hxxps://winandshine[.]asia/bonus/all-cc/lp1/index[.]php?ctc=9[.]99&cs=64zhv85ezbpz0&k=2421c00deed621c1491cf8a29b49b0ac&country_code=FR&country_name=France&region=Occitanie&city=Blagnac&isp=Orange%20S[.]A[.]&lang=fr&ref_domain=www[.]radio-en-ligne[.]fr&os=Windows%2010&osv=&browser=Chrome&browserv=150&brand=Desktop&model=Desktop&marketing_name=Desktop&tablet=4&rheight=768&rwidth=768&exchange=eund-santaads-owa-cpm-rtb-bn&rtb_id=FL8zskVUEG458nITWYrdeBOjvPkbDXLPu3h2NdWf6o3FFYENFHMWa8pNFohyFF6hQ4U0MDSbjCQQ&chkhm=y&mod=m&e=10

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://winandshine.asia/bonus/all-cc/lp1/index.php?ctc=9.99&cs=64zhv85ezbpz0&k=2421c00deed621c1491cf8a29b49b0ac&country_code=FR&country_name=France&region=Occitanie&city=Blagnac&isp=Orange%20S.A.&lang=fr&ref_domain=www.radio-en-ligne.fr&os=Windows%2010&osv=&browser=Chrome&browserv=150&brand=Desktop&model=Desktop&marketing_name=Desktop&tablet=4&rheight=768&rwidth=768&exchange=eund-santaads-owa-cpm-rtb-bn&rtb_id=FL8zskVUEG458nITWYrdeBOjvPkbDXLPu3h2NdWf6o3FFYENFHMWa8pNFohyFF6hQ4U0MDSbjCQQ&chkhm=y&mod=m&e=10
Sample260729-lze3lstses

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
628	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297926869542222"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{64597216-7461-4527-8145-B891E06F859E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2016	2548	msedge.exe	87
PID 2548 wrote to memory of 628	2548	msedge.exe	88
PID 2548 wrote to memory of 3852	2548	msedge.exe	89
PID 2548 wrote to memory of 3852	2548	msedge.exe	89
PID 2548 wrote to memory of 3852	2548	msedge.exe	89
PID 2548 wrote to memory of 2296	2548	msedge.exe	90
PID 2548 wrote to memory of 2296	2548	msedge.exe	90
PID 2548 wrote to memory of 2060	2548	msedge.exe	91
PID 2548 wrote to memory of 2052	2548	msedge.exe	92
PID 2548 wrote to memory of 2060	2548	msedge.exe	91
PID 2548 wrote to memory of 2060	2548	msedge.exe	91
PID 2548 wrote to memory of 2052	2548	msedge.exe	92
PID 2548 wrote to memory of 2052	2548	msedge.exe	92
PID 2548 wrote to memory of 4696	2548	msedge.exe	94
PID 2548 wrote to memory of 4696	2548	msedge.exe	94
PID 2548 wrote to memory of 4696	2548	msedge.exe	94
PID 2548 wrote to memory of 3476	2548	msedge.exe	95
PID 2548 wrote to memory of 3476	2548	msedge.exe	95
PID 2548 wrote to memory of 3476	2548	msedge.exe	95
PID 2548 wrote to memory of 4944	2548	msedge.exe	98
PID 2548 wrote to memory of 2952	2548	msedge.exe	99
PID 2548 wrote to memory of 4944	2548	msedge.exe	98
PID 2548 wrote to memory of 2952	2548	msedge.exe	99
PID 2548 wrote to memory of 1160	2548	msedge.exe	101
PID 2548 wrote to memory of 4440	2548	msedge.exe	111
PID 2548 wrote to memory of 1068	2548	msedge.exe	112
PID 2548 wrote to memory of 816	2548	msedge.exe	113
PID 2548 wrote to memory of 440	2548	msedge.exe	114
PID 2548 wrote to memory of 440	2548	msedge.exe	114
PID 2548 wrote to memory of 1884	2548	msedge.exe	116
PID 2548 wrote to memory of 1884	2548	msedge.exe	116
PID 2548 wrote to memory of 4536	2548	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://winandshine.asia/bonus/all-cc/lp1/index.php?ctc=9.99&cs=64zhv85ezbpz0&k=2421c00deed621c1491cf8a29b49b0ac&country_code=FR&country_name=France&region=Occitanie&city=Blagnac&isp=Orange%20S.A.&lang=fr&ref_domain=www.radio-en-ligne.fr&os=Windows%2010&osv=&browser=Chrome&browserv=150&brand=Desktop&model=Desktop&marketing_name=Desktop&tablet=4&rheight=768&rwidth=768&exchange=eund-santaads-owa-cpm-rtb-bn&rtb_id=FL8zskVUEG458nITWYrdeBOjvPkbDXLPu3h2NdWf6o3FFYENFHMWa8pNFohyFF6hQ4U0MDSbjCQQ&chkhm=y&mod=m&e=10
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x248,0x7ffe7821c188,0x7ffe7821c194,0x7ffe7821c1a0
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,3505594930931861537,12930731852975347930,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - System Time Discovery
