hxxps://western-birthday-invite[.]nivoinvites[.]com/ [[36mAn Elegant Invitation[0m]

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://western-birthday-invite.nivoinvites.com/ [[36mAn Elegant Invitation[0m]
Sample260821-e9dh7sgn4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317606900297423"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{ECE08E7B-20DC-4E65-99FF-ECF023270447}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
464	msedge.exe
464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2448	2172	msedge.exe	86
PID 2172 wrote to memory of 1464	2172	msedge.exe	87
PID 2172 wrote to memory of 4908	2172	msedge.exe	88
PID 2172 wrote to memory of 2272	2172	msedge.exe	89
PID 2172 wrote to memory of 4908	2172	msedge.exe	88
PID 2172 wrote to memory of 4908	2172	msedge.exe	88
PID 2172 wrote to memory of 2272	2172	msedge.exe	89
PID 2172 wrote to memory of 544	2172	msedge.exe	91
PID 2172 wrote to memory of 3280	2172	msedge.exe	92
PID 2172 wrote to memory of 544	2172	msedge.exe	91
PID 2172 wrote to memory of 544	2172	msedge.exe	91
PID 2172 wrote to memory of 3280	2172	msedge.exe	92
PID 2172 wrote to memory of 3280	2172	msedge.exe	92
PID 2172 wrote to memory of 4708	2172	msedge.exe	93
PID 2172 wrote to memory of 4708	2172	msedge.exe	93
PID 2172 wrote to memory of 4708	2172	msedge.exe	93
PID 2172 wrote to memory of 4896	2172	msedge.exe	94
PID 2172 wrote to memory of 4896	2172	msedge.exe	94
PID 2172 wrote to memory of 4896	2172	msedge.exe	94
PID 2172 wrote to memory of 4124	2172	msedge.exe	97
PID 2172 wrote to memory of 2400	2172	msedge.exe	98
PID 2172 wrote to memory of 4124	2172	msedge.exe	97
PID 2172 wrote to memory of 2400	2172	msedge.exe	98
PID 2172 wrote to memory of 2864	2172	msedge.exe	100
PID 2172 wrote to memory of 1608	2172	msedge.exe	109
PID 2172 wrote to memory of 1304	2172	msedge.exe	110
PID 2172 wrote to memory of 544	2172	msedge.exe	111
PID 2172 wrote to memory of 4016	2172	msedge.exe	113
PID 2172 wrote to memory of 4016	2172	msedge.exe	113
PID 2172 wrote to memory of 464	2172	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://western-birthday-invite.nivoinvites.com/ [[36mAn Elegant Invitation[0m]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcdd16c188,0x7ffcdd16c194,0x7ffcdd16c1a0
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,4490868247231485918,18043069906431642778,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,18170443416104849434,7524368599493949843,262144 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,1436921659242537378,15128751260955565080,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6281093203359133617,13732373736169445156,2097152 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6883318331036483191,17635644047472600469,2097152 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14553944814640876207,3317225245284758368,2097152 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,15401498556958016236,15104157444617014579,2097152 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,17481768160841574505,1551681077017038681,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17664027950240626908,6128214496027930420,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,18061207504433572091,6321220836028027614,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,18061207504433572091,6321220836028027614,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14935588739613226516,14118674222823123579,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,11428948333609351428,5805729754537398019,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,9030878708143277335,16730625701386772585,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,6744693148910290790,14682089595724144726,524288 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4728,i,10148792784531333864,6563797767720360141,262144 --field-trial-handle=2284,i,9374918887492675135,1794229328675405017,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fd216c7727d0e3760ac73bf83bb499de618d7844125d442fcb806cf190a9112f
