hxxp://youknowwhoiam[.]cc

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youknowwhoiam.cc
Sample260706-krss3acy4w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3340	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278015159122551"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{8665A103-3EF5-41D3-9FCB-4FC304238BA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5644	msedge.exe
5644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2560	4548	msedge.exe	81
PID 4548 wrote to memory of 1184	4548	msedge.exe	82
PID 4548 wrote to memory of 3340	4548	msedge.exe	83
PID 4548 wrote to memory of 1184	4548	msedge.exe	82
PID 4548 wrote to memory of 1184	4548	msedge.exe	82
PID 4548 wrote to memory of 2264	4548	msedge.exe	84
PID 4548 wrote to memory of 2264	4548	msedge.exe	84
PID 4548 wrote to memory of 4996	4548	msedge.exe	86
PID 4548 wrote to memory of 4996	4548	msedge.exe	86
PID 4548 wrote to memory of 4996	4548	msedge.exe	86
PID 4548 wrote to memory of 3036	4548	msedge.exe	87
PID 4548 wrote to memory of 3036	4548	msedge.exe	87
PID 4548 wrote to memory of 3036	4548	msedge.exe	87
PID 4548 wrote to memory of 2828	4548	msedge.exe	89
PID 4548 wrote to memory of 4796	4548	msedge.exe	90
PID 4548 wrote to memory of 2828	4548	msedge.exe	89
PID 4548 wrote to memory of 2828	4548	msedge.exe	89
PID 4548 wrote to memory of 2204	4548	msedge.exe	91
PID 4548 wrote to memory of 4796	4548	msedge.exe	90
PID 4548 wrote to memory of 4796	4548	msedge.exe	90
PID 4548 wrote to memory of 2224	4548	msedge.exe	92
PID 4548 wrote to memory of 2204	4548	msedge.exe	91
PID 4548 wrote to memory of 2204	4548	msedge.exe	91
PID 4548 wrote to memory of 2224	4548	msedge.exe	92
PID 4548 wrote to memory of 2224	4548	msedge.exe	92
PID 4548 wrote to memory of 1204	4548	msedge.exe	93
PID 4548 wrote to memory of 1204	4548	msedge.exe	93
PID 4548 wrote to memory of 1204	4548	msedge.exe	93
PID 4548 wrote to memory of 2896	4548	msedge.exe	95
PID 4548 wrote to memory of 2896	4548	msedge.exe	95
PID 4548 wrote to memory of 2896	4548	msedge.exe	95
PID 4548 wrote to memory of 2096	4548	msedge.exe	96
PID 4548 wrote to memory of 2500	4548	msedge.exe	97
PID 4548 wrote to memory of 2096	4548	msedge.exe	96
PID 4548 wrote to memory of 2500	4548	msedge.exe	97
PID 4548 wrote to memory of 1348	4548	msedge.exe	99
PID 4548 wrote to memory of 1460	4548	msedge.exe	100
PID 1460 wrote to memory of 4436	1460	msedge.exe	101
PID 4548 wrote to memory of 788	4548	msedge.exe	102
PID 4548 wrote to memory of 788	4548	msedge.exe	102
PID 4548 wrote to memory of 788	4548	msedge.exe	102
PID 4548 wrote to memory of 472	4548	msedge.exe	106
PID 4548 wrote to memory of 472	4548	msedge.exe	106
PID 4548 wrote to memory of 3876	4548	msedge.exe	107
PID 4548 wrote to memory of 3876	4548	msedge.exe	107
PID 4548 wrote to memory of 3876	4548	msedge.exe	107
PID 4548 wrote to memory of 1456	4548	msedge.exe	108
PID 4548 wrote to memory of 4848	4548	msedge.exe	109
PID 4548 wrote to memory of 1816	4548	msedge.exe	110
PID 4548 wrote to memory of 700	4548	msedge.exe	111
PID 4548 wrote to memory of 700	4548	msedge.exe	111
PID 4548 wrote to memory of 700	4548	msedge.exe	111
PID 4548 wrote to memory of 5064	4548	msedge.exe	112
