hxxps://www[.]google[.]com/search?q=stout's+trattoria+at+grape+creek+vineyards&rlz=1C1GCTS_enUS1160US1160&oq=grape+creek+vineyards+tratt&gs_lcrp=EgZjaHJvbWUqCAgBEAAYFhgeMgYIABBFGDkyCAgBEAAYFhgeMg0IAhAAGIYDGIAEGIoFMg0IAxAAGIYDGIAEGIoFMgcIBBAAGO8FMgcIBRAAGO8FMgcIBhAAGO8FMgoIBxAAGIAEGKIEMgoICBAAGKIEGIkF0gEIOTI0MmowajeoAgCwAgA&sourceid=chrome&source=chrome[.]ob&ie=UTF-8

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/search?q=stout's+trattoria+at+grape+creek+vineyards&rlz=1C1GCTS_enUS1160US1160&oq=grape+creek+vineyards+tratt&gs_lcrp=EgZjaHJvbWUqCAgBEAAYFhgeMgYIABBFGDkyCAgBEAAYFhgeMg0IAhAAGIYDGIAEGIoFMg0IAxAAGIYDGIAEGIoFMgcIBBAAGO8FMgcIBRAAGO8FMgcIBhAAGO8FMgoIBxAAGIAEGKIEMgoICBAAGKIEGIkF0gEIOTI0MmowajeoAgCwAgA&sourceid=chrome&source=chrome.ob&ie=UTF-8
Sample260816-h6datasdld

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313384462548201"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{91FEE8DA-E068-4A66-872A-2EB27195E85A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3372	1724	msedge.exe	84
PID 1724 wrote to memory of 4712	1724	msedge.exe	85
PID 1724 wrote to memory of 4076	1724	msedge.exe	86
PID 1724 wrote to memory of 4076	1724	msedge.exe	86
PID 1724 wrote to memory of 4076	1724	msedge.exe	86
PID 1724 wrote to memory of 872	1724	msedge.exe	87
PID 1724 wrote to memory of 872	1724	msedge.exe	87
PID 1724 wrote to memory of 1400	1724	msedge.exe	89
PID 1724 wrote to memory of 1400	1724	msedge.exe	89
PID 1724 wrote to memory of 1400	1724	msedge.exe	89
PID 1724 wrote to memory of 1912	1724	msedge.exe	90
PID 1724 wrote to memory of 1912	1724	msedge.exe	90
PID 1724 wrote to memory of 1912	1724	msedge.exe	90
PID 1724 wrote to memory of 3868	1724	msedge.exe	91
PID 1724 wrote to memory of 3868	1724	msedge.exe	91
PID 1724 wrote to memory of 3868	1724	msedge.exe	91
PID 1724 wrote to memory of 4204	1724	msedge.exe	92
PID 1724 wrote to memory of 4204	1724	msedge.exe	92
PID 1724 wrote to memory of 4204	1724	msedge.exe	92
PID 1724 wrote to memory of 4608	1724	msedge.exe	95
PID 1724 wrote to memory of 4608	1724	msedge.exe	95
PID 1724 wrote to memory of 4608	1724	msedge.exe	95
PID 1724 wrote to memory of 4604	1724	msedge.exe	97
PID 1724 wrote to memory of 2276	1724	msedge.exe	98
PID 1724 wrote to memory of 4604	1724	msedge.exe	97
PID 1724 wrote to memory of 2276	1724	msedge.exe	98
PID 1724 wrote to memory of 1772	1724	msedge.exe	102
PID 1724 wrote to memory of 1044	1724	msedge.exe	110
PID 1724 wrote to memory of 260	1724	msedge.exe	111
PID 1724 wrote to memory of 228	1724	msedge.exe	112
PID 1724 wrote to memory of 2052	1724	msedge.exe	122
PID 1724 wrote to memory of 2052	1724	msedge.exe	122
PID 1724 wrote to memory of 3708	1724	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/search?q=stout's+trattoria+at+grape+creek+vineyards&rlz=1C1GCTS_enUS1160US1160&oq=grape+creek+vineyards+tratt&gs_lcrp=EgZjaHJvbWUqCAgBEAAYFhgeMgYIABBFGDkyCAgBEAAYFhgeMg0IAhAAGIYDGIAEGIoFMg0IAxAAGIYDGIAEGIoFMgcIBBAAGO8FMgcIBRAAGO8FMgcIBhAAGO8FMgoIBxAAGIAEGKIEMgoICBAAGKIEGIkF0gEIOTI0MmowajeoAgCwAgA&sourceid=chrome&source=chrome.ob&ie=UTF-8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x210,0x7ffd39b4c188,0x7ffd39b4c194,0x7ffd39b4c1a0
