hxxp://lns[.]germaincollection[.]fr/f/a/fT5Ws6xqSymOwyzMTL3BGg~~/AAA-WhA~/Fp520s69t32zTV5TuVHcJIs1W_0pzFq8OHVbxmvymexOXstFiu4cCAioCKLmIRNPgmGV8TQed1g51DCPNScPTnLJRb2ryB9fld26iUXsKTZ8qWk1eB8lIm2TIXW5A-oA%22%20target=

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://lns.germaincollection.fr/f/a/fT5Ws6xqSymOwyzMTL3BGg~~/AAA-WhA~/Fp520s69t32zTV5TuVHcJIs1W_0pzFq8OHVbxmvymexOXstFiu4cCAioCKLmIRNPgmGV8TQed1g51DCPNScPTnLJRb2ryB9fld26iUXsKTZ8qWk1eB8lIm2TIXW5A-oA%22%20target=
Sample260910-g2dkcafh56

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3448	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334946922864620"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{575FF447-D5B0-4C8C-ABE2-33F8D81B9DE3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 5112	4624	msedge.exe	88
PID 4624 wrote to memory of 3448	4624	msedge.exe	90
PID 4624 wrote to memory of 4304	4624	msedge.exe	89
PID 4624 wrote to memory of 4304	4624	msedge.exe	89
PID 4624 wrote to memory of 4304	4624	msedge.exe	89
PID 4624 wrote to memory of 4520	4624	msedge.exe	91
PID 4624 wrote to memory of 4520	4624	msedge.exe	91
PID 4624 wrote to memory of 4268	4624	msedge.exe	93
PID 4624 wrote to memory of 4436	4624	msedge.exe	94
PID 4624 wrote to memory of 4268	4624	msedge.exe	93
PID 4624 wrote to memory of 4268	4624	msedge.exe	93
PID 4624 wrote to memory of 4436	4624	msedge.exe	94
PID 4624 wrote to memory of 4436	4624	msedge.exe	94
PID 4624 wrote to memory of 4336	4624	msedge.exe	95
PID 4624 wrote to memory of 4744	4624	msedge.exe	96
PID 4624 wrote to memory of 4336	4624	msedge.exe	95
PID 4624 wrote to memory of 4336	4624	msedge.exe	95
PID 4624 wrote to memory of 4744	4624	msedge.exe	96
PID 4624 wrote to memory of 4744	4624	msedge.exe	96
PID 4624 wrote to memory of 756	4624	msedge.exe	99
PID 4624 wrote to memory of 756	4624	msedge.exe	99
PID 4624 wrote to memory of 756	4624	msedge.exe	99
PID 4624 wrote to memory of 3088	4624	msedge.exe	100
PID 4624 wrote to memory of 3360	4624	msedge.exe	101
PID 4624 wrote to memory of 3088	4624	msedge.exe	100
PID 4624 wrote to memory of 3360	4624	msedge.exe	101
PID 4624 wrote to memory of 4432	4624	msedge.exe	103
PID 4624 wrote to memory of 1228	4624	msedge.exe	112
PID 4624 wrote to memory of 4184	4624	msedge.exe	113
PID 4624 wrote to memory of 604	4624	msedge.exe	114
PID 4624 wrote to memory of 2044	4624	msedge.exe	116
PID 4624 wrote to memory of 2044	4624	msedge.exe	116
PID 4624 wrote to memory of 1656	4624	msedge.exe	117
PID 4624 wrote to memory of 1656	4624	msedge.exe	117
PID 4624 wrote to memory of 2416	4624	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://lns.germaincollection.fr/f/a/fT5Ws6xqSymOwyzMTL3BGg~~/AAA-WhA~/Fp520s69t32zTV5TuVHcJIs1W_0pzFq8OHVbxmvymexOXstFiu4cCAioCKLmIRNPgmGV8TQed1g51DCPNScPTnLJRb2ryB9fld26iUXsKTZ8qWk1eB8lIm2TIXW5A-oA%22%20target=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffef3b2c188,0x7ffef3b2c194,0x7ffef3b2c1a0
