hxxps://gifts-donutsmp[.]net/gift/365412782114/claim

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gifts-donutsmp.net/gift/365412782114/claim
Sample260824-l93xesfj21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3480	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320401030085252"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{AAB7AAE0-8B48-4911-B831-9A720403FB39}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 3256	1768	msedge.exe	87
PID 1768 wrote to memory of 3480	1768	msedge.exe	89
PID 1768 wrote to memory of 3220	1768	msedge.exe	88
PID 1768 wrote to memory of 3220	1768	msedge.exe	88
PID 1768 wrote to memory of 3220	1768	msedge.exe	88
PID 1768 wrote to memory of 2576	1768	msedge.exe	91
PID 1768 wrote to memory of 2576	1768	msedge.exe	91
PID 1768 wrote to memory of 3328	1768	msedge.exe	92
PID 1768 wrote to memory of 2616	1768	msedge.exe	93
PID 1768 wrote to memory of 3328	1768	msedge.exe	92
PID 1768 wrote to memory of 3328	1768	msedge.exe	92
PID 1768 wrote to memory of 2616	1768	msedge.exe	93
PID 1768 wrote to memory of 2616	1768	msedge.exe	93
PID 1768 wrote to memory of 3384	1768	msedge.exe	94
PID 1768 wrote to memory of 3384	1768	msedge.exe	94
PID 1768 wrote to memory of 3384	1768	msedge.exe	94
PID 1768 wrote to memory of 2660	1768	msedge.exe	95
PID 1768 wrote to memory of 2660	1768	msedge.exe	95
PID 1768 wrote to memory of 2660	1768	msedge.exe	95
PID 1768 wrote to memory of 3244	1768	msedge.exe	98
PID 1768 wrote to memory of 1600	1768	msedge.exe	99
PID 1768 wrote to memory of 3244	1768	msedge.exe	98
PID 1768 wrote to memory of 1600	1768	msedge.exe	99
PID 1768 wrote to memory of 3064	1768	msedge.exe	101
PID 1768 wrote to memory of 4696	1768	msedge.exe	105
PID 1768 wrote to memory of 1868	1768	msedge.exe	106
PID 1768 wrote to memory of 1808	1768	msedge.exe	107
PID 1768 wrote to memory of 5000	1768	msedge.exe	108
PID 1768 wrote to memory of 5000	1768	msedge.exe	108
PID 1768 wrote to memory of 5000	1768	msedge.exe	108
PID 1768 wrote to memory of 3876	1768	msedge.exe	115
PID 1768 wrote to memory of 3876	1768	msedge.exe	115
PID 1768 wrote to memory of 3884	1768	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gifts-donutsmp.net/gift/365412782114/claim
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x2a8,0x7ff807ddc188,0x7ff807ddc194,0x7ff807ddc1a0
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2305623967836833850,343768599586781324,262144 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,9242985153660105472,13569423276633283258,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,15165376411012106498,6659443138873931443,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,6918102103151722083,5734165437448034959,2097152 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,12177454155607887092,9862675490094075414,2097152 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,1483944159434317927,16750212812083738345,2097152 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,11402669121730885638,3016017140459802430,2097152 