hxxps://brewdeskgrid[.]com/rewgrid

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
148s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/07/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://brewdeskgrid.com/rewgrid
Sample260723-ncppmscc67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4416	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292789421010364"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{CAD22C7A-B362-4631-BAF3-6DF883943E2A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 5928	980	msedge.exe	80
PID 980 wrote to memory of 4416	980	msedge.exe	81
PID 980 wrote to memory of 4948	980	msedge.exe	82
PID 980 wrote to memory of 4948	980	msedge.exe	82
PID 980 wrote to memory of 4948	980	msedge.exe	82
PID 980 wrote to memory of 5248	980	msedge.exe	83
PID 980 wrote to memory of 5248	980	msedge.exe	83
PID 980 wrote to memory of 400	980	msedge.exe	85
PID 980 wrote to memory of 400	980	msedge.exe	85
PID 980 wrote to memory of 400	980	msedge.exe	85
PID 980 wrote to memory of 2484	980	msedge.exe	86
PID 980 wrote to memory of 2484	980	msedge.exe	86
PID 980 wrote to memory of 2484	980	msedge.exe	86
PID 980 wrote to memory of 1432	980	msedge.exe	88
PID 980 wrote to memory of 1432	980	msedge.exe	88
PID 980 wrote to memory of 1432	980	msedge.exe	88
PID 980 wrote to memory of 3616	980	msedge.exe	89
PID 980 wrote to memory of 1992	980	msedge.exe	90
PID 980 wrote to memory of 3616	980	msedge.exe	89
PID 980 wrote to memory of 1992	980	msedge.exe	90
PID 980 wrote to memory of 3796	980	msedge.exe	92
PID 980 wrote to memory of 4180	980	msedge.exe	93
PID 4180 wrote to memory of 5796	4180	msedge.exe	94
PID 980 wrote to memory of 3404	980	msedge.exe	97
PID 980 wrote to memory of 6000	980	msedge.exe	98
PID 980 wrote to memory of 3812	980	msedge.exe	99
PID 980 wrote to memory of 4076	980	msedge.exe	100
PID 980 wrote to memory of 4076	980	msedge.exe	100
PID 980 wrote to memory of 2132	980	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://brewdeskgrid.com/rewgrid
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b8,0x7ff9e2a4c188,0x7ff9e2a4c194,0x7ff9e2a4c1a0
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,1737262014557145038,9799814922303633551,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,14759375500190273878,5679688046420499318,262144 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,9009109839146728123,9023945296259396446,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,1264064870856198442,4294201812850794098,2097152 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,7546556854685506494,16846722356553884646,2097152 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4784,i,8899245923148823571,17551434287323742456,2097152 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,5799290589414520405,11829110985318722762,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15655790615156976897,7852831906989088226,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,8207718685593307008,10057124439022220391,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,8207718685593307008,10057124439022220391,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,11344734802231675629,9214041250095279745,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,5511004041804318363,5957499266654134119,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,4153860477126377582,15632827148145487156,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12351934399584107964,2474581049719858400,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,1280167646252320039,10596066306882678384,524288 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,9993581261337019219,10340992993426833275,262144 --field-trial-handle=2112,i,12408277166165977192,8595710615570977200,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

