hxxps://kawaiidragonquest[.]cfd/index51[.]php?flow_id=81&conversion=ZhfCM9vFZBw&bid=0[.]01&campaign=2558869&pubfeed=1280952&subid=1322571&country=mx&city=Benito+Juarez&os=Windows+10&browser=CHROME_153[.]0[.]0[.]0&carrier=Uninet&flow_k=f3635145d4

Resubmissions

22/09/2026, 16:09

260922-tl4staaa753

22/09/2026, 15:41

260922-s4wdqayajd3

Analysis

max time kernel
148s
max time network
147s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/09/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kawaiidragonquest.cfd/index51.php?flow_id=81&conversion=ZhfCM9vFZBw&bid=0.01&campaign=2558869&pubfeed=1280952&subid=1322571&country=mx&city=Benito+Juarez&os=Windows+10&browser=CHROME_153.0.0.0&carrier=Uninet&flow_k=f3635145d4
Sample260922-tl4staaa75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345669928255255"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{EDB3A2C9-21E6-47D3-B2AE-3629737F4591}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5488	msedge.exe
5488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4748	4652	msedge.exe	83
PID 4652 wrote to memory of 3284	4652	msedge.exe	84
PID 4652 wrote to memory of 2612	4652	msedge.exe	85
PID 4652 wrote to memory of 2612	4652	msedge.exe	85
PID 4652 wrote to memory of 2612	4652	msedge.exe	85
PID 4652 wrote to memory of 2768	4652	msedge.exe	86
PID 4652 wrote to memory of 2768	4652	msedge.exe	86
PID 4652 wrote to memory of 4856	4652	msedge.exe	88
PID 4652 wrote to memory of 4856	4652	msedge.exe	88
PID 4652 wrote to memory of 2228	4652	msedge.exe	89
PID 4652 wrote to memory of 4856	4652	msedge.exe	88
PID 4652 wrote to memory of 2228	4652	msedge.exe	89
PID 4652 wrote to memory of 2228	4652	msedge.exe	89
PID 4652 wrote to memory of 5640	4652	msedge.exe	92
PID 4652 wrote to memory of 5788	4652	msedge.exe	93
PID 4652 wrote to memory of 5640	4652	msedge.exe	92
PID 4652 wrote to memory of 5788	4652	msedge.exe	93
PID 4652 wrote to memory of 5328	4652	msedge.exe	95
PID 4652 wrote to memory of 5588	4652	msedge.exe	99
PID 4652 wrote to memory of 5588	4652	msedge.exe	99
PID 4652 wrote to memory of 5588	4652	msedge.exe	99
PID 4652 wrote to memory of 4860	4652	msedge.exe	103
PID 4652 wrote to memory of 4860	4652	msedge.exe	103
PID 4652 wrote to memory of 3604	4652	msedge.exe	106
PID 4652 wrote to memory of 4788	4652	msedge.exe	107
PID 4652 wrote to memory of 3728	4652	msedge.exe	108
PID 4652 wrote to memory of 2420	4652	msedge.exe	111
PID 4652 wrote to memory of 2420	4652	msedge.exe	111
PID 4652 wrote to memory of 5488	4652	msedge.exe	112
PID 4652 wrote to memory of 3532	4652	msedge.exe	113
PID 4652 wrote to memory of 3532	4652	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kawaiidragonquest.cfd/index51.php?flow_id=81&conversion=ZhfCM9vFZBw&bid=0.01&campaign=2558869&pubfeed=1280952&subid=1322571&country=mx&city=Benito+Juarez&os=Windows+10&browser=CHROME_153.0.0.0&carrier=Uninet&flow_k=f3635145d4
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff96c59c188,0x7ff96c59c194,0x7ff96c59c1a0
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,10366166100918910796,9035511494648686207,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,227415562036465050,8002893201287372832,262144 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,18029128199654727971,9278807915442507163,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12074407166560843519,12306503199882497614,2097152 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,15674537833410457148,14419390753908904034,2097152 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,6652220532773758055,4942379582975916083,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4026526840625246003,3592367818055806155,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,8216903616050584788,17961912830095735016,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,8216903616050584788,17961912830095735016,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5944,i,14492350822635586822,9280549884268832703,2097152 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,4935858151365732513,15186775212374382662,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,14755622341723951642,4001061187283896849,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,18164840607672175454,13329565524697383964,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,15053989825355511704,18217553704037304283,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1722361212870872350,6268830190729105160,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,9581245815248613808,10482340976323832644,262144 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10242980175365847155,16991464644657248343,524288 --field-trial-handle=3036,i,11330098242724415533,414343393022733103,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