MD5 1c25701f6aa1871452be6fbdbf44de32
SHA1 adbca18385edea50558f139093af9f6ec67cd1c4
SHA512 604a80841f4ae113add4d3c6f25908aa8d9b9a856b9e189c5eff3a1d8a90ae3c28b1ade6df2c2a9ea00a89e26b2168614e8bba470f48f2d26d1bd4fe09b5e20e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 83c9debf8db916c18e861edd063f1326e5b249731a78cade0021062aa8408b47
MD5 49e11fdb31ef15e5ed42d8e1432fd13f
SHA1 15f2d2d2a8aea04ec7170e2f517cf2a0c29d632e
SHA512 0d1f8c8a0bd5e57d3f84f2de970efc2452f8e8774cebcc8e1ca4f8f3c3db135d0782c1a25c2fc56543adf2fdfc3d4e81f5899e878958be910dca5dbee291d2e3
TLSH
T1A66129360A6684B7F3A81171F1F4066B7571C1862FA7EA751D10D5FE3119F1680A21EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585d5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585d5d.TMP
Size 3KB
SHA256 4a2b515c19ce32c3610416d6929bdf9a774775f0d4d0c67ddd173a6dd75bed70
MD5 22f1122a24d96675d729aaf96db25152
SHA1 13e167761e7217e9aa827e140cc89a7dca4aae5a
SHA512 7e4f51b88df557beb3408d68383ffda6b7f074638ef75b25eb5e00b1394ddcf918edc4e88cd0e18557ef3252b2acb34af16f414abaea52b9b7eaaf7f3fe0ce87
TLSH
T1C06109360E5688B7F3A81171F0F4066B7571C5862FA7EA761D14D6FE312AF1680D21EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1a40f3f0e7bb2ec3d1ccf58da887d06a1db5172f27b8643b50e0969ea4557a68
MD5 537c9902c457b8c9eae8ba5511cb6ab2
SHA1 2cb2246115f81d7842dd3f87c66f0c004e23bd9a
SHA512 284a3ea6e7cb3a343d015213261236842eda91617bd1500d03a27dafb200d4f9a073bdd50af3d20d515f9876d8fec29a716ce715d9beefb7720b2ff0617707a2
TLSH
T1FD118BB3C7E5966E890556F05A18AE1BCE2C0602822C7C598AD4EF2783E3065E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 27735c38c7ef752c8f65905e6c1542af2eb6427aeeab82c63950542bca63fe49
MD5 ca4845899624b65e7a95d69d48a5741b
SHA1 fc1932748f137761c3a28237530711f685ee0bb5
SHA512 f37eb0e63af9bf88451344cfb3711870000e50d9f656a61a81d1659d56d03e47f80b18b9947a3d22ca5ddcc50b5b0a6d2cbd6f849ab4cad70d303160b2284928
SSDEEP 192:sxZ/R6yM/jK1Ml8UQwkh/fQsHYMrIdpiNHW6+WN7nc/YH6xOqIg5CJ:sxZ/cqDh/fQs4M0CHbY//c
TLSH
T11452E7566A3459B7CCDBE209B942BB53D6F51473A1904E44AEFCCA1C00E7AED721382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ee8ff616dc8e8d90251987dc8004e157203c009602913b8df8cd544937457ea9
MD5 42e66c1793702c31d0ff86609363b246
SHA1 2527ffb849b24686aa478bb2c958ef90a91213fa
SHA512 19e53e4deb8211c1a6f0a0fc9a2f1d4f8dd533e78b0065ad0bfc799a3fa80d1cc98f347985933cd010bebd9be47ee3459bdf73b833776d27337a45d0e6bf4bdd
SSDEEP 192:sxZ/R6yM/jK1Ml8Mkh/fQscArIdpgNHW6+WN7nc/YH22AqIgrJ:sxZ/cMh/fQscA0cHbY/G9
TLSH
T16852E8126A3469B7CCCBE209B955BB53D6F51473A2900E44ADFCCA1C00E7AED720782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b31d163aae61f6daeaeff15b70bb5ceebe830206aaff681308c139e9fc10e635
MD5 02f163b61dc089b3b79549d0372fc36f
SHA1 37de1ef76e56efe52d08322b5cb6697f22cf012b
SHA512 8986cba65a41e958eea06edadc8bc8034b4856684ea1098342e075eec366dc7d779e965e8ed5734a48029dbba8d00f553a3da653807fb0b4b2e2c67caa421296
SSDEEP 768:3aUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RMroVN0t:3aUZYTMWvg0Pou1ja7eLZmRXUt
TLSH