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,15144702320329709952,4749829447314372778,262144 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,13947118941939776886,12139679279513280567,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,10436078784157133239,11377346803341028256,2097152 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1268542745799907482,15951245614864844139,2097152 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,9508964998966366561,15458860500605819990,2097152 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5252467502368044655,7937368929168794463,2097152 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11315523251345387418,15782006968165919064,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,16799167283921363192,10997707999923810061,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7036177517018305563,16450872071211073285,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7036177517018305563,16450872071211073285,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,4308543733362417693,9483260389326761640,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,6944189584433033595,12142383567755519244,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,6579922924625770066,11376630888782685856,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,8942023350303355585,12650173948737959588,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,3598153228362963733,14049127595842785643,524288 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5788,i,8820016549243798138,1294507657710364236,262144 --field-trial-handle=2344,i,10081677742202514364,513318174700306344,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 933f135278de640e184eb7b68ed7955bbe3f69ed6e283a964aa4addd9a6d09ee
MD5 df4e257d3e8cfa3c2488e6d99e51f537
SHA1 907a32a41ec42464248f3c62f360f15ac5438fc9
SHA512 a248e3c383658d77b82a4d3081ea05874260fd9a94d88c3128f476b1916a314872becdcab4c427622ba1b89e72fc0b8fb916ef2930416557babe711c4e647e5c
TLSH
T1977181F4090B8B61EF73833AE5D2128471BEC5D8F9835F5E51E05B3D2088FA1CA79566
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589dc2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589dc2.TMP
Size 3KB
SHA256 116dcdfbe42f0d27b0cc1ebdd1af98815bcd6bb5298acd48fa8b884a6606600d
MD5 6e8bbb0a8ecb13742edc98d446c0b12c
SHA1 a0af5fc4d487040a8a749abf5518fd902ce9062d
SHA512 8cea80913872bae4bf0fc4e86197b72fcdab3ea3e47c85b4a7d699a966b6f2e5407b149e89ddbfb695afce9f988797a98142c3dc1bba8f4b4d08578bedab142a
TLSH
T1157181F40A0B8B61EF73833AE5D1128471BEC5D8F9935F5E51E00B3D2488FA0CA79526
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4f3b6c4ce252d1e9330c823004614a292cd18ca9361554c216d1d807285342b5
MD5 b9d1f34fbf5a014e1afdbec930f39bf0
SHA1 7b0dd6741a67cc78a1453bcd46b843f4a22e0b59
SHA512 9bb4d96c84468e9ab25458cf210d2e4db899f35a5a1c5d9cd218c53ef6d01eba5e7ca30b6c4b1234c3e27f2df347c13f08b9a1ee8fc753984cf5a452bd60320d
TLSH
T177117DB7C7D5856E891116F06A24AE2BDE2D0605831C7C1989D4EF2BD3E3075D10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 236912ab54b2ef41c6ca2e9f90067794b2821cf06cb459b595866b3941c927a8
MD5 016bd10343890af0dacc3e7df8813887
SHA1 5f7aac9b2edb8f245747d0730b4e21044b96b4a6
SHA512 eb43be0f0ec150732aa3d96caacd7d9ae491c9566e76a80d6471ee7b5a4514655a7ffbfa70531cc0aa93ea4cac0daf4aff1d9216cf4d90c0b650269c8c75297a
SSDEEP 192:sxZXRJyM/jK1Ml8MkF/fssS7U3IdpJjHW6+WNe9y/YClWrgIVIgrJ:sxZXbMF/fssSIY1Hbd/KX9
TLSH
T1C442C8166A3899B7CCDBE209F955BF53D6F90972D2900E44D9FC8A0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 97dc7519f2da9047f15b288fd9559754d36e5f37e3c19190ef3c65d23a52b89b
MD5 48e3eb9fe6e6ac4dbcf94c4cc02ac450
SHA1 9c9bacb19e0ce67f7484d92bf4c981876d8119cd
SHA512 d2afb9d76425c256e7bce96bc7e579f161555c5013b3d66b4cd44df4d28568daa964bb690d5b0d9cacf7da641f0a16a54bcd9ed063e7ce42e4c3d181f4f4345f
SSDEEP 192:sxZXRJyM/jK1Ml8UQdkF/fssl7c3IdpnjHW6+WNe8dXYCMLrgIVIg5BJ:sxZXbq2F/fsslIYjHbTX2XJ