PID 4548 wrote to memory of 5064	4548	msedge.exe	112
PID 4548 wrote to memory of 5064	4548	msedge.exe	112
PID 4548 wrote to memory of 1264	4548	msedge.exe	114
PID 4548 wrote to memory of 1264	4548	msedge.exe	114
PID 4548 wrote to memory of 4856	4548	msedge.exe	116
PID 4548 wrote to memory of 4856	4548	msedge.exe	116
PID 4548 wrote to memory of 4856	4548	msedge.exe	116
PID 4548 wrote to memory of 6096	4548	msedge.exe	121
PID 4548 wrote to memory of 6096	4548	msedge.exe	121
PID 4548 wrote to memory of 5644	4548	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youknowwhoiam.cc
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7fff6847c188,0x7fff6847c194,0x7fff6847c1a0
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,18007942048268674877,3501546049621738053,262144 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,15421999346765513945,12445980811913344750,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,14267193870239100907,3373561109773809759,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14763758149569231042,7266281888758901755,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15066522237687239807,5584500184378235474,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,7041771360277087029,14230970493053153299,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,2151486339493083419,8521700132574392244,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,15708857004915954208,7433306265481950750,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4292,i,9994022449948336156,429701339712538241,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5208,i,7754710345990147798,13986039164644398119,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3544,i,4573964730396071179,8397009652047068002,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,18401538366366572500,6673825360254322431,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16264801330455139832,2585397870837031944,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16652024001963199090,14056757425194545704,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16652024001963199090,14056757425194545704,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,13061050744508291921,423048280003052363,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6548,i,18352563201408866552,1140032282918533393,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,11689293121417870671,18042701111100403906,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6720,i,11649529466084125623,4688420832603422460,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,14894936170881627724,2917943657740219251,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,3885017416176310507,10815755086224550260,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,5650468062508618180,4422322808246393507,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4264,i,9470982236361273501,14753811919359639094,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3944,i,17103873964040561613,4903984138454529997,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,4830297491206711247,5869243516629415650,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:12