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,10648560292026108161,4316946999366380292,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,11509787271832879976,15501295851288800909,262144 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,7996756564779355905,8001288520862697593,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4370857344879012814,4530930522979023190,2097152 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16162297336914911029,12809130697749334892,2097152 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,11247803592637544559,6736112652366224021,2097152 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,61316453029918029,17894695597562523651,2097152 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3664,i,18223008744150740174,5380607430795905697,2097152 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,11331662897059795918,7546576953474119717,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,9402274255395249311,10503626587692017054,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16433536779922693364,7344970914293982093,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16433536779922693364,7344970914293982093,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,527188037224305289,15912072378082720401,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,17880817835320204585,11690155075343430209,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,15765491715540082018,14999351099061580844,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1003621021432406616,13023501644562268951,524288 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,7282095068128500175,16022737682023318328,262144 --field-trial-handle=2268,i,905029833131362753,9512106976727718326,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3afcf24737c967de071233ba3e20034bba53c07707514b5a2aaa09515ee9ff2c
MD5 7dfd2b2130e2a4b484daaf34cf0c4c25
SHA1 9db41c8c313f4454548088ae6db8e121361bc723
SHA512 b93dd5035c4171fd2f69d8f142327aff2c52dbf22619b05b4fca3b1b3cab49b8d4b69a4a253f243f637aff361ca399e358bcdf0b3086246b254be88c381c4541
TLSH
T1CB516D2883720891E37C257093E1133DF07E959A3AE7EE1646640DFD681EB36743F159
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590238.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590238.TMP
Size 2KB
SHA256 34c9101055ae81027b6b809ca49b501626ed368911c12381d3d805cecb9cb058
MD5 6c50c43036d315b31a6136fea37ddd8b
SHA1 9fa9faf43562fbc3ca851ab204f03980786094ac
SHA512 1157168fcc52e3e1bc0bef3a3303973f3a7e1e4c70aeac83317f458d3eb2d89f6b7e00806a0ee220f420e52a5ea4e9a63323e9c81343abcefda26fbca6bdea1c
TLSH
T118516C2883720881E37C1571A3E1133DF07E809A3AE7EE1646900DFD691EB36783F15A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3f30ce7e6ad3442d85743b2fc7c732bea0ba2e6363df088c1f9290d70bda7e50
MD5 adc224e6c2bcb41482a44150ceabeb1f
SHA1 1c27c1ae527feb9d988736623baae25009473ed1
SHA512 e68b168293c463f22683fd28c449f4b752a6f9a80f13b2314740073d9b59df2a797c08392fbca52f2e6c83aefa29bc214353f81b93ff31be94497e6d1bc21ad9
TLSH
T19C417BF7C3D5C16D891156F09B29AF2BCE1E0618432C3C2AC9D8BF5793E2471E11565E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 137f2ab6c855f33a79dc20e1a0be8c7c41ea5575849eed88d22c90490c8c26e5
MD5 74e061873a03a2e2801d13bb9d452444
SHA1 66ee14256e0d8412ac84905270081eb4a7c1a1c4
SHA512 63f1962c7b7e0f54cbffd1063c941a2c94214928c358c7988a820ffb25f67daccae272981554c6efeff2afd72423d231919600757a6d5e83a937cb1c44cf6338
SSDEEP 192:sxZhRIyM/jK1Ml8MkY/fnsKa3IKSIdpqRhHW6+WNrap/Y9I6Hz+XIgrJ:sxZhCMY/fnsKa3IA6Hb8/Am9
TLSH
T11E42D7026A349977CCCBD209F955BF53D6F9557392A40E98A9FCCA1C00E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bc4f74216c5cc554e8ca9905252001c6bff4bf6f609f8adb71c066b041ecf05c
MD5 757c813875ee1e95a8644f599dd1efb3
SHA1 03c002066f37a4accb0cb4ccc0d1f79e7dfc57ea
SHA512 fd82d3fa6bf6075808e1b40543e13ba7f2dd03aed32e32468c0891973d5c42fa1a135fede8b4a2292800f0b7e3cdc80c7e698cd232d1d43565b5d833f6aa9531
SSDEEP 192:sxZhRIyM/jK1Ml8UQJkY/fnsratIKSIdpoRhHW6+WNrxmQdY9IIsmz+XIg5rJ:sxZhCqKY/fnsratIAIHbNddwJmX
TLSH
T15E52E9126A345977CCDBD209F951BF53D6F9547392940E98AAFCCA1C00E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4b7e254a4559f944f6002cdc36ea3cdd634f7ff327c644e3c880ec93361095e1
MD5 2b1df296ee7f126fc59e5351a22c71fd
SHA1 c54c35085b9a4670f86ea56d20bf02bd793039e3