TLSH
T1A652C8166A3899B7CCDBE209F941BF53D6F95972D2900E4499FCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a248cf1dace848b8b4610754f488c07ed31909b05fb3b1a6de3ad3ed543067cb
MD5 38405e892d48652d74fec61a17c1b8a6
SHA1 a24c355c7c58bc31e8870f230b44d42b55af8ebb
SHA512 05c6f51dd2419b2eff504114becedadd3086d6a0b08769c775a72bff0aa53b276226117a593d7b2e5ea2583f4d7c71c6674aaa8f3d38883b9ec33c1c395143a0
SSDEEP 768:rg8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV6roN:rg8bqn+WvSCt6u1jaCZLbWVxN
TLSH
T154D20B3B280CC77E4F845E5DDC26AF962DD802CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593985.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593985.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 06972448fd440a32391efe409a9a2daf2643c265b5541b53aa2299bf6e0bed7f
MD5 93f82387657d5b69a4c4351e093d1eb7
SHA1 09901a2a7329ebc161bc678ee5bc66a1d0760a9d
SHA512 b933f570327ff72e43f035239a1ab0b2e865246b14a7b45f014451fc17da515d4dcc0f3ac13a2580c3308ce7b2c98949e1ae47ce8ea96ff3854e2e0b3651d3e8
SSDEEP 192:uGm+xasuheOwQxMGsNkqQgls9MbiYMQmiU1bwF4Ea+jpOmZv6Bam6q+ScjmqYoJk:0ZcIhsNkq5K9xdOaEa+9O5r2ScjmwSj
TLSH
T12A928E336D389CB66AE6A555F88632238FF88173D6C81B54D5EDAF0C00D65AC1317C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e87c47bdc5cf29f79ea324564ec86ca1e9438ac5ed006bb2dcdee3b195b261a5
MD5 767b673396053d62e22f0e0fbf6ed17a
SHA1 107c3dc030f3eb24c5a3119941692b143a564a60
SHA512 5e84f5110a9bd6aa9858922f95a2e5eaf1a610de97c3295f1a7b5d4063a9e84f4d52c703e6a5aef3068e1c5ba2602b7cfbf3d63c32c54e43c1d9cd4eaec549e7
SSDEEP 96:EqONkCQsjpf1bxX5ih/cIPURHl8h4otop55nD7BfPgvE5BzatIRdy+plOmZ8CoKx:vONa6Db6QmiUytFHBa+jpOmZvxRgUFU6
TLSH
T13E02E73968786CB79EF26E49F88B27276FA4103BD9962B50DAD85F0C00D764C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7b749fae07fcc41017ff834a59bd456ee9cfe9e759d03643d8c08a8de3c906cb
MD5 a361068cfbaaf30444e78267d3540c04
SHA1 59ed375e78e011e710541399b501c483cd0f5f06
SHA512 4d64f670208e31d104b50e96c93f15ae0b836ce4989cebf03b6168ff906cc8feee8e7e9bd4465133dd735327a0354caa71c7d58fa99e5fea31e206207078e0e6
SSDEEP 192:ukm+xasuheOwQxMGsNkXQgls9MbiYMQmiU1hwF4Ea+jpOmZv6Bam6q+ScjmqYoJk:WZcIhsNkX5K9xdIaEa+9O5r2ScjmwSj
TLSH
T15D928E336D389CB66AE6A455F88632238FF88173D6C95B54D9EDAF0C00D65AC1307D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3a18ee9c6de5bb5dab82b0ac155cbfdcca7d6610e4d94ff091bd2db683a30f8d
MD5 47ad6b7985f525f01a5764340c41317d
SHA1 60c96bcb9d03ce9402c3a699c83dc230b16902ee
SHA512 30574f60a35d0d88fa5dd149c8e104b8011ef6a60972bf43cff9a4c2b86d1b0b12c11987bcc69e8e36ad629f2e10f5fd9b3c4cf3a4e9177241af491fc835659b
SSDEEP 384:ZiFiZcI2zsNs8TUNTUlIlX5K9xdIaEa+9O5E2ScjmwSj:wFQGFwgDK94RaMO5E21jGj
TLSH
T1D9A25C339D68CDBABEE69A55F94A32138EF84173C6C5AB94E6DC9F0C00D659C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fce1cf4219a2470bc0daf73ef5df24219eda6f3101e2e8a07f8d4ae10b12c6c7
MD5 9e750386e6d30ae1741b44be5d19b2b8
SHA1 228d566635f56c3137f3be8f8a23ac7510ae625d
SHA512 6501c9f3aad8089c6eaa3e6a93407d3b625d645a69490b87fedea6fa43a1f0f87e877d51b645212f452b93cd861736db4ac049fab8d429a6e4c08047e0715219
SSDEEP 192:vONN6DbkQmiUyGFGBa+jpOmZv6NNz6q+U6:vONN6sjGBa+9O5j2U6
TLSH
T111120A36797C9CB76EE26594F88732179EE84127DA8A7B90D5DC1F0C00DF95C234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35d49229-1955-4e9b-a9b5-39c62a38bd63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35d49229-1955-4e9b-a9b5-39c62a38bd63.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 89273286c7d78527700fc87f78393bb1223024f0f53a32d03b2ce1995532375b
MD5 8f8c2efad198ef0d33b393f11f7faa96
SHA1 ecfee3e466ac7d6f7b39e4433b68fc8851ea21b6
SHA512 25c0b718af1b1a579418cecfe5a8e2a679d14de2f98b18f3164ba82741f666fab44ffe445de13f66507fc611631e39861b4f4a23b2a306ccba48aaff2922b25f
TLSH
T1A341265CBBE91148B3B73E5A9BF6A96E487EB9772E06C49D00110E4F0672B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download