08180193-7210-4af4-abdf-fec5bee2407e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08180193-7210-4af4-abdf-fec5bee2407e.tmp
Size 414B
SHA256 64c4d38d8d1b983f4269b7ea1d646ac40fc2a8e50a3b3a9b438de30c0dafff93
MD5 215f7f8067b0c703f95a96b92c53b6ef
SHA1 4d6aeed203e3bd7b94313bdadd503e17e70c59bc
SHA512 56b70c82a4a03923d33739c16aa73925495c25b2b66ef5e439a685dfe687e5595b40faf0febe60552e6f858018bffa22634c82dd1c30fdc932a0474a060e19b8
TLSH
T136E02BAFC930AC2714FA1B19A0951B46EA5113575780945F3A7D860C8FB472E028982C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 871f5699212e410be2d2627bea832e04aabd3ded65b5c7b67716ac7e2801e34d
MD5 6e3bba54f175938c13458b8213954654
SHA1 9d5b32152ee06171a7f4efc1dd54b7c7b57432b3
SHA512 8bcc6a55232c583d38fb6fa9a8fce5ca9ad9ed91abf6507591ff26e9ea78812a7447f37e7ff33c476f708d9bf4aa44ee1d04aabb606949194b8c30189be595a7
TLSH
T17971A5BD3E61C453E323163194D20A01BD77E25979735E1503805836F9FBBE6D8139C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5859d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5859d3.TMP
Size 3KB
SHA256 21cb1b7482fc15012a0bfd047c8cbdff7e80d380b18531f8e9abc54bda701219
MD5 e895a76e800bbbfaf059bbb8afbd641b
SHA1 91564fecbca444ab797186ab40508c30f7867925
SHA512 17a3122114d9ec0a56ceffab8dc523553150c46ffc82ac0377ddd243d526d00c7bf3c4f15d315dc0de806656c6fffd76dbc8b5ed038f540ec51572f5bfe4dd63
TLSH
T1BC71923C7EA2C563E313023195D20501BD7BC29A39771E151380597AF9FABF1D8179C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9daffef9f9d9ce3779fbe4e816fd0a4e28942f21b88a7f3c8d6cab3349e3f2b8
MD5 490615de89370f1c71696fd7bc9c3bfb
SHA1 69fe87406cd26dc5a951f577566e6fa64f050e3d
SHA512 9a598ca600ac00056e899a89b5a63c7e18ab403dccdefc6663c1ff5460488eef9c2cdf92e2f1f603d90f0212c7c8d6eb27c78263cee5b3849582f29b78e80c3d
SSDEEP 48:YALlgyDPNqOhSNh4hrhyh9h/afo7gmgj6AsIzEs6rsGu0EsxcsFBsKVFsaWfCKsD:D1gOYNm1wH1aaij6QzuDu0d5lHWfmNwQ
TLSH
T1C9919BF7C7E8812DC91196F4A715BF1FCE2D0624432C3C6A88E8BE5793E2471E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 54e8d2d4b6ae0a2ff6496478b4398d4ef4f5ba6fc0c0681b449d34f3c4738fcf
MD5 541c2fcf63929f9d93bd069e8e7d5eef
SHA1 352d8865bdc7deab23ca4fc77e871ade66aa8265
SHA512 6a1973961813147757c9e2254daa341b624180c8899f112b68dec7f3c05f582901a0599c1ba14fb76d5485df87e72b094c628cbffe20ed6deb2c91d825404068
SSDEEP 192:sxZWR/yMqZjK1Ml8UQUF//fYsuw0E0CXUfzodpH10/W6+WNrlZ/Y0dNIZbQIg5jj:sxZW0qi//fYsuwb0L02/bj/50Yhj
TLSH
T10A72F716AA3449778CDBD219F5857F53D6F90563D2904E48A9FCCB0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 17d2ce47512dfda682a4ae9c46931956c43916e5f67b7a9ee1e958302a3b1a52
MD5 d131f48a6a9a8134c30afaca722fe804
SHA1 0b482e552e9d80fac6678d9b88cd5045544a9e3c
SHA512 45a865ce754d2e32075ed9826a74f15aeab438cae83474ef0157fe9f5e8b3f99daec45d65bd011a04b1d19c4a822cb8795f78b57f7c9da5d11c86fb13ac0a9e2
SSDEEP 192:sxZWR/yMqZjK1Ml8MF//fYs8twyxE0CXUfzodpH10/W6+WNrlZ/Y0dOyobQIgj5J:sxZW0d//fYs8twy60L02/bj/5OYjj
TLSH
T17462F8166A345D778CDBD209FA457F53D6F90523D2904E48A9FC8B1C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 0e402150b429d667305b333054dbceb05f030074bf0e4446fcc9b8e74c154d55
MD5 f8076b246c6823f405102ad4f9be0963
SHA1 c29affcdfa01dba0972be1b0aae5ada317c81cff
SHA512 9fdc726a396ad8b5f671b218bf5b256e4091eff1a512c06e7bcc08d22df9cda0126d91d3a6f30447380f9d0d3dbc084ce1ca433d3dc58f861d2da791a1937c71
TLSH
T1D2B0222AA2000033C803833320C380C0F030ACAC320EEB03F08C002CAC23B8CE0A3002
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1f5edcd59915b1d84379ea8d70e7b4a9e01f7b62f810792eaf8e05f7d53793a0