70b4c145-a3ed-4dbd-8b33-813f8b1d1e1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70b4c145-a3ed-4dbd-8b33-813f8b1d1e1f.tmp
Size 10KB
SHA256 90cec1a9619fdb10ab87978587e3dd25975cbd885bf52cd8ee7e3f6694f1cac3
MD5 6a887adc706a502fa93ee8e6532cb1d4
SHA1 e378458b111460fdf1d0eb9d64506e50205b1b08
SHA512 dff37225a061e5240b1d79e84e6bce7ad4699628ab164d59a06a8606b3e6a2b49b2c01992d141bdcec5ddcc895c9cc50851d58eae4246459d1fdc0fb329932a2
SSDEEP 192:sxZ7RGka/fAsPXezodpLHW6+WNGYC3Rdr1Igj3J:sxZ7Pa/fAsPXFLHbGv9jZ
TLSH
T1A532C6556E38A93F9CC7D619BA55BF53D3F95032A0901E48E6FC8A1C24EB6CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 25a11858451b97dbff0b0cf319d25691e6ee507ba329fc5baa9b1ee81e808522
MD5 5b71075dc10f8f5807392bd2d5a45544
SHA1 f5c64e46a5cdc646b2b4229f55b10b41e2ada801
SHA512 039aa68236a14429989b61e8214616c3f5be4b740c25ade32b8e4a3d8f1464958f57c181f6c8e8a9d3fa5b171494b4fb3d44025eea22cd1209b687c192c46736
TLSH
T1D9F0F9B5CD21BC6B18FC1B2820A54746F791135B3B40895F3B3C410D8FB8637859686C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e9a70c6bb894b48f28febc5265f879b98df24fddfb5062bba7c495302e3605cd
MD5 79fe27693d88ab7c9fb4d87268c55bf5
SHA1 5f064a715c82d1d4f53043e7a78da31d088cdfc8
SHA512 c25e44fc28286df9a4e1d127064cf263fa652dc53472d8092a4ce6cdf9719f3f21f1ba4b7d1119ab3bc3b3d9c47e95279f7a86bbf5d18e6199c55d36c9a94407
TLSH
T1DF512883D6958F93C7B8C33082DE01BBBAB08DA075830E9D3BE4C8365BC6355AD5D088
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8ad990764a3b134cf48a99d1967b684fcd5d8616295be06c368e5da4c98fa936
MD5 d4957ad4ea21e2d32a8c0271787dbe38
SHA1 94ad6f10a30a936731de2f4340cc10ac8e3bf3ed
SHA512 fe173f47cb7eaaab457e985b141251eb55223267d59b2e422db9600948fab881d1991440ef4a44799199ffdbe7f0a81c15833be98141e9fae78fe679c3b44ad0
TLSH
T1D7610BF783E4866DDA0196F0AB14AE2BCE1C0505432C3D5A89E4AF5BD3E34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8fad4964191a9bef313cd497b9de5559d4ed77f16de8f15100f9023020670910
MD5 e6964ca436821ee4e6892aebdb8cd10b
SHA1 9fa8a3e1b162f4f58a5e305a6e13e352f63d2554
SHA512 b12f1ac5b490fa4762d1cdb47b2dcd4751a34290c86537b11822f7adbb44f1115099892d3cac3f7c024a5f86afd7e832692d3d3d400e7766189c384254efa569
SSDEEP 192:sxZ7RGka/fAsgXXzodpl0BHW6+WNpJIn9/YC34dr1Ig5ky3J:sxZ7Pa/fAsgX8mHbXi/A9myZ
TLSH
T19942C716AD38693F9CC6D619AA15BF53E3F95133A0901E58A6FC8A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c20005e221599c1be088f5a904de6c34712b2a0fb2f45a14f9bcf007b22f9d74