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7080,i,5858843178100787335,13452168086426757528,2097152 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,12546302965429518737,13365798686593710003,524288 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7476,i,9933915318917430341,12062879720057545891,262144 --field-trial-handle=2172,i,14872293291528523216,16084367822305792603,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee579a8518f1d969aefe0c52525bd80bd3dc22ea457de57fc871e975068ae464
MD5 828b312d5057d721548e321acfcdc108
SHA1 c2fcec8c71723a7ec5af83461b0c2a6eec1908c1
SHA512 00c6abfbd80512b9f8f60c0e856709169b0dd8642ee06b36d186b291c84637ffa427092aaf566fb628a40a24021ffbedec834fd5d7e6c5c2cbe2445bf3fbca1f
TLSH
T138D023207B3E7CD1D6342139543187027D641053275A5247A2408C0D9CB50C597C25F1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 202KB
SHA256 1e6cfb929555b4da24116a8558c58c64cfbcf76a7da759d283580c57c73467ee
MD5 b349310e5564fd6909dde93cf2b00e59
SHA1 00264f9cbf51f507ba354ca01490c8f4624b3b6a
SHA512 d1451549f26d326c9b8244a74f787196bf7eb8cefbdf51694dd51ca5241daffbfbbdcfe524b099c64a630430100080ec63eb260691d4618dd799e40c79b52e1e
SSDEEP 3072:hNwNcNcgnyCyyneg4+aa7P46i79YBvMxnXAJ/RSCJjN8xDggYgBuenKxTw7e:/FNcFn+z4diRFjNCbuenb7e
TLSH
T1A014026B0FC23858C486EAF3103DF2AA7D06CF59AB3549DB7682399E93317C25B1550B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 11a572a8a3eeeadbe3e2faf73da1b5a027800b0f2ed6bb6d7aa229729b6ec004
MD5 0c81f63e243c72761a560a820713fa36
SHA1 dab3a1ef28c5b725d2085784336d26e003a52d70
SHA512 1006497b02cd98dd6c7c858b016b969818af3d155ebde2b61fc39e22dd3ea51fe80691417f905c4b6e047ec788b2e2bf495a5b2694b727404d284ef236031b13
TLSH
T160613C3059E2C997D7274E3EC2C1750D377306AA0E330E021088ABB1AF32772D6756C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5730d2d8869823c7e87b3ac62753493c8243b7af3558f7e0e7f90feb067cbb1d
MD5 98a77000d1247efd2aa034830b94f137
SHA1 8e41daabbaa886ae56fe02caf4b8ccbc5e3b8d25
SHA512 abedf488621faabdc3664a2a45c3eebaa0b002c55e5d36ea16f8ea741e8823be842ccd68252d6bfa70fde489d268a862b9263045895cea80d90c86a63709a365
SSDEEP 96:9Qycvv5OZk6Y2b6vJMd0xMGh4IzNLo/BuJL:9G5OZTbOmyb4I5Lo/sF
TLSH
T1ADA15DB476E28883D73A0EB991D07908337207550EA7CE461284EB74AF327F2C6BD5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58534b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58534b.TMP
Size 3KB
SHA256 b5ff219df62df01d1df9a91c1b9cd4088ab4f0104343a678ac283ee8794774ac
MD5 8d8d2e4e10979be005142e766e018389
SHA1 f2ef4a06578967b1c375bbd783477eadd82ef744
SHA512 71f3325376c8b6d0bfbf362804d7596fd0e94babd188e8a70490ab66e21778ed0803c2e9d59db48bf101bc4e20dd9660d9d136c5a28bc72bb17da4f1ef5d9257
TLSH
T110612B3059E2C997D7274E3EC2C1750C37730AAA0D330E021088ABB1AF32772D6756C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 32bd72071d7229322d33b6dcab9b28d731ba2a10df403da94434b91ab3b622bc
MD5 1c15021ab223b84b04bfa212681efd3e
SHA1 b24b0826d5304d43279bbcc9eb1e3a98a04568f0
SHA512 d01e8d666a4b75f56439bffa5b1641e57095ade73166778b713077d2875cdb7eeb4551131c39840bd0426a250abd6649a87459b9fcebab45be4f61141b0b1a4e
TLSH
T193517BF3C3D586AEC92156F0EA287E1BDE1D095983283C1AC5E4EF5B93E3070E151A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8178f4f550840e273926d6d64c65cb778b68a2a276ffc8c7d02503f0d3d599f3