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15562285383871138865,14048509731353375793,262144 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9881427922957254137,18126128941475104471,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,16433795980154445787,14194784312441815480,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11444934074681835872,16550440110234415120,2097152 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2169122831636693307,13630972969328398633,2097152 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,878249352944540894,4719597139318796441,2097152 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,5712265071531190073,4219640120085776515,2097152 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,2659250322982548241,2600092100576949634,2097152 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,12872794122927347912,2129396017156573272,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,15549131487943778809,4267274186947367521,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7677693025957318140,2315213799917561650,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7677693025957318140,2315213799917561650,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,6359854566069383368,12146781399108620833,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,5065227669758278796,4990832915576495666,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,13836417171633234674,8777187134175620414,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,3960035974571761795,10257420688419618485,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,3195841147264364594,3415363280365691131,524288 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,15176745930278976178,4289078921742897189,262144 --field-trial-handle=2304,i,5872262880876770603,15336320711959645346,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e67de7c61fc77274efa0345625423aa48cafdc17c6761be4a993a299763f22a
MD5 5f8e5752e1a3aaeddb4ed4d0851439f7
SHA1 49051ff7b1d56a94588fa53c9e8dea75942c3220
SHA512 587d6de6641d09ab606b1f3c81465354ca0a666bf1584f0665b6b21a849edb39acaf5130cdacdf717d096fd04aefccf4e497861399ec1ca0c9cb230c5ad705b6
TLSH
T1AC714D3726424955D35020B0D8A91B59F6BDCC9D8D8B3E2A1D908CFFF91A70BB312CC8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d9c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d9c1.TMP
Size 3KB
SHA256 39a6f89cf3ea20a79d310b75a656c575915180ef58bcb6c7b3c946c76a342403
MD5 16f96a35119fbfe1921cb1dd8ed0494a
SHA1 58080122fec944dd9b3702ed5e718007fac2ab47
SHA512 93bb614eb15c122a4fe66233f96478ba6c2ee33e91a58a7eb560b22d0b1d8304955f550569f2f38757b9810d068fcdf41b7701e9c2c426124bd5cde143168ad4
TLSH
T1C771293726424956D34020B1E8A91740F6BDCCAD8DCB7E6A1D904DFEF919747B306CC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9c0c31cd494a9dc9a0d84a3842c592362a5f44af02dc4bfcf02d95e0816f28ea
MD5 1a14af98272b765825248379f9ccf685
