bdec3af4ca399a0457a9da978589e828a0580c5b80c6b4500e7b7257e12bd84f5c9a5378b508e53d123da01daef63bf2a57bb01ebde791c58ba3dfb41
SSDEEP 192:sxZiR7Wx/f3sivTIdp2vHW6+WNGY369nkIg5TJ:sxZigx/f3s4MUHbGXaX
TLSH
T1F322C6667E28697B8CC6E20DBB25BF53E2F9503250951E48EAFC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 75095e2a990a845f555bdc9d69b995f3611a412ecf9c4b04b52bfdc005d8931c
MD5 cea1a584d421d103784222bf74a3fe90
SHA1 4b7ca4abec941376b9eb1b31c633497ae58df8f7
SHA512 c32b8f5babc2d735959626513a65867e082a2e02bbe5782bfd136e100a15fe09d56df0e494f18eb8bf67c77488342a06c82e18572e19ec9cc0b5e86642e8f0c6
SSDEEP 192:sxZiR7Wx/f3szvOIdpJHW6+WNGY364nkIg5pJ:sxZigx/f3szfJHbGX7x
TLSH
T16012D6566E28A57B8CC7D20DBB25BF53E6F9103261D51E48EAFC861C05E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 efc1ba2055d1e5e42632ac4ff3d1293f518266bf2b1acce2a175b956cfbde39d
MD5 362a09e92ba8755204778aeb3f0645e8
SHA1 470e2c7ac1c5916cf8225da4d0c6e9b4422cab34
SHA512 910cc29726dee1c9d605965dd1dcdc328fef516d11dd566ae6ea7768b59822cd1f14ff24097ec41b046ca30bd5964d5c86dfa6fb71499f85a3bd15579f1ea26f
SSDEEP 768:f/Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/0ro1so:f/Klm7QWvUYe0u1ja8/L/E/f1so
TLSH
T1A2C2FA3B740CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 88a69a19fa650018f44d9daa3c39f1f474313a09e9c84cbd33e92a422f3cec81
MD5 0f8548513401b9887d153b1d8b45e223
SHA1 1ba8d9871ec6aa538e4a36efa09971557a14a3d9
SHA512 0a2a98bf6a6ebf908fcdb47cba613d97b0350f73d5b60eebd820bbb532bb8c34a06a32d01fbf14656cc1f588ede34792c6ad23b0a45c67e504d5e42586f2dd11
SSDEEP 48:K098xN/rvQbjWDISFQK9F1nQxVAYGH99yLGDGmGHGjGNGlG1G2bGlGoG9ISGjG2B:KE6kKbqCeDyKcEfHCK8QKPypWCEgkoIT
TLSH
T16C910710717B124038BE746494F49B5F528232733419E62B7FAD25A29E6EE044EFEDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 901b6a97c4e26e88456839c0aed48a8e9400581384fb980fd8bcad2e1831c22a
MD5 64563dacf8a9e0edcaa4bfe7e4226775
SHA1 28835629791a7272e7582c5e18f2d278f1cc1c5f
SHA512 e3787e373cd4746a32e1ab9ad0d917bfdf35029163e49ee3f0dd998b16e5237ea9fd1755515a96682b37cbcb4098bd75b31cefdac80d55961ce7cc60ee4e3f00
SSDEEP 192:uI2sNOoQhhN6SUbe1QmiU1Z7Ta4h//ZsPC7nQezMaoZ/5LqymK0:QsNOo8N6rb4/Fh//ma7mDXm7
TLSH
T1EB424A7A7C74AC3A5DE39581F4423A139EB480A7D6C92F94DADCAB1D02DB1986307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 38d82edffe6e65cddb684ebaeab12fb11bff6df5d6885b0c8a716e009c5ef5bc
MD5 b8c8bb812f67d5e850fc2ca4aed79b96
SHA1 99e3a18bb024aba7c1b1bfe38e227f1d01d7a7f8
SHA512 fb1994eb015160fc3beea539f8f32652adfa372438d7b4aa2d52c922fb910d795c390c1c50ec5d56fc24e0c9653c34cea539c2a4bc50787d7f4837443f3dca73