MD5 fc836369fd924026a146b79ab054a1e7
SHA1 c80f240b2af04135705d654ce2b2e07298a9a588
SHA512 b88a21b3fdfe20ed789c4cf2b57e09112c4c097c1bcbfb18a1c81cd35ec39126395347641ca667716e461f1de8388dc0dbd8558b3d8d89c8ae71b31da5722ff9
SSDEEP 192:sxZ5PRMyM/jK1Ml8MFt/fvXspurPQ4Idpdov/nQ6+WNGY0aQaYSqIgrJ:sxZ5POdt/ffsppJdq/JG5VJ9
TLSH
T1C452F916AA34597BCCDBD209FA55BB53D6F51463A2900D44AAFCCA0C01E7BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 cbdcffb73d7412ee513e8726ccc2f38e4ed9df37265a275ad58f5ee7192bf2a8
MD5 7ab0c50d1bb86d2c3fb8f0cb3305479a
SHA1 37642aa61a89a5781ff047e4e291d22e5f2d270e
SHA512 8543c39e272a6acddaf34d994c564bb6b41a39b7c39f3b553f1661bcb9de26f132e390756050821a11dd9c8329eca526f93aa0e475ef7c7d2260e09d7343ef32
SSDEEP 384:sxZ5P2um1t/ffse95RpY/JpHWPV5VYHDF:sNrm1t/fN9i/JpHg5VyDF
TLSH
T1D582E956A5304977CCDBD619B965BF52D6F91463A6810E486EFCCE0C01EBBED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 afe70e7e7ead9e053e2f37bb8aed19227c255ecc4caabbd7dea00ab7a3312592
MD5 cf99549fb7d1bebb94924990a2114d9c
SHA1 1aa322309817c21a819863dd2cabe9dbe72fbcd1
SHA512 dd1d45b5cc12b52d81c32531280abcec2b28ffd3199151fefdf7385788b6a1c87320d360f00103808d0b4bf11974fa84528b80f79384b06e79d8a31326f79092
SSDEEP 192:sxZ5PRMyM/jK1Ml8M5cB1t/fvXseurDQedp89oSV9/nQ6+WNiu6/Y0aQrMSqIg51:sxZ5P2Bm1t/ffse9umZ/JK/5VyFDF
TLSH
T13D72E952A6349977CCCBD619B965BF53D7F50463AA410E489AFCCA0C01EB7ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8ba99fdfd31e0bfc24c9a2c495a323dd57f0ece18aeeccf9b13761e549ed94e1
MD5 fc20e97bccf5aa8e7e5074b27319335f
SHA1 3b1c43f878157dc50e430d3819cfcf91875a7208
SHA512 1b9dccabaaafc834915aaa1ff6a69c46f37336d22fe1f391c7657e238419fd592b0361cb072c7655cea3b2feef05ab8923e4f00ae6bf95238459e22dd5ca323d
SSDEEP 384:sxZ5P2Cm1t/ffse9jPpY/JpHWbB5VbHDF:sNhm1t/fN9e/JpHI5VDDF
TLSH
T13572E952A5308977CCDBD219B965BF53D6F91463A6910D48AEFCCE0C01EB6ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 24fef580ec90432597e063518278ffed55fa2c85a3090b9d5f036a8f4d197fc2
MD5 e6fc605089245d46272081b595c6aa4c
SHA1 16995b60861822db57e150b8e9feffb21d802c61
SHA512 1c7a390c041c95e45b685b5ac5b5bb9adef54f460b4dd0e1acda76aad8344bd7c8ad4edb98b21fab562a79dbd34a534bf24d1f7679d6bf8145f0767d477f246e
SSDEEP 384:sxZ5P29m1t/ffse9jPpY/JpHWUd5VLHDF:sNwm1t/fN9e/JpHT5VTDF
TLSH
T19872D852A5309977CCDBD21DB965BF52D6F514639A910E486EFCCE0C01EBAED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7e2d74069d04aaefec42a85fbba2abb4fd3d05da263eb074b6b1728f750433c8
MD5 622c356658e6796f49a937faa2daaca6
SHA1 8e16e2be1612e915142b2a32bd44f6b78d38310d
SHA512 ccbc823786947c79cef3a51fa07f1e1ead9574c7f7b7dcf277e45440823ade40541c28746d05e9bc1218917e74fc9d441a300ca92c90dd8155631eb388885ed7
SSDEEP 192:sxZ5PRMyM/jK1Ml8M8cB1t/fvXseurDQCfdpwe9oSV0/nQ6+WNiu6LvM1Y0aQJwy:sxZ5P2Em1t/ffse9OPA/JKQ15VJdFDF
TLSH
T1E372FA52A6349977CCDBD219B965BF53D6F504639A410E486EFCCA0C01EB6ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 c503e2804aee91e9943b62db7d8582c97fce9e808d786ddb9f57734ffe87a01a
MD5 1183bbcd8e8559201649c44bbed7c6d3
SHA1 c5edd2aaa54153e2441b4d9374cc649813794ed2
SHA512 304d753b3527c0ac9d637f7f887d801f3f498aa89bee12853f0839a787377e1ee702d74084735a67a2058d538eb6bddb18613249bc2106bc5ba2a51e22adafee