MD5 d80d61bee90f488a7d51e98e60f6bd3e
SHA1 6ea24cee8a93ff3491db637bc0a1f65234d6fa25
SHA512 56b211831dacf659e5a3517244b630e75b6253bfde85396a6f8824f77779482ce09bdb32c3b5c5f264bb3c10091539cf7fa7fb60c9ecb12119331d878960982b
SSDEEP 192:sxZ7RGka/fAs9XezodpLHW6+WNGYC3Rdr1Ig5ky3J:sxZ7Pa/fAs9XFLHbGv9myZ
TLSH
T1C732C555AE38A93F9CC7D619AA55BF53D3F95032A0901E48E6FC8A1C14EB6CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d13fe99a73ba75fa1d443f1e6be9e39c6546b620562039b35d66d9769fa83419
MD5 dc5907c3ed19db2269ae1de9e987d2c8
SHA1 b6c8ddf5ffac8bdcd8b60d6d25aff2e39f43402f
SHA512 5b570bd05ef0580abeb132ec1bbb0e96bdbfaf868405ef32b252d5422736c6ce2294593765ee00a63b05e95d91df1a28e5e513a20b9e5bab9e19d422b6561b86
SSDEEP 768:d8+S3v9WvhLvb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcwLle4ZvWrohMYd2:d8+S3v9WvhLvbu1japwLQ8vtKf
TLSH
T1B7C2E82F380CCB7E5FC01E9D9C5A6F9A6D9802C7A6588D4047FE994C03C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 201665f8c0781cc8027f4395f59763d38afb577b88ac450f530a89e9cc44869b
MD5 834975a3d8407c5e712fc93dbef995f7
SHA1 f1880a80ea38fa2339f6ac3a4a4c50deffb75b3c
SHA512 e08bd7f0d2a291851cbca3af22bfc5a0d8534c900de33cf30a601268144f2c855a6d4d5b224a7a0051f7620be4396c0e4d4e97936b281f69d88f5b2283cf14d6
TLSH
T14DA00210094DD022F8008674D56796403390491D5A556347449090BD8CD1146664516D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5973fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5973fd.TMP
Size 48B
SHA256 db664916d34eb54135240a29ce8497d8acd7a2ff5696341a2a3b2a28b8c1d404
MD5 0e693377fc91b7bea180ccf21508283a
SHA1 34c6435065c4e176d4f901cfde363f4c85b183c5
SHA512 b9e2754cf6e2a3bcd047c638491d10995494c82dde810ba243f845929593e271c9b1238a2425ef81a49a67c8d8e016bab5a7e06457f57aa1d7e2bd8f1cdbf1bb
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 37965d28c908393f7e001088f8b8cb124b7e524544db7ce99254e8e56ebbc182
MD5 229612192443a5dd7b32c5f67db3a5e1
SHA1 7a6fefba2b3509e30fd02eb6e24122cf1252bf05
SHA512 bc997c31cd3218d9808895b4b2a1a0aabc2e29aef1bea86c94c755663b86b59895439d9b10908f34b8b4d17604c821c1f8c0eb3634420a834369bf2e0b828936
SSDEEP 96:K0UwKZ+6mZ6KawN8AKNeGq28KfKkFiKOoyS8YKBWmLCKI4C2VSKGIRggK9myqcQb:yjNB/XORbkJNlzjk517HNRZhLrBF
TLSH
T18EB2F11571BB0600383E2D0C81B4976E9A4271A33168EA7B7FBC14A5DE6BE095DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 621d3e0da82856de2ae087fbd8cd9b9f169497e3a5a3c9824dde2c90998547ab
MD5 12f694713c0a8e45afda27f56a88ec55
