hxxps://cdn[.]discordapp[.]com/attachments/1517025257397948498/1534418576587489412/Lullaby_v2[.]rar?ex=6a740e28&is=6a72bca8&hm=8d3532dea5a6c10138653b4acc71d6bd9caaa761d8d797ef919a504308bcbf29&

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1517025257397948498/1534418576587489412/Lullaby_v2.rar?ex=6a740e28&is=6a72bca8&hm=8d3532dea5a6c10138653b4acc71d6bd9caaa761d8d797ef919a504308bcbf29&
Sample260805-e5yctaybkc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303779376212881"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{B9540083-6402-4200-AB14-2A40BFB11E08}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1500	2296	msedge.exe	87
PID 2296 wrote to memory of 4552	2296	msedge.exe	89
PID 2296 wrote to memory of 3744	2296	msedge.exe	88
PID 2296 wrote to memory of 3744	2296	msedge.exe	88
PID 2296 wrote to memory of 3744	2296	msedge.exe	88
PID 2296 wrote to memory of 1420	2296	msedge.exe	90
PID 2296 wrote to memory of 1420	2296	msedge.exe	90
PID 2296 wrote to memory of 3596	2296	msedge.exe	91
PID 2296 wrote to memory of 408	2296	msedge.exe	92
PID 2296 wrote to memory of 3596	2296	msedge.exe	91
PID 2296 wrote to memory of 3596	2296	msedge.exe	91
PID 2296 wrote to memory of 408	2296	msedge.exe	92
PID 2296 wrote to memory of 408	2296	msedge.exe	92
PID 2296 wrote to memory of 2628	2296	msedge.exe	94
PID 2296 wrote to memory of 2628	2296	msedge.exe	94
PID 2296 wrote to memory of 176	2296	msedge.exe	95
PID 2296 wrote to memory of 2628	2296	msedge.exe	94
PID 2296 wrote to memory of 176	2296	msedge.exe	95
PID 2296 wrote to memory of 176	2296	msedge.exe	95
PID 2296 wrote to memory of 4848	2296	msedge.exe	98
PID 2296 wrote to memory of 3080	2296	msedge.exe	99
PID 2296 wrote to memory of 4848	2296	msedge.exe	98
PID 2296 wrote to memory of 3080	2296	msedge.exe	99
PID 2296 wrote to memory of 3980	2296	msedge.exe	101
PID 2296 wrote to memory of 3980	2296	msedge.exe	101
PID 2296 wrote to memory of 3980	2296	msedge.exe	101
PID 2296 wrote to memory of 856	2296	msedge.exe	100
PID 2296 wrote to memory of 856	2296	msedge.exe	100
PID 2296 wrote to memory of 2552	2296	msedge.exe	102
PID 2296 wrote to memory of 3372	2296	msedge.exe	106
PID 2296 wrote to memory of 4600	2296	msedge.exe	118
PID 2296 wrote to memory of 3164	2296	msedge.exe	119
PID 2296 wrote to memory of 4632	2296	msedge.exe	120
PID 2296 wrote to memory of 988	2296	msedge.exe	122
PID 2296 wrote to memory of 988	2296	msedge.exe	122
PID 2296 wrote to memory of 4964	2296	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1517025257397948498/1534418576587489412/Lullaby_v2.rar?ex=6a740e28&is=6a72bca8&hm=8d3532dea5a6c10138653b4acc71d6bd9caaa761d8d797ef919a504308bcbf29&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffccf63c188,0x7ffccf63c194,0x7ffccf63c1a0
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,15781539309387454794,5929160857303403618,262144 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,5872901963048825809,3546528213713366307,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,5278191063132655436,12431412751095051871,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5340178237790794280,7923993242607250697,2097152 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8630119509644159139,11323625813068624039,2097152 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,7995673993405334750,6042167211573995348,2097152 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,3790956876717993131,16608171183318694971,2097152 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,462228984100366494,13571591050204521757,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6390891377019835813,18181014792965131257,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,2260918638696544420,3739372964495686297,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5748,i,2299075546056666680,12687208684317244867,2097152 