SSDEEP 768:GJ/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VZhroYJ:GJ/zh8dF2PkWRmEcQXwu1jaKWjLp2tVT
TLSH
T15EE20A3F280CC77E4F844E9DEC2A6F966EE801CB66684D5447FA894C03C77DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 81b50c2ee1013fb75b6af6884b3d8ead0cd6f2d3957ae0360bb7c23c04a9abd8
MD5 81e311ca5cbb3cc9f6aa33e1d788221c
SHA1 de13389f61bc337504cce0cd5d7a8dd82ea49252
SHA512 3640d88f84be7f1cf8deb95b8611fb08b55659956305d07837bfc2218845e4f4c29cf67eac3d0c95e2005d7a2cf2d268680b138bdd293751eae66296304b231b
TLSH
T17EA00295A2790101C48106B09486C5EA3671795105114F16A1E20088DE94380B3294C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8860b9617ec5eee53fb5e182fbffa8339811b77e4cdf277834c459345fd92673
MD5 8a2dbd94080e6b591e3ee675d631867e
SHA1 355299602f521d8a01023b420126395e64f33dae
SHA512 e6ad07d3d45b8a1481ec714a5c72e740f0d7e2f9ca4a5753d2d7413b9607d6321d171b6ece99cc2b49f8305f3e4466a5b13360c1b6009d4db49b94dd085c0c2e
SSDEEP 96:KEWgKvjucK/6SONmKmgiCGkKvKFUOUjUyUuUIUx:2kPVxnEUOUjUyUuUIUx
TLSH
T17FB1474231BA46113D7E390CA3A4CF17468273673055E92F7BA950B24E6BE206DFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 35a3f84aabe18fdb2dde70bc15b0916338ab0a91ee605cd6becd6b6dfa014731
MD5 6dddad70324eab633640c554662b4fa5
SHA1 26aa472878e7fb01686fe462e1411a4556abf10f
SHA512 d170414a6ac747cfb6d9d0735964e363184d4305c8caf081964fb4ef87cc66def1617885f77d9907a0aa6a13aa3aa6becb0e492d38595b7e9b413d262a3b4266
SSDEEP 384:0tNn/s3n9S78N0DEtuCx1AnscOjKyi3OObjI9G6w7F:0j+9MAtPoscOOr329MF
TLSH
T153928D36AC285E764DE39159F4463B0B8FF850BBE6852F84D4DC6F0D02DFAAC5312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9bfb3074e31883f33f0f2feb018c4c0e5b29fb20a2f69b7c2a42d50ae108a96d
MD5 8615f5be3bf59dbb1231336ecd79fea5
SHA1 aa0d555c05b5a40661f1a9d3f5591155af374922
SHA512 64570f8c96ee020828d3ed0763d78d8e7b1972534ba67fb94602fcabbaefd85683e08418b89aabcb28a5c90c0f75e02ec43ad507dc5b65088cb4e9d0d123cdca
SSDEEP 384:dEtNn/s3n9S08NZzEtu2xuxynscOjKyw3OObjI9G6w7F:dEj+9JVtCxGscOOn329MF
TLSH
T1AD928E36AC285E770DD39149F5863B0B8FF850ABE7852F84D4DC6F0D02DBA9C5316926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 43b78870c74d7d1bdaee6d5b75ba89c476abb93751e66c7dd90c8bdf2544f772
MD5 80290f9128b9fdc6b96422b0481e0b7e
SHA1 1dc54a486e7ab43ec0989b419ab75be0a785bc89
SHA512 433fbf5c9fc21718f5ebd61ed3cc2670a025fded5ac49a08f80148fc50289a14bfd221e4c6f8f7f5babd9c7be8c13ffe3f3c225110501cc858e310fa9fd26ad3
SSDEEP 384:7tNn/s3n9S78N0HEtuZx4AnscOjKyr3OObjI9G6w7F:7j+9MktRoscOOe329MF
TLSH
T149928D366C285E764DE39189F4463B1B8FF850BBE6852F84D4DC6F0D02DFA9C5312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 69e4ab5c5c425989cbb6e79e43ae23c7b3c3bdca7eca0a07b4bca40f9284ed12
MD5 aced2a5f4bf750cbababe1e442b2ab99
SHA1 bba5af0448c90aaefc54f29c6829e385122259a6
SHA512 cdfb8ce0c1ea4ff3f14a6100946414f3b06a72bd229158ce0132383f52bb023da9bcb4326e69fafc6cc5becf24655925be607581fe6c1bd1f6fbe75554ca1f91
SSDEEP 384:7tNn/s3n9S78N00EtuExFx2nscOjKyr3OObjI9G6w7F:7j+9MJtTxKscOOe329MF
TLSH
T1E3928D36AC285E764DD39189F4863B1B8FF850BBE7852F84D4DC6F0D02DBA9C5312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33957e97cd92cdbe887a354181603c206c93584b61822de56e18a4ce608102f1
MD5 7823ac9b9a76c0cdcd40a7a5b189a42c