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,12019566025557609941,2349125609003277139,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16741849437567828334,4593586989313965911,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14437541498011092616,10642062585212067118,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14437541498011092616,10642062585212067118,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,12519155113598424466,8071430057630428866,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,9177126070193063742,13685215600618880518,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,569848609262338162,7410641988660366795,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3036,i,10076936577771600884,3180137447487374495,2097152 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,8529641229594486871,1876362463186661894,524288 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,10866959194778124006,4647123941350694578,262144 --field-trial-handle=2332,i,7271120844287327187,15614635940334949569,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 88KB
SHA256 d61384d7a5af3781b1e7bffdda5e60e4554019c449b896f22a56486b5a23c05e
MD5 a334927078cb9727dfb8c3c2cbb8b70d
SHA1 0a8ed4d59660f082d9223b704f47d5586abc2039
SHA512 c798c0595a028c6ae572c7640feb3681f1503919e66a7c5222e24b0fde86606b6db97afc9648ce0f73b85315ddec127c8fdba663ea2ac4cc5fb91ca7843e2e59
SSDEEP 1536:XUpoh1p3Seu1vZLqcT+9Pn6AtvWw1BhSvySsU1iedA5sYSnXGFKPpNsjg:E+LylZL766RJvySs9iYyWFqNP
TLSH
T1E39312F868F1564A15E0B35BA309BAD561FEE8FE17A7614ED1443F14332920A68E3CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e48501a9f38e82bf86731e657c8ff0801c618b98049b4981601c9ca3faa49369
MD5 c50b76543a036e4c1af8913f61afe9e0
SHA1 dcc167e3066fb3c562b0412dea907dc92e68b887
SHA512 3215d78d66edc069650a45291bb3997e94d78f54302c81d2ade4a4c09c873b3b44ada7bf116c8688d07b9c149b9f6e52e04887312f3884538c77d09b8966b4a8
TLSH
T11E813E09829608B1FB52AA3DCEF1190B7478C74A1A971F76DC58BF3DFD05751AA1EC04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f51627489e6acdd7b089054bd499576b90ec1c6f267966c01f7ed01eb61579ac
MD5 e0167bba1ce48ceec9fff683015e0ee8
SHA1 4ed2df59c0a0dc1301e46b67cb12ac696ab5c0a8
SHA512 50176b8b4137360fad3e143a8ea04ca79fbb1a070f0fa95384d80a86ded5a45ca2c769f465ec2e004437b43c3f93c941560eff2b56018c641435950bb688d621
TLSH
T11A715109829208B2F7529A3DCEF2490B7478C74A19971F72ED287F3EFD05B51A61EC04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5897d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5897d6.TMP
Size 3KB
SHA256 b2fe03b8139cd4d208ad428de876884619ae0bd4c149e6b1cd96d44726420d29
MD5 1975d0f8a519efe69dd29a7aea52ad12
SHA1 1f71dfc31a325d61ace0d3b3d46806525d84168b
SHA512 4e41ee6397f895794b4e9123bd4a4e763c438ee88694e472457f335c121d36c69b0d8d1e85561d7a8ce4bf4887020aed3328a83ef4c49e5d575cda8927301840
TLSH
T199716F09829308B2F3829A3DCDF2151B7878C74A0A5B1F72CC10BF3DFD05B11AA2AC05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 629ffedd7dcbf55ed862718463051c2968f7ba6b908ace6d9b839fa28ae0ca95
MD5 337784a0801a1e501cf827386e3f7e32
SHA1 392d603c4ece41e5f83af863744589df583788b5
