hxxps://festivalsource[.]co[.]uk/can-you-bring-alcohol-to-glastonbury-festival/#[:]~[:]text=Glastonbury%20has%20a%20hi

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://festivalsource.co.uk/can-you-bring-alcohol-to-glastonbury-festival/#:~:text=Glastonbury%20has%20a%20hi
Sample260910-n2a8jsseng

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
41	reallyfreegeoip.org
42	reallyfreegeoip.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335147996236216"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{E4C3B2E9-F74C-413A-95E6-9E0B273A3CED}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3996	2536	msedge.exe	81
PID 2536 wrote to memory of 4932	2536	msedge.exe	82
PID 2536 wrote to memory of 4608	2536	msedge.exe	83
PID 2536 wrote to memory of 3728	2536	msedge.exe	84
PID 2536 wrote to memory of 4608	2536	msedge.exe	83
PID 2536 wrote to memory of 4608	2536	msedge.exe	83
PID 2536 wrote to memory of 3728	2536	msedge.exe	84
PID 2536 wrote to memory of 568	2536	msedge.exe	85
PID 2536 wrote to memory of 592	2536	msedge.exe	86
PID 2536 wrote to memory of 568	2536	msedge.exe	85
PID 2536 wrote to memory of 568	2536	msedge.exe	85
PID 2536 wrote to memory of 592	2536	msedge.exe	86
PID 2536 wrote to memory of 592	2536	msedge.exe	86
PID 2536 wrote to memory of 2816	2536	msedge.exe	88
PID 2536 wrote to memory of 3436	2536	msedge.exe	89
PID 2536 wrote to memory of 2816	2536	msedge.exe	88
PID 2536 wrote to memory of 2816	2536	msedge.exe	88
PID 2536 wrote to memory of 3436	2536	msedge.exe	89
PID 2536 wrote to memory of 3436	2536	msedge.exe	89
PID 2536 wrote to memory of 1968	2536	msedge.exe	90
PID 2536 wrote to memory of 4040	2536	msedge.exe	91
PID 2536 wrote to memory of 1968	2536	msedge.exe	90
PID 2536 wrote to memory of 1968	2536	msedge.exe	90
PID 2536 wrote to memory of 4040	2536	msedge.exe	91
PID 2536 wrote to memory of 4040	2536	msedge.exe	91
PID 2536 wrote to memory of 4896	2536	msedge.exe	94
PID 2536 wrote to memory of 4896	2536	msedge.exe	94
PID 2536 wrote to memory of 4648	2536	msedge.exe	95
PID 2536 wrote to memory of 4648	2536	msedge.exe	95
PID 2536 wrote to memory of 2180	2536	msedge.exe	96
PID 2536 wrote to memory of 1484	2536	msedge.exe	98
PID 2180 wrote to memory of 1224	2180	msedge.exe	99
PID 2536 wrote to memory of 784	2536	msedge.exe	100
PID 2536 wrote to memory of 3784	2536	msedge.exe	101
PID 2536 wrote to memory of 4768	2536	msedge.exe	102
PID 2536 wrote to memory of 1800	2536	msedge.exe	103
PID 2536 wrote to memory of 1800	2536	msedge.exe	103
PID 2536 wrote to memory of 5008	2536	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://festivalsource.co.uk/can-you-bring-alcohol-to-glastonbury-festival/#:~:text=Glastonbury%20has%20a%20hi
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x21c,0x7ffc2c7cc188,0x7ffc2c7cc194,0x7ffc2c7cc1a0
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,12565868235639807155,14169953459789371332,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,9993719767672072356,17395872381922271215,262144 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,17291391768846874489,7041225687757194126,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3300,i,5559192142745789798,7088578165763792814,2097152 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3320,i,13558764939383360511,10836729476067243244,2097152 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,22411549287622352,2839506082151852210,2097152 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,3158648418757833047,18182365391675939301,2097152 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4224,i,14242224526849867893,16075252580427408350,2097152 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4280,i,8599333564138597383,391948773771079767,2097152 