SHA1 04952b0b2a52653df7997cf316df84e4c0bd9374
SHA512 f42e496c681dd1811a085ccb09da4a5063dfbdd1c84fd478bde74901bae2b5f9e5132570c8540c3f66730197e53f02169b6ddcc5e635458a173e5425f8a9b4eb
SSDEEP 192:BGN96P2UOcQmiUymIUFqGv0cOjTwS1CU6:BGN96eXs1IyqGscOjj8U6
TLSH
T18D02FA796D782CB78FE3AD45B98637134FD8106BE9952B80C9D41F0C00DB64C3307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 377ad73f50e88611093c87cd88e54399495e575975652633948469e69c621eae
MD5 3f622617f22880e82b0084cf43e1b8ef
SHA1 4867bc6817f2a4506e09d3873c44b8145d20d9d1
SHA512 621feac84b97b3f019651e6bc6f0af135c4dea0adf111560122db72b173f4c02544dc87ba5d0e4d120420fda60fa37042fc930914c8edd7250ac877505f3343c
SSDEEP 384:FEtNn/s3n9SLb8NZiEtuyxjxbnscOjKyG3OObjI9G6w7F:FEj+9yetTxLscOOl329MF
TLSH
T1D4C238F558E70932C89E8347B77E3E074EBCC06BB6452A44B7C85A0DCD9A5BFD202912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0439bd1b16192886beebda94b4ab4873bf2b772f483e44c706defbe8955e1dc5
MD5 9f77917cdb5761740a0448df17a84aac
SHA1 a0ceb88656ec4448d2495365b34fb54f683d9a38
SHA512 1238ef423053e4b4fe735df1f5fe9731449744487bd5e37516155140dbe5caf40706d32202a8743d66b9671d3ee4d5e60686b450cf23e48b0eebfcc62b02d28d
SSDEEP 384:7tNn/s3n9Sf8N02EtulxBxinscOjKyr3OObjI9G6w7F:7j+9UHtwx2scOOe329MF
TLSH
T1AF928D366C285E770DD39149F4463B0B8FF850ABE6852F84D4DC6F0D02DBA9C5312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1c19e0b4645961ab121a4139f19c56f1fe717694215423f34871bf5c49ec76ea
MD5 70383c9fecc18f7a6c5239dced841876
SHA1 ab1955551a27ab2536973002a8039c68d9128c75
SHA512 4b3f6cd8d190cf290343fabaa15004c2a5f32c9dfea45f8d9c268dd8fe0bfb528b02e8de6a80c3c670d9b907e5f6a48431b8ed8ac45f99762bfe24f1f15a9e8e
SSDEEP 384:dEtNn/s3n9S08N0zEtuvExfxynscOjKyb3OObjI9G6w7F:dEj+9RwtNxGscOOm329MF
TLSH
T19C928D36AC285E770DD39159F58A3B0B8FF850ABE7852F84D4DC6F0D02DBA9C5312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9176fefcd5466af6275c56fc0baf44ca04888632984d527a93e6709cd212a027
MD5 6090b009d81f8087d39c87d8286ff984
SHA1 e498c2596c0ae5088da370d2b59027574b56b963
SHA512 b3f55d1bbac4b33a37065f2a602372d5a38b22c896f8bdfa0ba7aa11b1698867fbe28f7809c8f00a019ef05ff42a954789f51ca606910e48f8a34cffdf9519a2
SSDEEP 192:iGN96P2U2QmiUyR6EFgGv0cOjK8NV0Bqq/U6:iGN96edNigGscOjKyq3U6
TLSH
T195122B76AC686C775EE3A545F48637078FE95067EF8A3B80D4DC2E0C01EF99C2346926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a8ba8844ae47973aa1343070bad048d67b89e6d7ced49b5212d68d0147cdb18b
MD5 cd6ab72ce21c73d7cb8bfe26853c054d
SHA1 4e2479cca2b756f30b152ac723f839b6c68e6feb
SHA512 96b9bc41ef51f62fabd8c6690c8fbe32a19577363c19d59c0b04c62cff57a0ea6cf014fd5c72ba88d43916c48bccb316bc6ffa673ff67cc120358f8bfd52691b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 260a7044bfa57ff8c4c299a85ba9cf658121326bc867e7e53ae7e885329f8b54
MD5 91ca02c05ae95bfa92cf3913aeeb535a
SHA1 28736805e3a90c8f1e64dd8c821967dca6a768bf
SHA512 bdd42d9b0f7e410fe3c4ca59604addf7c4e3ca9d3a7d027675c56617a871e52edb5945736768f94edee90e762b390fcc9fa69149bdd55b8a225d1b74a96b064e
MD5 SHA1 SHA512

Submit Download

f9f8ae43-fd3d-4133-95bb-375904703d41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f9f8ae43-fd3d-4133-95bb-375904703d41.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download