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,3269077066000163189,9389161872501585076,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,7268560010871735174,6671568228621221653,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,7268560010871735174,6671568228621221653,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,2019340430968699993,693257805781208682,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,16558567192022797091,2630330416567644223,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,1451319102836099383,8316796924901788628,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,3043228587056746905,17997720887284839253,524288 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7104,i,16971534085788631196,2813811020767331557,262144 --field-trial-handle=2356,i,12374118439278297587,14881257248461398339,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1333372e85c3980d0cad884e21ae4a9058af13cd9124ce2b19f19bd3ecea8b05
MD5 a4732d34c88349937b92a79ebfb5db28
SHA1 7178d74b2b322bd55dfd3f56621cf81cfdea6a29
SHA512 f8983c0f19fb512e7f2b7fa65debc0755e569a5867239ddfba80f9ad617322bac68a79b0f8d033babde47c0fa27102110919f80eee30f845fac0254c487482a8
TLSH
T10A61C6750B10C4ECE79031B098E932927872DDEAF4834E4670735EB1FA04F4149EA1BD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8a9cfd03a53fa2d65569882e7c1bb4274e972ce36541dd2867d434742d8d82b1
MD5 c49b8ed24c63fad27dd191ba387525ab
SHA1 9843581737896da5cd53cd246aded56bda7f25f3
SHA512 fe3d757d3aeb13b45a3d7d18b9cb3af8338691c36a3f3667597abfcb3a1edef70e40fc244becc3094db9f60be64fdfbe3ca283583d390c58e8cab6bfde99a048
TLSH
T1D7219BF3C7D5CA6EC90516F46A146E1BCE2D0A1543283C2A89D4EF6BD7E3072E00194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 83328f6c5784e392f56b7ca003c53e89a8c3f0974bf80cd7626b89f8a1021c71
MD5 734f5cb8ff9a4f79141c29c8eaf8ed01
SHA1 d5381f46377c33e9003ede3ffa452d57b8a899a1
SHA512 79d091bf0efb01d0356f4db7e33ce3ae807127d89b9b934f5a645699abca480116ca4e8ce6c7def7de3ce056e89db75bf6fddf532b1b26b2ca98fdd10fb0f8eb
SSDEEP 192:sxZkRcT9H/fWsfN1VBIdpJHW6+WNGYvxCwQNIgrJ:sxZkaH/fWsfNaJHbG8e9
TLSH
T16522A7126E38A53B8CC7D21DBA25BF53D6FA503261951E58EAFC961C05E76CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ac2ae0fbe2356185869c5a91db173f0f5c789e253d3eabf4743ad1576d0a98e4
MD5 301516184c5119819df14dbe0a2248b2
SHA1 bb4ce78f4964e35a9dfac233821e389c7a899e17
SHA512 6d98f2bc619941d124000676573f951757003a5b8c6ad017ab892655a1970a2808e7ed2db380a98236073d6e330452baa0c891314ad967f8ed9404a810104206
SSDEEP 192:sxZkRcT9H/fWsv7N1VBIdpJHW6+WNGYvxCwQNIg5IJ:sxZkaH/fWsDNaJHbG8e+
TLSH
T12422B8126E38A53B8CC7D21DBB15BF53D6FA5032A1951E58EAFC961C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e972328a47ce4703bded2f3b71a207ceaaf333f059d5ece2dfc19add7955c15e
MD5 1b0ab9aada8e6ab022ddcc729dc0f98d
SHA1 ee6b56ae58fa272be00c1f88bf41fe371363bb20
SHA512 3b222adc6c8d89aabeb8a0dab4cd1da4af7a7c8b26277903066be210e9b3cc299298a4c232fea6f08fbb2d4c4dccf2d9690a49a6818e56348ffed7352d30f9f8
SSDEEP 192:sxZkRcT9H/fWsv7mc1VBIdpJHW6+WNGYvj2wQNIg5qJ:sxZkaH/fWsDxaJHbGEes
TLSH
T12322B7126E38A9378CCBE20DBA15BF53D6FA503251951E58EAFCD61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bfc661472e440dea35e306f22e3454323dc40a8011a02f0b6f8e06af596ab98a
MD5 a99a6c17f3a218b4a29324d889b86ef7
SHA1 235293a7d855d78ef3bbc4b4ee7244b9456efc86
SHA512 f46cbc74c4a9796fd107e4d3a4ba0b71355bb54084f3742f862687e502d7b45520e83f5f8b82d6c4b32820e2a345655645c38dd197351376914633fe5656e065
SSDEEP 768:qZee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbZrou:qZee3rxWvhffnu1jatcL88bSu
TLSH