SHA1 eecb61e8dddd682d714225092e707a4f7d8d42bb
SHA512 8476eb619755fc616cdf374ef43c8915cb75831c31f6bda6ebd6b4b59f9d780d87ca5cb0a769cb78db37ce2aa1a292518cf2c8233c4914a9832fae68f94fe1a7
TLSH
T13F618CF7C3D5C22DC84256F49B16AF1FCE2D0A14432C3C66C8E8AE6B93E2471D21665E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2efe5669fdd458be79301c5aedcdcc67c612208764a3c88eaf57dfb9602a1019
MD5 35b5dc8ca8cb6c1052fdddfe6e216cc8
SHA1 e958a791704bb3e6fa128a6a49d65bd9b1636526
SHA512 e8a28d2bf41ae0868972fdae297b500c34f7b6cf788be804ff86aa762c0ca81faa29270e2b76d23c419218657b78e9638cac1dc7f3d9c6c4c906825a8149e537
SSDEEP 192:sxZaRZyM/jK1Ml8MW+/fSsMy4IdpqHxJHW6+WNrud/YwumldIgrJ:sxZaHu+/fSsRJsXHbw/X9
TLSH
T11F42F8516A34A97BCCDBD209FA51BF53D6F5053296940E44ADFCCA1C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9c897d0cf13b4d3c6eef22043d1c1de3b2e8f37a4e5075f5afd216c4bd279148
MD5 299ad0b25caafc61423899ecc9b510b0
SHA1 1758254a8f99314f4a7f77f519cbd8d3d316e215
SHA512 d6453a17dd2d7298ba48b5da6c7a1ed8498ee7278ef476c00ddb202cc0ad16bab462e3ba15fd110046d38a45df00cc2a045dd699c38cce5ff145041aea168352
SSDEEP 192:sxZaRZyM/jK1Ml8UQRW+/fSsJy4IdpoHxJHW6+WNrud/YwKTgdIg5XJ:sxZaHqo+/fSsgJ2XHbw/nz
TLSH
T1CC52E851AA34A977CCDBD209F951BF53E6F5457296940E44ADFCCA1C00E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5cd00b6186c2d1419584c2f9e18e4281c9b6bdc6f5028bf429087679999943c9
MD5 1448e513fc942ce4e5af4b5e674c348f
SHA1 e4aa33e3c3d2da325b03b805ba68792ce8f083e9
SHA512 82f1c29bebadf1facdc1b2f9635609db3bc266c313d5b162b9a88ac061a7066b0cac017b59b63337ae46284feb0855a2776ca7fd839b83ed2178ef811af313ad
SSDEEP 768:Ne4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dZrohQcGaS:Ne4jeXmWvmKLEu1jacPLZQdS1M
TLSH
T112D20A3B240CCF7E4F844E5CED2AAE976ED802CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4ef684929126e81a22b9aefa36a13d4e5a26709ece10465573d9eac73911fe04
MD5 83559f59785ff88a0e696614da9d8b5b
SHA1 d4c16becf243a493569a8e574f48815f1d8fbf9b
SHA512 7474b25875a830588a2812e02fb233fcc78cb55db1b48dad2e1309e41c6fef976f3794e2a64f92f49023f112b2446ebb19c3f1b0444b6a1abf957c34d78592e7
TLSH
T17BA0021819C24D53DC44267528C65589333448343D0682574DA0E54CAC5F6685D5512C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f347b6a812ec4bed066cd2c7558a6cca96d2a5044e0c8067cbf470a63283e72d
MD5 b16347a743cc91a5bca78ba656a5d9c7
SHA1 5041e9ea3dc97d72d0b7685a3ae13a88b4192f8c
SHA512 c7a1662167571a39f4cebc7f573a4ff6963ed1332d90ddea545a858046b6d464a9dfa7b63b8d00240690c6b0e88326c0a23f785c66aeb9597dcc20bafedfe618
SSDEEP 96:KPYDMoGi+cmypHUwcKsJUecI4oJ24Bp65OaQwgSmdcWUx/KsuUP/ILDUtSjeKgk+:UlXYFX
TLSH
T15991311135BB02023D7D390D85A09B5B4A4771A3311EF62B3BAC51A68E6AE14DDFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3667cfa1-0c57-4c41-8f75-a4f42afd09f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3667cfa1-0c57-4c41-8f75-a4f42afd09f1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0d51a6ed47a9be1ea51ef75e48e3d7d5a6b4fa8488f6b5b884ecf8fcfe92c28c