SSDEEP 192:uI2sNOoQhhN6SUbeqQmiU1Z7Ta4h//ZsPC7nQezMaoZ/5LqymK0:QsNOo8N6rbZ/Fh//ma7mDXm7
TLSH
T120424A7A7C74AC369DA39581F4423A139EB480A7D6C92F94DADCAB1D02DB1A86307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 107eb6b0a0a1dca34f477e949b1991f2d9a04f551b631bc8f0715b7c42cd2ea7
MD5 d8c22bbdd11dfdcf146ffbd2df1b4681
SHA1 f8e5e9e96be5c6e84068d7d82d7c582d18a005e9
SHA512 a4ac70c95e9fc2e2bb3b151ac356602f173951e03470cdfbef4847c27037b3c2ed2b6e95fd6ca8fec412a9262004779739d7aeb84283de511bda05971dde0efa
SSDEEP 384:qZcIssNOo98N6rb4/Fh//ma7mDsa+VYOlZo7:Ist7/upDhgxo
TLSH
T14F827D766C74AC7A5CF3D2C2F88337139EB480A796C96F948ADCAB1D05DA1981307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9fc2016018d74043ff00c51b23adf09fbc856d5a1a2561cc104b8c4ce9e292a7
MD5 347cba6fde1f53d90f9025dcab93836d
SHA1 97d1e1a714bcd63065809deb1f53a9eb9e9469b4
SHA512 58978af4f803d37e448abe35fe1600b7ae46968570ce23c764e1e9c7e6df55bb19c3ac20ddabe187aa9a368d8781509e09a68aa6efbe88eb5771c82a0b971006
SSDEEP 96:KqONkhQsjpfbUmjH5ih/cIPURHl8h4otop5QaDWBKP4v+Y1xf//ojdexVeYrMpPE:BONJ6JUm0QmiUyJGso//ZsPC7dBCT+U6
TLSH
T17802E939BC28BCBB8EE3AE45F4877B239FA4106BD6951F84DAD85E2D01D715C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d74b3bd98a85260fd707bf068932fe2574465861167d5d175487258b47210710
MD5 935dd145c9212e2ce8f21e1f7ecfddc9
SHA1 0f9469a27e85a2228f9687c70715832d1c6a8f0a
SHA512 7ab89dc62731b37f004dd143bbc39a096ceb2a6f51df587497f4f5f08394813d6cfcaeb40ac60c74575bb81031e728970b395189c6214f758acc1cc0ba692e14
SSDEEP 384:BFiZcIyusNe8TUNTUlIlo98N6rb4/Fh//ma7GDsa+VYOlZo7:BFQH3wgV7/uBDhgxo
TLSH
T1E4A26C776C64D87E9DF79B81F98636138EB480A7C6C9AE90A7CC9B1D01DA1D81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 50de96f729eca44996b27b471ff30ac7bc13686361911156d4b4207a7377d54c
MD5 fd9294077c2a0407e5d53c952a11de4c
SHA1 6800d18d05ccd8cca2615ec32499cde6ae8ace73
SHA512 d4208eabfadd8105ebee0ed4a249489f20bc8e794aa6e8c8aa0ddd85001d0f3b7ad5e631df17df4b78c3d0f51acbe370bf0a183f10aeee0a7ec18534ce0cf544
SSDEEP 192:BONX6JUZQmiUyqG3o//ZsPC7nQezDNxZ/5U6:BONX6+3c3o//ma7/DU6
TLSH
T18F120939B868BC7B5DE2A995F48336139E744167DB896F80DADC2B2C02DF59C530B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 48548d34d1a98b687bccf80c9cac51cb5b43e4a642b1b86167dc81c5f6baf565
MD5 b97b71082a65f5bb86fc4fc76bab35b2
SHA1 20920026ea6a48473e3f6add1b4bbafe996a8993
SHA512 4391c30517a6f82f47f9eb0ae61e0e8e23f5ce860e3b6a4e78037661de946fef572fd49c330e93fe83422c6e80e8212f418905d88e9697a30959a17c27d2f171
TLSH
T10541D758B6E91148B3B36E5AAFF6A86E487FB9772E06D46D10010D4E0A63B40CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download