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,8667370828694392417,13442798978216871723,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,18409662257862430955,8249234682165957142,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,12019078476517747583,17733589860539579712,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11326303832750466304,4444713882044667234,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11326303832750466304,4444713882044667234,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,4285780431581036977,13227033304495884077,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,7911882067351116188,9763208131075842588,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15910977808569860303,10506577974401271331,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17207087598934283775,14061873103328463773,524288 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6372,i,7483848098481008614,8176080913878160516,262144 --field-trial-handle=1900,i,13605491255926020478,15307539857060729754,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

1b2df87b-a35b-4010-8bc9-4fac508cec6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b2df87b-a35b-4010-8bc9-4fac508cec6d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3374052173a032fe00343d702201606ce4bc1b5c1d6b0539861967f96b844176
MD5 9582ba22073d1364ae757ae0de3d35a2
SHA1 5b0314912d785b65400e89c872f27989cc9f512e
SHA512 edc15a3ee9a140c8bcabffca6edcf48a02150685650af7a259c8e3e6f06b221d8e060860f6e5897072c93b39aadc8b7dcee10648d6abba21b98a3ec21680af5e
TLSH
T154812CF446A200A3FF50F0B154E36D06357D8B854AABCEE6C5A0BEF15D26BBCDE64104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b438.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b438.TMP
Size 3KB
SHA256 4c82a47d864a9d9eb281036dd2d3fae22b35acfadb18ce92e8ebda61b01e6c1f
MD5 46f37b37ceea0990758950adf674dbec
SHA1 a366759774b36c3350b83e1343cb7e1b0e1deaa9
SHA512 14f47fefff1ba12bdba26cdc9efa83f02bd25e32d959344b767c9d5f785a333f82f18d3cf2eafbecd80b8d0ffefbcadf97eed36d99c7090f4515403df5b77f1a
TLSH
T1A271E6F846520493FF60F072A1E76D06357D83854A9BDED9C4A07EF25D16BBCED68104
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fee848913ba04f92c23b33c6556ae858272fe88b47d5f7063c7e714dbf550906
MD5 e79cc69028d6f51fcd44c4790772657e
SHA1 97af105e67ab542057198ed339fb5e896368db9c
SHA512 93178f53a2d44571ffa4d5828a5b4e8f86a10fb3a1354331454715baa26644a2d340c22a29accdc20f4f444d35f9288201e7314ce3ec50b00df72e2eea55f379
TLSH
T12D81DEE7C2E5867CCC9666F05E156E2ACF0C0A12839C3D09C9D8DE0BEBF6470D11194E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 55cf040b932355ce39cff8ff5bc3a44d58b01c8176403f0bb0672033fb075d0d
MD5 8d5e52548f3296e0129da73fa25c4ff1
SHA1 6776ef3fcd8e80b145001e1236af050be90276d5
SHA512 2810411d7f6df23581e5eaea88d99b1e8fa2863ff06dd68689de6d3b52eeb0f82ef0eb3600bdab98690b38bc106c193072f86a16b3f8e3c1474a94260d6d68e6
SSDEEP 192:sxZjRWyM/jK1Ml8Mba/fqsWvIdpJ2/W6+WNPRO/Y0azDitIgrJ:sxZjgDa/fqsWAw/bE/5f9
TLSH
T1E2420852AA346977CCDBD209F945BF93D6F8547292900E44AAFCC91C00E2BED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 12071fb9523d0618ddd7e3d68b592ca83a5e75e5532bf78dbef9d705fa407e6d
MD5 15dc50d2dbf4c5ff1636d443201195d0
SHA1 79bb684b6c961d5974fdf71fb356585295895d7a
SHA512 405cf0f3e0b5eeb5be1d4107e63c12c79823664b21e4f2cfa67682e5225b974eab3a996d9dd9afca29149c05d4005a55de632b92c1fedc4b8214395d9cec08a7
SSDEEP 192:sxZjRWyM/jK1Ml8Mba/fqsrvIdpJ2/W6+WNPRO/Y0azFitIg5fJ:sxZjQDa/fqsrAw/bE/5Tr
TLSH
T116520956AA345977CCDBD209F945BF93D6F8547297900E44AAFCCA1C00E2BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ec98ac23226e2502cf5e2730fed689240125cf3bace0b558be1db80f65f08f9d
MD5 054ac16fdcb885337fd1aeeb364ed39f
SHA1 225091eeead161cf5e9039adcd847d7ee619c1fb
SHA512 497e68951ec667ffe6b71bcde929420bf09f5c1afb4d9fbe90f945a75ddc5b5f06975092a0e9cad95400847eb9db945d98f1eca93263fb5f2fd5b9be36f94b62
SSDEEP 192:sxZjRWyM/jK1Ml8UQ4ba/fqszvIdpj2/W6+WNPRO/Y0aI4ytIg59J:sxZjQq2a/fqszAS/bE/5Jt
TLSH
T13A520856EA345977CCDBD209F941BF93E2F8547296900E44AAFCCA1C00E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 d1d621c6d0124efb7159bb3904b64fc8c754c9d2a6c98811ee0c39a8c5af4616
MD5 e26b4ad045f4e12eec2b0a29e0b2dd85
SHA1 ee9de3c6b580df5d897eca391b6151415c381483