SHA512 60f078f9cc24f00ea08c653892bf7cfa66885763061c665eb525f80bde0018be38969d309732a1a680780329178ed274d5243b79df5df83f31f4199b24af8295
TLSH
T1FB51ADF793E4865D8D2152F4AA186E1BCF1D055A432C3C99C5D4EE5BE3F35B1E20160E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4dfec848b8d3a9b13fdb025a10a9567802a5e0ecea11264a196be13541017f18
MD5 e5738e7eebac50a6f402f545cc8cc922
SHA1 4c3c14c7bee929e968cb23c9456aa2834ca7caae
SHA512 dccdd204f89e6d61a3747dc224b009f9b790acedfb8bba50da7520a5fb9b958a83b3554553ca8a0a54a5e53ebcfcc7c4d3559b52d08be1ef7b2514ff0107805b
SSDEEP 192:sxZMRuyM/jK1Ml8MkQ/fMsYqfVIdpYGHW6+WNnaQ/YHyoyrwIgrJ:sxZMQMQ/fMsYmmDHbR/Rc9
TLSH
T1FA52E7116A38A977CCDFD209FA45BF53D6F90472A2900E44A9FCCA1C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0aeda55307c50d44ec570bc808d9a344775cc01b129c3f5fe612a3ff52a1c87a
MD5 0a243060af7bf216953a19aeb8bd7974
SHA1 76e01e41cd1f8d33c324b717db5e03fd98f7c7a5
SHA512 f2524493d84b007616840c8d6329d1fc6e2003502785d56a2fe96e20b41b9d6041cee24d289cf711c619648d1b681b207a837510ebc5bc7ed86f5c85be1fa8fc
SSDEEP 192:sxZMRuyMojK1Ml8UQWkQ/fMsn4fVIdpSghHW6+WN0MaAA+7hJYHHVawIg5GJ:sxZMXq9Q/fMsnomzHbvAwJ4I
TLSH
T1C562C416A6385977CCDFD209FA45BF53E6F55472A2900E44AAFC8A1C01E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e4710933f8500c2907f800adcf3807c1995e0f512f5c41f765176da7f5aed3e7
MD5 7166695073fcbec342875239e8e030c0
SHA1 a093915845a1390de97b938eb28def23d8063cbd
SHA512 6563c4feba06600fdce92bba7594cef9e133b00a3225fcf6fdfe418b4d9eb674daeea6358bc442e72e93b6d051c1f4458e33b57f07f99dfedad87bf3fa9d287f
SSDEEP 192:sxZMRuyMojK1Ml8MkQ/fMsn4fVIdpYGHW6+WNnaAZYHGyrwIg5GJ:sxZMXMQ/fMsnomDHbxZBI
TLSH
T17452D6156A38597BCCDFD209FA45BF53D6F50472A2900E44AAFCCA1C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b54d2ec57c29df4f4bd7db46fae2bace9034e7ee7726c1ce00c02dde96769855
MD5 ee73d95d3fe8fb99bca5b0ec67fad4d5
SHA1 ab7b8a2bfea1c4299876a83a9a35ecee8b00e6f0
SHA512 cabc5fa49b3c3a4bc9c969fafa4a9a9a606109759410b0f3c17479df5806609ec7abd15dbf3902696f1e78d38d256046880270793e74d2596fdad2d48fbc8115
SSDEEP 768:yZUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RJroVOz0f:yZUZYTMWvg0Pou1ja7eLZmRiEIf
TLSH
T144D20B2F280CCB7E4F844E5DEC266F963ED801CB5A984D5447EA894C03CB6EF112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3122bd63e59ba03fbdfd494f71146716a72bfada0e1a544cbc8c14cbc6ad03b7
MD5 c8a682c572c19f8362f5d76fca41e034
SHA1 a4032a8bac4f2c6beb8a542eec5c0d75eede9624
SHA512 7325a09cde4fd9e4bfb61b7d7dc22482adfacbca7379ae60fc058a421494ded3050196d2b2a52e8e864ef98ce38be0570617f96bf9fb7ce8c0c8ce390c4860af
SSDEEP 96:KA1eK2AgHWKIAWSi0KDi0+0KjKWG36K0Ihb2379p:E0lPUzNib2379p
TLSH
T13AD1F65272BA02117C7E3A0893E4976FCE42B1633058E52B7BAC01B58D27E269CFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 fb8bf4d07e4acdc54b3b1fbfa7903b8342b48bc927060e8c8d026d950c9c637f
MD5 d5e4c8dcece7aa0d6c2994a9368da86b
SHA1 6eb50648b581125ed73745de8b3ce54963ff7882
SHA512 e45c8263d962cfb928c89e359343b5cbce5c443d510e9e723daa0142575ddb60926c31aad8b2bd1c846177b6a6799c6d28a41a15dc40522e1e4dbb3b017f1a2f
SSDEEP 192:uYLsNIoQm/w++tWUNVQmiU1fNLU4zX5Obd+j1jzoryiyR+XjTk4QrqDt4/tyASnD:dsNIoPzs5jrzX5od+d8yiXXAYivyD
TLSH