T1A8D20A2B284CCB7E4F844E5DEC266F963ED801CB5A584D544BEA894C03CB2EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 cddc7c154d6f057dd409ae72f944964e288fac34f1c75473b86b28cb2225da2e
MD5 04b075b0b07a2769668963022891d578
SHA1 ffd220bd910e0a3d8ea235ade8cc1f7fb3d44fb4
SHA512 a182402b5812a5150dfec9ea099c9e4d8881a01977a14d9894c85b2064078fcae4541c1018a1c35bc9e9f63fd2217cc6bf2f6bfb5fa29106e4ed4483055a7e1d
SSDEEP 96:KA1eK2A08AK92uywgK1WKN2KeI6SUwKJGN:EuvzgxDG
TLSH
T18BD1485670BA03417C7D2A4D836487569FC1B2A73128A86B7FAC04B25D27E21DEFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5411a49f-6230-43dd-8ccf-a23bd8aabd5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5411a49f-6230-43dd-8ccf-a23bd8aabd5c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9f41b7c4461297161ffa05bfdef0b4efa63de922708895a89f19038a912082fa
MD5 8a561205f01875bb3e7323d6c9a10f4d
SHA1 0ef61bda5d8998d05560b5c1294275c231998aaa
SHA512 5837427abc70e1b9188be12a13f771213cb1f602742a9f557e4802902145f2df7120eea06652f0382a7e4b57aef8efb395eedb47c47089f45ec915c40bb92626
SSDEEP 384:aZcIhsNb+zfY8G5uzX5od+F8rAXpq2Divm3so0:YhtfC8OIpq2DiO8T
TLSH
T1B8828D315874AC766CE6F185F84B35179FF890639BC9AF80C5EC5B2C009A6AD1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7c28f1b94c547bfa904c7f37e50dd345336109b01351c0e0df4c646a61656a09
MD5 3231deb5aa3836490ccec097a6901fb3
SHA1 18fb8d267ff36e48ad78867971d7f040a6a9189c
SHA512 9fecedb5eb654e7ab6e08362a4f3af2f496f24fef6dbe6ad73b3c6bfa1eb2400c407b5bbd81f7e1fe984103370c2ad05ecd93af2b7a9f21ab2b3d12951f3db14
SSDEEP 384:LZcIhsNbrzfY8G5uzX5od+F8rAXpq2Divm3so0:ThofC8OIpq2DiO8T
TLSH
T19B827D315874AC666CE6F185F94B35179FF890639BC9AF8085EC9B2C009A6AD1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 3b5d3771954ba6726dc97fb7e2f8d3cfbee8a088781c0e56eadd6a940775c390
MD5 d6e7bd454fb2f16eaa2895cb7e6c1e2f
SHA1 a645cbc7d1a15cceb191360aa1f6ad88a641b409
SHA512 93fa2f97785d40e1c9cbf030d42fcc2c3b89b1edde0bbb543474ed38991127ded7d32cd16dbe16903ba24e4b09583098e7eea83b424858d62f5facb72492f6de
SSDEEP 384:kiFiZcIzsNl8TUNTUlIlrzfY8G5uzX5od+F8rAX/q2Divm3so0:/FQzowgVfC8OI/q2DiO8T
TLSH
T1AFA25C3248A4DC7BADE6FA85F94A31178FF45063CA89EA90D6DC9B2C009B5DD1307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d33825579c23e4920dab6b05cff29b7bfa14f00e5326fedbf935bdfdb4934ae0
MD5 469c2b921b3befb2fcdfa752ae3616b4
SHA1 84db3d983002f773088a4930a24091b1f0430d95
SHA512 c7f673a59565cf6738e5a3b7bd97541a4991cd8cc175ce77fa74ec6a3df9c6140b55223e4bb840cfa659d0de9380bac64765da8c5167ff7ce49fbf07f278bc55
SSDEEP 192:yONr61VWQmiUyvIgGX5Obd+jVjzorr+/aqg3GSU6:yONr6WBgGX5od+F8rNqVSU6
TLSH
T1EF02C93568686CA78EE2BE49B48737235FE41067EA556F80DAEC1B1C00D769C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cb70e715612fb3a7163efbe93cbd33b9e54cd97bf6fad89cc0a89de614bf1e84
MD5 3824e0df6526e753acaa92c9860c3e0e
SHA1 e927c4aff6dbb8c558cf8fad7eed536eaa5af91e
SHA512 6d842f4bb3f585f9cab4c9dcbd4c640ff106b43e6ff981fa64e4531a3421be710d18efdbb9b44770a1ca8850c9a04663f132f4e5a65f147599791bdef479b2b1
SSDEEP 192:sONe61NWQmiUyXIkGX5Obd+jVjzorrAXKXjJqCq2DU6:sONe6STkGX5od+F8rAX2q2DU6
TLSH
T1B6121936A468AC678DE2B555B48B31139FE55127EE897FC0DAEC2B1C00DB69C530BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef1af7a9371ee3398b6a8d013ccfc3970b1221309b462a08a10cdb9c50339347
MD5 d90dce524412e76307e4ae885386d3a7
SHA1 18ede22ad9f8b63453f68aa0cb1ecafbd280d3d1
SHA512 d842edfeafb5080e04f69accf31204d94db03c8db03f1e0841d29814e1c1970e9a5b88d8c64207502707d1dc0e8f02dc0695feb47a92416906ff164c1bb62b62
TLSH
T182412858BAE91108B3B76F1AABF6A56D087BB9372F07816D10010D4F0A26F40CC71B33
MD5 SHA1 SHA512 TLSH

Submit Download