T1DEC2FA2B640CCB7E5FC00A9DDC5A6F977FA802C767548D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 749809339444677468218cb130aa0a5d23b6b619e5597803287ee0f0c6e03b55
MD5 31410c6d4719885a2e64aba875810aae
SHA1 f5f8419195247a211393a5c69999866668afe923
SHA512 f71383f03bcb0232dacab860644470fb3eeb0e77554ca1b3fb5936883b731e7e7e5336c622b2649938da6840b9695adfcf95228b66e0889d85a250a295c7048b
SSDEEP 48:KYHIhKggkXyFrI1KAUonyhziHD1RFARpETIwbAKjV7dAXrQe09RX0r3RpB:KYH+Kggm+ruKAUyyQgKJun
TLSH
T14F91F316753E12122C3D3D8CB2A196360F4535A37468A9AF7FB804624EA7E124EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596037.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 232945b8827fac1f5c6bc03a9f4342e77a7e54a85ab87ef17601c60443ee7939
MD5 5335d451ca956463362689186c5a0544
SHA1 2e2fd8c9a538994196b13976bf2610ebe47a76a2
SHA512 f6ebc5ea6a96fd2d85bec8c0b2a0176bfc8486edb09cfb608840bdcd2a106ee50752cf24bd45708d336a7d8aa20be59ae08e2d51c760ae68a4a1a9b146ca8b60
SSDEEP 192:uWm+xasuheOwQxMGsNcjQMgHUcM7w5MQmiU1wY+4MTAn+FdLQx6ptFd3E68z1jq9:uZcIhsNcjNgHU17scXhkdcxMdUTyiA
TLSH
T111625B725C745C3B99A7B246F48A3B134EF8907BA6C85F94A6ED6F1C01D62A80307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a131e92aa17ad1101ca62a0ffaec282106fa84fb4fe472f432b577a26ba20ad6
MD5 d88a0a29d45daf8be5df608697e1dc65
SHA1 969190ed81b1cc9a106d76dae8b1672a0c6e4332
SHA512 3459ab8d860d37bfe3db832d27db30a06c999345eb52986b3eaf59f17351fa08d44e7fbd12e84a38cc4ebb1db19732e66a34741f57f16d3a70412a885cd48b0b
SSDEEP 192:lONb6vMtPQmiUyxSThTAn+FdLQx6/847TMU/u:lONb6UtRvT7dcxEoU/u
TLSH
T158020835AC786C7BEA73AE46F48A27175FE4116FA5D01B54EAE82F1C00D725C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bbc705e8684e5064b3731eac0f7adfbda61aab428d323547703f3bcba12fcd7b
MD5 80b6852fbdc35349f4a7adf0d072b86e
SHA1 53e293b9a361631c8547734cda8c54a7d35d6077
SHA512 6ca44d19fc0fcfbdce4bdd3ad0b057cfdbded9a521e1d70b0b7d6eb583291d36898a51dcbe17d89e023903fb93d9a45ab96946e1f1e96d5dc00933e55b4ea1e5
SSDEEP 384:oiFiZcIxzsNU8TUNTUlIlSNgHU17scXhkdcxMdULyiA:zFQBRwgXH+hCnULyiA
TLSH
T1CF825B735C64893BAEA6AA45F54A36138EF4507BCAC4AA94F7EC6F1C00D719C030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3b546e1d5c959497c100e9fc44e87c05868292a177be2858f729adbb8b5c263a
MD5 0e4b24ed5239ec1cd9c882852c3903c7
SHA1 10f3b7d75088316b4558114b81829f5845079bac
SHA512 a00be62bdd74172b22ae9d9c1e2c855f902088ec52cda3a3b0600385da0873c1d44296859727229b2c1ac97e483a07ccc7f2c8fa125b3c5b524d5d35849755f3
SSDEEP 192:RONF6vMnPQmiUy/SThTAn+FdLQx6ptFd3EL80IjqJU/u:RONF6UnRXT7dcxMdU8yU/u
TLSH
T19B121A31AC746C27AE93B546F48A36135EA1916FEAC46B50F6EC3F1C01DB66C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7d8e3cdb117423db661a482004b5c1ca2962751e97e7cdd2936ffa8037f4a541
MD5 3e469045e250193ebd19024cccf84631
SHA1 ba2e5744f44ea1c8707f930b816e5b79e92a4e31
SHA512 e8ccfe16eac71b5994128f42f0758b8b3669bba5bf2e6e5941d088efdb2d436ca77d51cf3096a0347ad0b4f2ab53883860502635a12712baa2e2581d34ce89c5
SSDEEP 192:uam+xasuheOwQxMGsNcSQMgHUcM7w5MQmiU1wY+4MTAn+FdLQx6ptFd3E68z1jq9:6ZcIhsNcSNgHU17scXhkdcxMdUTyiA
TLSH
T168626B725C745C3B99A3B246F48A3B134EF8907BA6C85F94A6FD6F1C00D62A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Lullaby v2.rar.crdownload

Path C:\Users\Admin\Downloads\Lullaby v2.rar.crdownload
Size 7.3MB
SHA256 2f8badfc930bd410b829c72d27b799e7626ed543657a54c3ce8d2a3912a3b936
MD5 d42388939d60f124fb74e717c86b7aa5
SHA1 fabcff237f3dc28b4eb5315ccdde8323c1130b91
SHA512 b7b8e161568f5bc41fd75b93419d64afc8ec782a8e1c2e94e3f2ab45bea9dfb18c092c0eb6730cc46575253489e0192a192babce4952c405ea04bdc44a740558
SSDEEP 196608:V+mcPTcCQMBEuYc/y6shmkiaamYv9cN+dS/88M0CMDlh4FDWcf6:MmOAzyY8y6ymfx5v9LSU8M0Cu/QW/
TLSH
T1CF76337F534BE34611C6A0B3845E8000FE5570BBAE814EE517E8CD6AF8852B7263E2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download