MD5 c8d397455f691bb36e45af8e758e4394
SHA1 62f8103831a234c684cbb7314b3bd5f0caf74439
SHA512 4abfa525e80b196ab2985d2794bc22377cba2f83c79801f8563c936f82fca87794a1761294490a7e5b4e12fac31edba6a5f1e95013abf269a34fdeec4fb71702
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72ze:AFBHhTofhno2mB21q3Llbfe3sLDdeEpp
TLSH
T1CBB29F56717B12123C3E290CA7A19B370E8272A33458E96F7BB804B64E67E515DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 19428818e04d1a86ba17013463c1a5bd1b1a37ddf444362f3592d8174901827e
MD5 9e5f00c8ceec6e1ac0dd2fa429a8a4ac
SHA1 5a6f49ccb3eddf28d2c8f410141e22e84da9ba7c
SHA512 961498df803d42e4bb24367cbff69bc2f4a2e124486b4294aa45af7f01d193fb8eafcad7c79fa5ff8ae3efce11ad072a94184983bea800277048a5a7d7a879c4
SSDEEP 384:n5iFoZcIA38NM8TUNTUlIRPywVujGfb7oodhLCi/sDVcl1lIO7w/5HHy/7Igs9B0:QFWA3bwgXloAsDVcLCO7w/51Bup
TLSH
T199F2D5F198E789B7E89E5B87A37D6E0699FCC063B5885984B7C81D0CCC8657FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 52bc6a35d5c2a822b2e67b2a280bf72efc0e8fc758a44c4d019b144c95a34575
MD5 3e910aaa072cd997e2a8cccc72a02823
SHA1 d8b863cf09205b3d045a59d96ac6dbee4eee9686
SHA512 7ea6e32b2b769d8c0b64e895f359011552d32d171062f29fc1eb5dae0bec87ccd794847f14bc34efa8d919dfbef88b26bdf858b087865316a22d420a851fa1b8
SSDEEP 384:n5liFoZcIX38NM8TUNTUlIRPywCujGfb7oodhLCicsDVcl1lIO7w/5HHy/7Igs9a:uFWX3bwgUloZsDVcLCO7w/51Bup
TLSH
T117D26B32E8A4C9B7ECE65E96F64A7A07DEF04163869C9ED4D6CC1D1D00CB59D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 56ce7a52c73d4f94d61db8380f2a6e78d7ade7a44530cc70e8966ab23b20c05e
MD5 27e93ddd8a08ca765db75ec7f6e05c2c
SHA1 b27f92b2e9e9bbc23d492bd140ab1e18940d3c63
SHA512 d72cb8ad06172902ee0f56a153de416e4968ede92ec6f1b518a0edb01ac119058e96515cf3dfcab00c42b91380790683c8ba1ef9ae7a8579b6df66a26fe8702c
SSDEEP 384:nGiFoZcIX38NM8TUNTUlIRPywCujGfb7oodhLCicsDVcl1lIO7w/5HHy/7Igs9B0:tFWX3bwgUloZsDVcLCO7w/51Bup
TLSH
T1B9D26B32E8A4C9B7ECE65E96F64A7A07DEF04163869C9ED4D6CC1D1D008B59D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 066cd1d175aca5d342bc866b2e1e9727700859d96ef9f3341f66a647a97a6838
MD5 721016c39eca4eafcfe538cfe258ddb0
SHA1 ad2bbddb1508502e697d2fa141b6ae98e3bf6c22
SHA512 27d38d6c628e5eb0c9b992b9771fae1a412d6c73128b04eb46d2b56bf42f444df70066653ac75d8b4151fa72d585da506f34a236f1e7795c6382d52f91e201ee
SSDEEP 384:n5liFiZcI638NM8TUNTUlIR7ylCujGfb7oodhLCicsDVcl1lIO7w/5HHy/7Igs9a:uFQ63bwgXloZsDVcLCO7w/51Bup
TLSH
T149D26B32E8A4C9B7ECE65E96F64A7A07DEE08163C69C9AD4D6C81D1D00CB59D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 801e57df6f4384e010070d4567554eb9f10f7e3899ef41b3341331af5a8f390c
MD5 4cfc150fef32e052802828e4f0e51b53
SHA1 104fc87f2f7fa3d95727813a7bb491f378a57177
SHA512 013bd810d28bdc6b080222adb6af919818070c56f08324c4f442086253353c98979c33b337cd4a1a3e0d40960e460ceaa41e49c37004bdc725c2aa9dfbbd9e89
SSDEEP 384:n5aiF9CcmyWCs38NA8TUNTUlIxBydBtfjGfb7oodhLCiQshkP+lFYS/VNHy/7IgS:fFccps3rwgcSonshkoFYS/P
TLSH
T18DC24A32ECA4CAABFCE64FD5E64A7A07DEE04163C68C9AD4DAC81D5D00DB19D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 098cea609921deebc5e169fe979b22802edb0f596d0af99d560b3d82ef7dda6c
MD5 8bb42d0e79997d643910c22713e834d0
SHA1 b0ba1051db91aa4d9e38ac800eae1d7e9b3a3122
SHA512 a2cc036b35d627b20b5bbaf294c205cc540b922ccceafddede8a556e6e97db44082f2293d94a7b891acf386c26a720b8648facf9e74919e29ef754e072ab7e69
SSDEEP 384:n5HiF9CcmyWCs38N28TUNTUlIxBydveoeajGfb7oodhL4ehkP+lFYS/VNHy/7IgS:cFccps3VwgDNxo/ehkoFYS/P
TLSH
T13DB25B36ECA8DAB7FCE64F99E74E7A07DEE00163859859D4DAC80D5D00DB19D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3796-244-0x0000021E23690000-0x0000021E24690000-memory.dmp

Download