MD5 7cb04d9c96e247cb7e299d0e4c53372d
SHA1 7cd910f671930b32b071ed5ddb5d3b2b77d7ea77
SHA512 03af33ad240cfe650708a03946f3e632b2d7919b8d24bd33e3ff0a2edc4e0840344ca0aededdbe90ca599e50311ae44b760bf97202c3f4da2d986756756e17b9
SSDEEP 384:hiFiZcIysNX8TUNTUlIleLT6cHf+682IXeLF6sa+VYhl5ot:IFQyCwgA/GG6hg6nG
TLSH
T165C23BF258D79876D9AE9743F77E2E028EBCC153B5856684B3D85A0DCC861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1fc7fb2964e5e366a3849c2f71f909f6ba3732af85d29b7eda8664d852e3ada
MD5 97c49e4fb2596a1d86e161c017541a74
SHA1 d29f8b1f0283ef18f3779764c1e432a3c608ed86
SHA512 08a8ddc4a7b376cc9aea17de0a1cd02676bf9d6bbe68b665c9b9806bf05af24a5a9050d835348c1a47730272ee6bb355fe02dda7b8aa9685e757695f5354948c
SSDEEP 192:EONQ6hZ0QmiUyNrUpc/+jV0jzor2e5wOZMdlU6:EONQ6oFpu+682t2ElU6
TLSH
T11902EA35A8787C7B8EE2AE45F48737235FE5116BAD956B84DAF81F1D00C769C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b9d4fe7528f26761a763ff23ba55ebd5b9ce04d5446171dcc877b5e46b90e273
MD5 3432c3f442f156eaefda9bcb073405bc
SHA1 50c4f8e1d89a50c6b7d25ae0f91fb4f4be99497d
SHA512 833b5d8f84e9784fe5b08b0493743e83841d2dec2b36cce0c00c7ba7b278735e7e54d52fb2b130f0e0f11a98603783e90ddb0a24946b44297aaf12f1882f3dfc
SSDEEP 384:IZcIhsNNfLT6RHf+682IXe1F6sa+VYhl5ot:2hX/Gq6hg6nG
TLSH
T1EF827D326CB86C7659E7E791F44722039FF881679AC96B8496EC6F1D00D96EC1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 14f2c755bd5bb1eb85121acb12e4e9a086e8b4815eee09fe7dc55e959294bd56
MD5 bd72a3a99e239a398da5447c218e2930
SHA1 24252f62c69e6bef801655f9ff68955dc16be6d5
SHA512 db8cf49f8db311bab5d4e1aecb536c0d5291d3cf5f53499003177dbcf083ceef18386b2beffc6a3e776f7b5ff5e10c60810a1aedfcc67f95aa160b174a765352
SSDEEP 384:yZcIhsNNeLT6RHf+682IXe1F6sa+VYhl5ot:AhI/Gq6hg6nG
TLSH
T146827D316CB86C7659E7E781F84722039FF881679AC96F8496EC5F1E00D96AC1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df301956482beaf755f57a52579d3688a5fc4f7f289a673dcbed2c9e4ed3f192
MD5 8aeec71f532e6566db575d454bd7c98b
SHA1 48456a5d70b86941f8abbbb85cac797c6ef5b233
SHA512 4b071780d31c5cc1c5f51a13a48d43da37edec2218be3b14eaa235bd28977bb7fbf75607fb37861ca36572435bcf770ea0ee2b86609023ddc29ab572c00b6ca1
SSDEEP 192:ZONI6hZYQmiUyNtU1c/+jV0jzor2IXQN2Q5cOq9qfU6:ZONI6EN1u+682IXey96U6
TLSH
T1EC12FB36A8A8BC675DD3A651F49732139EE84227EEC57F84E6EC1F1D00DF6AC1306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38b49fb9-235d-46cb-ba06-0b2f4c28a7ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38b49fb9-235d-46cb-ba06-0b2f4c28a7ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 123d95af7968d8f61b0fb80ffb11f21520fc67254281924f737c458e3300b3a6
MD5 7a2a3f68b0aa13bb3b90b2872012e391
SHA1 80ecd72bec38fed235450e7becee7699a63f96f9
SHA512 6df154fa6d600fad809e8ab7fda565cd7bf8e701f4dd1287de70b0e5f75e58bd96a0fe61d1c4e796869eaeeb52de389ea2d9fdedba3480395c01eedbb91a577c
TLSH
T1EF411858A6FA1148B3B76E569BF6A8AE447EBD773E0AC05D10110E4F4633B00CD62B37
MD5 SHA1 SHA512 TLSH

Submit Download