SHA512 cfd46f926c61c7553744389cb94029293b81489dc282295d310d65eedb29515203ef998d107ceaeb7c08450573965de9e3ee8cbef379a9d99594e2bea36690dc
SSDEEP 768:9Scv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNurodg6F:9Scv21wWvu+Z+u1jaeFLeRNld1
TLSH
T178D20B2B280CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d43f3679570c6121712f546e243b923958af9dae5a93598b2e39ac9cea84f7c2
MD5 cb1b5158824059943d301a988770f2fe
SHA1 ac972cf2de4d6239ab9b5c589c0817f10553d406
SHA512 639fd7594b88078885c6b958891d4e230645efd38dc2b4ab96430aeecc801fb4dbad381e1491e64dca1332923292b60e83c1116f363b5a864b3a90878b93d92b
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+1eKe0CKkgKl+E:mTJlzH
TLSH
T137916641B07716412C7E6A0C97968A364E4775A37808BABF7BF800A24F6BE151CFE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5974a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5974a9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dba45f4537f2ead4d73453a5fbfe319fd9365005484e7e52412284527f826fa6
MD5 aa12c88e2311318a471b94cf24e437a9
SHA1 48ebfc150600cb89c81cf123cb6becbb47bd609f
SHA512 f30aa55778d528157c9cc3be2115c438cde36d3405b89a11149aa67b394f6dae7b513ae3cd17f3dece2725abb5169eb57fab7c0f8d3c1c2317a571af10978fd0
SSDEEP 384:PZcIhsNdUptzHueziHG6e+CTdIe9JrVBOOPrXLpe8C/pBC:Hhhuer9rV9hVBOi9PuC
TLSH
T1FE928D31AD386D676EE7E541F48736039EFCA067F6C52F94E5ECDB0C01DA9A8130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 37a6a913120118ef39060792028d32cf84cafab1f7921791242172ee42011271
MD5 34086680b8f250d46a9fce05abc905cd
SHA1 3a16eb00f7ae0f410c0ba089b4df55a687f63950
SHA512 0a7feb7ed1bd7b3807268ecbf1c688d62e5fcae95aed8d15dcd6405d44c7935d1842cdb1d13f7f0e3c9396928d5b395823e6d5be1dc2c082787e759192c00c71
SSDEEP 384:siFiZcICsNO8TUNTUlIlgtzHueziH56e+CTdIe9JrMBOOPrXLpe8C/pBC:XFQCDwgWueo9rV9hMBOi9PuC
TLSH
T1FBD24DF258D75876E9AE9B43A77D2D038EBCD063F5946A94B3C88A0CCC9617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d55675afbfc5ad2d68ae31ee89a3aa7aedb62b8a360571a4ce78b6bba972264c
MD5 3953739fb08f14a20f26c6001f3e4067
SHA1 f0825a4ff360d359d1021736d20489f66d5cca74
SHA512 e295e9494f85827370435d7bfee63e540980b2a4933fe82d08049ac4a052e36be6c5889a6bddffa02414cf0640da206c93261437f3aa2e2bc6a9deecec4d6851
SSDEEP 384:fZcIhsNdUgtzHueziHG6e+CTdIe9JrVBOOPrXLpe8C/pBC:3hCuer9rV9hVBOi9PuC
TLSH
T17F928D31AD386C676DE7E541F58736039EFCA067F6C92F94E5ECDB0C01DA9A8130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d278d58a0c17dd14735b4e3784db3ef12d181df83814e1abeb4eaae790eefa6
MD5 d58b34a2257b56f1a717114cb7dc7f75
SHA1 4fbe07f7c78f179b1037dd301c0b5e4f35e46ee6
SHA512 6fd5875d1f6af04c78d9fd5d743e65b13ce98f5b18d8511cbb1b6af061fd6bdbeb547491ee706bf2e05a83e8a97517358a7422d54f9fefcc2456b42f8a70a198
SSDEEP 192:JONr6v+YLNQmiUy7AZh+CGN+FdeX9oEusGiU6:JONr6vz/dZh+CTdIe6JU6
TLSH
T15902E935AD782CBB9FF2AE45F48736175FA82177E9952F84D9E81F0C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dfe9729e9a3343b8ac5ce6cf9ade041fc34aa62e9d618c60a65f8fc8e13b973f
MD5 7b90cc052bc6e1cd7337b64654e5a79e
SHA1 d8272e39b67b592c3ba61a427c8b34006e29181e
SHA512 9054501a9840cf3ed41dcbadb8fffdcbbbd751d8b731553d7ce10ab3b61a83f5774e73f9539cf5b5abe8f594fc152b9ff1760747d652f419fda69964f0edcd20
SSDEEP 192:SON/6v+YLzQmiUyXAmh+CGN+FdeX9oIHSJrZx6CHVqAU6:SON/6vzZPmh+CTdIe9Jr/BU6
TLSH
T112121A35AC786C6B5ED3A541F48735139FA86167EE8A3F80D6EC5F1C01DF6AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff1886604c4c2949a8f8b7f990b71c0e0b054ab18a541b9c3ebff8127f426816
MD5 d90d6cf1133ffe0e05b1b0da6741fdbb
SHA1 72f0b2936fdbdeefcef298c224f5eac2f3264711
SHA512 229e0945c414f8e23c4df3e28c80e59688526f9db1bf6f51f0fa81f8e38b243bbc21b7b89de1a56a6f87bc4e000ab23bc04781c255c54f7cedd68b2f0e38cdc0
TLSH
T1C5412A59B6FE1048B3B77E5A9BF6A96D487ABC372E1AD05D00010E4F0A36A41CCB1777
MD5 SHA1 SHA512 TLSH

Submit Download