T1FA625C31A878AC275DE6E594F50B3517AFB8406B9BC92F90C6EC6B2C01DE1DD131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 26355bff2f3ed07357ffd9433b6bedbd0a16023c6445c83e377d42b42547d0a2
MD5 dece3635c7230a6f74803f0bf9db7b6b
SHA1 c9cafff9f4ba368a3c319655b551d3cd02e4a6b1
SHA512 64a697e762db17bfddae3a1e9bcc48295dbd3f4a4a7af7d9491dd3d288bd1ee3fac075be07c190731217cee73f464eb8090cb7150000ef759f1833641578828a
SSDEEP 384:CZcIhsNIZPzs5jrzX5od+d8yiXXAYivyLon:whN+vO1AYiwQ
TLSH
T1DF828D329C78AC7B5CE6E195F54B35179FB880279BCC6F8085EC6B2C019A599031BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9c68efe613357c85c822987afbf2a13b1cdf2b4497f81ebff4560709c33e4be0
MD5 89abb790dea14fb322b8fd2fc03f0c20
SHA1 15b7753090d6eff4eca3d59350a43f69b2fc5043
SHA512 bc70d63c2568b2fc17885255a6f6acce9bf6324c5d66bc1cb6424152e1ab65d559fa3a6eff53e6535b1a68ebdb12256ae8960fc894d50e94b1de898ebaad13c5
SSDEEP 384:WqZcIR6sNI2Pzs5ZrzX5od+d8yiXX0YivyLon:B0o0vO10YiwQ
TLSH
T1A2B208F158EB5836D8AE9347A73E2D065EBCC017B6885E40B7E8571CCC995BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42739211ba41b2ec7effbc1f11ce8634f0cf67f4d742c400fd36142f47423cfc
MD5 57393838744ca2e53bede9a9f9df17c7
SHA1 02269ba3a60c62232600e6012672caf3fb951c96
SHA512 26d1daede3a35bdafe8b1eabca030c5298f5f1add100f9cec9dd9f762371c0304df5a6330ceacc768a54b32027688824c6581708387871c439bf3adddfddcb91
SSDEEP 192:yON761VWQmiUyRcgGX5Obd+j1jzoryiyR//aP3EQU6:yON76WXgGX5od+d8yipMQU6
TLSH
T15902C83669686CBB8EE2AE49B44B37135FE4106BEA956F80D6EC1F1C00D765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b221b45fd89b0a998f5748b9422937fdb93f852a2dcc0e4093a19ac83779ec80
MD5 268a011ebe741d64668732e24af04bb8
SHA1 dba9c1435314b47f74d1e165d731333ab003c910
SHA512 545d982643601c29ab0cebb36d3acc36ba44e145ee633b7270bcd7d7189967361cec13bae631b58e6dca36ebe857f32e71a638927c45ad87f5503126b19c0fc4
SSDEEP 384:IZcIhsNI2Pzs5jrzX5od+d8yiXXAYivyLon:2ho+vO1AYiwQ
TLSH
T1D0828D725C78AC7B5CF6E195F54B35179FB880279BCC6F8085EC6B2C019A59D031BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f81022ed2f367b2e82252c7c698d9cc940c3652aa0db2e40a50ad49aa39a47c4
MD5 29551904d75da92196974ccb24463b0f
SHA1 878f49c51966e9b664ef60b6d78c7b90a0e26ec7
SHA512 832231bd562cb628012362d68c42fdffaa34978a4424cbb1a09c2973cd67ad44bfd31233f89e68a7c32e8b0f22597b206f382f2aa8d82f288ed23d194af0260c
SSDEEP 192:FONx61AWQmiUylzcpGX5Obd+j1jzoryiyR+XjTVjJrqDU6:FONx6dppGX5od+d8yiXX/YU6
TLSH
T14912F932A468AC6B9DE2B595B44B32139FE5512BDB897F80D6EC2F1C01DF59C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb83a829-bda3-446f-9802-8d9aeca21da0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eb83a829-bda3-446f-9802-8d9aeca21da0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e08c29eefbe65e307865ad7577913ba52757af0f04f1da912f51576fd6b37cf9
MD5 060f32a00753c1174b9d06de55d10e72
SHA1 0182b9dd24a8669d3331287a8299469057f3cb1e
SHA512 f608d382c15321a004db45b5fa17d08f218c6fce34ac00af73445046f274b8ff37739a944d009928369802a434bc90cccca93e5647dbb2462800794b95b14a1b
TLSH
T1FC41DB58B6ED1148B3B76E1A9BF6B86D587BB9772F06949D00110E4E0927F40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download