SHA1 e6e05efe204affe53bf222b4968e28de58e92cd7
SHA512 caef57e7448c19552efe883f98dc22b89b5d6842be5b34992df8d006abd5842aab636207dd3cdfa13eb8ab47d44855d01ec50a9517098d084cf77ee52cbcea87
SSDEEP 384:nkiFiZcII3sN58TUNTUlI4kAjh+YPmthfP/WRc6zIlr4Td1XZusa+VYwd7UVgL/V:/FQI3CwgOFA/cXZ/ZuhgXGg
TLSH
T189C24A32DC68DDBBADEA4FD5AB4A7643DEF0416385DCAAC4D6D81D1D009A1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8c1adac0b79406d880e6af29f6ee03d4178b6fa5b051ffb4b5583f30559c8849
MD5 67e08a3378ab720c806c351e7e3b97f5
SHA1 9eddbdbbccde29edbbe48c5f3657792f10f69d51
SHA512 c4b414146f39789f97f997bd648702798c4a6146bd480ecfadf4fd7161ef6317c31aa81f0c3bd196983762288a5bf6e95aac0b327aa6f8e73652df4fe05709c4
SSDEEP 384:nJiFiZcI63sNG8TUNTUlImkrjh+msAthfP/WRc6zIlr4TdlT7O6R2FeoAgL/7Izs:gFQ63Fwg58i/cXZHT7TRN0
TLSH
T1F4C24A32EC58DABBEDEA4F9AAB4E7A47DEF00163859C9AC4D9D81D1D008759D0307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5abcabafc44fdd4eaa5d5536abf765943ebc9dc42e39735264457a20e42bbfe8
MD5 9b414705bfa35b07858cce44efc0957f
SHA1 44612f29d47dd254adfa026a7843a32bc2b99046
SHA512 f1b5535a6ba1abe4d835a56e16c20fa17b7b7cebe5c11992507e9c78f2ad7aca698cfbe75f72fd78637d44625ba6a79f829c10add7a4cd538e2664e24ca6abbd
SSDEEP 384:n5iFiZcII3sN58TUNTUlI4k5fjh+rPmthfP/WRc6zIlr4Td1Xtu7O6R2FeoAgL/0:QFQI3Cwgtr6A/cXZ/tu7TRa0
TLSH
T139C24B32DC68D9BBBDEA9A99A74A3647EEF04163C68C9AC4D5D81D1D009B4ED030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 62bd017122b025219f28d5b78190f39764e8023500e52852ee2ec89c5e28e36d
MD5 c1c102662c784b7fec053c11dab799bf
SHA1 19dc3056ae4f0ac9e5d6cee0792917eb12458b1e
SHA512 5b7a24c23af6206f06cca3b3b129c3036eb17359c799073b7d7be88ed539faa1a64195aea6b82d05c5e034f9d31fafe582053d996d32a874f00af75f15b78a26
SSDEEP 384:nQiFiZcIte3sN58TUNTUlI4kAjh+YTmthfP/WRc6zIlr4Td1XoHusa+VYwd7UVgh:rFQ03CwgOdA/cXZ/oHuhgXGg
TLSH
T1ACE2B1F198D789B6E8DE4B97A73E2D0299FCC153B5885A84B7D81D0CCC860BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ffc02d2dfdc3d459ce9e8948db964ed2f90c823b18ca12b9a6b9d62fad417123
MD5 ef8da7deeef4b141009c275b07a16d57
SHA1 f2aba1c5412a20c82531725785fb2e5bb831a654
SHA512 6b6667676fa10f2c4ae365bad73985c86ad128246959574c740580b7d9ac9a4b6cfaffaa3f8f7f4e636f642f73451dc1736620a15b968db242b7dc3bf987c3b4
TLSH
T19741265CBAE91158B3B76F5AABF6A86D847ABD731E0AD59E10010E4F0622B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5328-182-0x000001D18B4E0000-0x000001D18C4E0000-memory.dmp

Download