SHA512 db1dd3b214a9f84de677384d1412f3b9c5e240c17ec32a209ba6a76245ff949b4eb6cb039079e48928832c34dabf8c2c83aea3a21fb77d41db8e352090b5f608
SSDEEP 768:XK/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VBMroqz:XK/zh8dF2PkWRmEcQXwu1jaKWjLp2tV8
TLSH
T195E20A2F280CC77E4F844E9CEC2A6F976EE801CB66684D5447EA894C03C77DB521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8236780f77cb1e4ef9ebac7687acb8beeb2db72ab1b9cbe7865810f56191144d
MD5 325f2f4198735fe7815e4a0a37e3109c
SHA1 a9efdd5532bb9e71c80ef2159ae13f46d2b9194d
SHA512 8873782cb0b3878aebcbdfdd2b3e66dd0dde89c54664a9ae35712248ab9978d2c7d4fd4947fba74b84c47c38b99709d4e28e98f659e351ba573154d16b4d68dd
SSDEEP 96:KEWgKvrYgKRyGqqEKLCAjSKg46GhiKi0C:2cD3OBhL
TLSH
T160D1236372BB02113C7D2528A7A097676A43B6673418AD3B77B814B24E67F204DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591b4e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591b4e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1ac06048b6d802ddbf3828869522f2b0162b1194b63fe3600e618f04849f7c48
MD5 4812ba51f94f7e10f9c055446d78d0f5
SHA1 6d149a3ba0da8566d26f52509ad77197cd93c56e
SHA512 9073489fd5cee1d99c67a706e0443bcfd71f66ceb4538476dfc6fd47d18f73a4198b1d271956a4ecb8c8b01148dac1a29e3d5baf7121e6398e9e104ff310f047
SSDEEP 192:u768NHY+QmIhp2U7RiQmiU1FAjFe54nv0qOO5/NPzYaqQU8:H8NHPhISuAfAhemnsqOO5qIU8
TLSH
T19B4217766C68AC765EE3A144F48636139FB450ABEB882F84D5DC2E1C01DF69C235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3e51f0c81e933a9a9d430c0e5004bb00ddec1e4b203abdc53655e098dff66a25
MD5 6621f9646af8e4ec90c417ff7610c123
SHA1 e51896a0f627a36e03837566551cd2a938d30ac7
SHA512 01c40e25f2a706b4ddef79a800ee7a60b5418f6f5b82b9e3f99824ff31cdbbdf887c060c469796177bf46c7d7a99f8a9f400410a9e68e5e42d646d3bf1bd94ac
SSDEEP 384:O5iFMZcIC8NZ8TUNTUlIlShISuAfehemnsqOO57IxuvzxV+Mhdp1BXo3:OQFaCEwg4ISF6sqOG7I4184p19c
TLSH
T143C218F258D79976DDAE9743A77D2E038EBCC067BA845A40B3885A0CCC465BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 af56f257732a3876d2de4d2c109ed0f2090b375095e21a6a3dc96548f79dd541
MD5 dd376a6dcfcee6f18b9804441deaa8bc
SHA1 ff5c92848001d8f4722c5b7d762609a3a2884db0
SHA512 8d49c345f347ceb250460eba4a918a0df44c042ad2de9027633341c336ae468c70537239ba2f0b6ae68689b435ddaacb7f4947b1c4ac0e044ce7a7ba3aebd90b
SSDEEP 384:nZcIi8NHShISuAfAhemnsqOO5qIxuvzxV+Mhdp1BXo3:PiHISP6sqOGqI4184p19c
TLSH
T13D827DB26C686CB75DE7E141F88673038FB890A7AFC81F80D4DC6F1D018B698171AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bd58a1dfeb913cf01868e9032167533ae88ea013fb816a00ee5947c4b31e097f
MD5 fbd45efb642fad5c37455ae5d6dc77ea
SHA1 9df0fc4e2817f1e94347c9bb98dc6cc5bb490003
SHA512 4f0c183e50c454c028f520eccece5ea20d35f57040ad1b0a72d1a04e99220ccebfe4bd301fee1b4874e3dd07a6e21b470dacd4472044eb050cc70ab525d7ee13
SSDEEP 192:u7Q8NHLQmIhp2U7RiQmiU1FAjFe54nv0qOO5/NPzYaqQU8:r8NHLhISuAfAhemnsqOO5qIU8
TLSH
T1D94228766C786C765EE3A144F48636139FB450ABEB882F84D5DC2F1C01DF69C235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14c2a7b0a34e4492032ea95ddd99e7c165cf592613dd5ced57f3c3f2c172df30
MD5 4a77e9333b35dbdcc15694a24341238e
SHA1 39414570bf561bb14b71541a090924433bb358e5
SHA512 ac1ce2b2f2f7c91a77b9c62ca1f588e30c11a0186a8c7026d7088bf5b3c0dedaf72897caa43ee6b5c091672dee72b0f859f2a6a3cae16c2efc1a01ba6202e473
SSDEEP 192:BGNG6P2UOcQmiUyFAIUFXqGv0qOOnwSG8U6:BGNG6eXsuAIkXqGsqOOPDU6
TLSH
T1D702D875AC782CB79FE2AD45B98777135FD8206BE9952F80D9D81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f19e0b4e8f29b99702bfdadfac05499bbe3e5e1a0786098dca831e80e82bba06
MD5 d0e53035aa57461f71a299099bd97358
SHA1 63ed263ac9fbb8b3bd88b90179e28a50545a6491
SHA512 dd6f4664d5d8616ff316cb9ce9f97500d94f557ce51cd18f7bec3f966d93046e1c50584b5f3da88ccfbb060cb5c3914ca5a66be2caa85422c29e294477cf9b83
SSDEEP 192:RGNC6P2UeQmiUyFTEFXyGv0qOO5/Np0BaqQU6:RGNC6eNuTUXyGsqOO5IIU6
TLSH
T1B4121A776C686C775EE3A541F48736138FA85167EB892F80D5DC2E1C01EFA9C234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f16102a-0924-4703-9e87-21401dada904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f16102a-0924-4703-9e87-21401dada904.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download