hxxp://youreanidiot[.]cc

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youreanidiot.cc
Sample260819-fezzdsdp8v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315884803544931"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{B8688EC6-9C0A-4688-B2F9-9DF4F45CC227}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	msedge.exe
952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4944	952	msedge.exe	85
PID 952 wrote to memory of 3832	952	msedge.exe	87
PID 952 wrote to memory of 4644	952	msedge.exe	88
PID 952 wrote to memory of 4644	952	msedge.exe	88
PID 952 wrote to memory of 4644	952	msedge.exe	88
PID 952 wrote to memory of 4916	952	msedge.exe	89
PID 952 wrote to memory of 4916	952	msedge.exe	89
PID 952 wrote to memory of 592	952	msedge.exe	90
PID 952 wrote to memory of 592	952	msedge.exe	90
PID 952 wrote to memory of 592	952	msedge.exe	90
PID 952 wrote to memory of 3816	952	msedge.exe	91
PID 952 wrote to memory of 3816	952	msedge.exe	91
PID 952 wrote to memory of 3816	952	msedge.exe	91
PID 952 wrote to memory of 4108	952	msedge.exe	92
PID 952 wrote to memory of 4108	952	msedge.exe	92
PID 952 wrote to memory of 4108	952	msedge.exe	92
PID 952 wrote to memory of 1396	952	msedge.exe	93
PID 952 wrote to memory of 1396	952	msedge.exe	93
PID 952 wrote to memory of 1396	952	msedge.exe	93
PID 952 wrote to memory of 3248	952	msedge.exe	97
PID 952 wrote to memory of 3248	952	msedge.exe	97
PID 952 wrote to memory of 3248	952	msedge.exe	97
PID 952 wrote to memory of 3396	952	msedge.exe	99
PID 952 wrote to memory of 3396	952	msedge.exe	99
PID 952 wrote to memory of 3396	952	msedge.exe	99
PID 952 wrote to memory of 1108	952	msedge.exe	100
PID 952 wrote to memory of 3392	952	msedge.exe	101
PID 952 wrote to memory of 1108	952	msedge.exe	100
PID 952 wrote to memory of 3392	952	msedge.exe	101
PID 952 wrote to memory of 1292	952	msedge.exe	103
PID 952 wrote to memory of 1576	952	msedge.exe	104
PID 952 wrote to memory of 1576	952	msedge.exe	104
PID 952 wrote to memory of 1576	952	msedge.exe	104
PID 952 wrote to memory of 2336	952	msedge.exe	107
PID 952 wrote to memory of 2336	952	msedge.exe	107
PID 952 wrote to memory of 4108	952	msedge.exe	110
PID 952 wrote to memory of 4108	952	msedge.exe	110
PID 952 wrote to memory of 4108	952	msedge.exe	110
PID 952 wrote to memory of 3820	952	msedge.exe	112
PID 952 wrote to memory of 3820	952	msedge.exe	112
PID 952 wrote to memory of 1292	952	msedge.exe	115
PID 952 wrote to memory of 1292	952	msedge.exe	115
PID 952 wrote to memory of 1292	952	msedge.exe	115
PID 952 wrote to memory of 1840	952	msedge.exe	116
PID 952 wrote to memory of 1840	952	msedge.exe	116
PID 952 wrote to memory of 1840	952	msedge.exe	116
PID 952 wrote to memory of 1684	952	msedge.exe	117
PID 952 wrote to memory of 1684	952	msedge.exe	117
PID 952 wrote to memory of 1684	952	msedge.exe	117
PID 952 wrote to memory of 5584	952	msedge.exe	119
PID 952 wrote to memory of 5592	952	msedge.exe	120
PID 952 wrote to memory of 5600	952	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youreanidiot.cc
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x18c,0x248,0x7fffd007c188,0x7fffd007c194,0x7fffd007c1a0
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,532965774716605491,8726144956320911599,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,18382566525910636515,15241281600931190696,262144 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,1188383177993390185,2665588435181120890,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,8423976547962869935,13856955854941815865,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,7687700054289959460,15628498274432186583,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,18387733304361279674,7381810323924364127,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,5882415777112572060,6886243625864317181,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,18370840997683231752,17420734028531055247,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3480,i,14279750888697560995,8839344193993867957,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,18103515870758308304,9797627356723446452,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,1354201349494168393,17541001525327151336,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9335267092127959026,9273277471056572505,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9335267092127959026,9273277471056572505,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6368,i,18069655253356369494,3029471270495322246,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,5001652030668779050,10740902876630932233,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5260,i,11978790461814067916,16814005064697834320,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,9304584941298261962,6956822974967626419,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4412,i,12908293670257997253,14722918171002451827,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4408,i,11868195783328106372,8228967350611268412,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7020,i,2341191884355040616,3225487596546875367,2097152 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,15368228071621469801,6448174238207881296,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,835503504077947172,498559212153918735,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,5651173693628552346,17503637759530306043,524288 --field-trial-handle=2380,i,1207464192295503835,5901699057594896959,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
  2⤵
  PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 21fa0e7eebd3f2d414c3e03021fd54ac1843b29dc2c7d2f3d977e11d55688685
MD5 f59e21985be5925f33a4ad8bb648a029
SHA1 6f48209a984ba168df0672bb6a232d440a75d363
SHA512 8148d94a0dbb83a39d3898ee69af7a851604354371f1f5ade11248cd247460358286a8f4d97b65eb2b6e3d0db64d20e4f2131fa0b33e7ab6e0c6fdd052bd0d15
TLSH
T132D0A7A471567515E71F00355811B251A366843275BAC342E0655C0EA77841883EA2E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 62KB
SHA256 e96962c7df63a9fbe00dddda6e5360d639e7b25498fef7400fe0333fa5311294
MD5 5bbcb2d4f3b68ad1969574166cbf7210
SHA1 c1659c4e5b88de42858857ebffd3accaa360b02e
SHA512 71f65503cd3f12f908644cc2fecc7b5e833724c93107962935a74eef4d8eab2806200cf291d366c646f5d0f881e27f9252b7c1a39050eaf4388c7ec474ddca74
SSDEEP 768:GlmILj20bh/Jhu51KNCCcwgjjp1X3xRTFo8OmY1gqNjbBSxY45QY6FP5vv2Mvc/r:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FY
TLSH
T1B553020A009EC47EE703DDA03087145E5FA508BAEFF5E3B9B012597B82667DAD75806E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 36ff1f0731a0781c7d01c7364a8eab1a30d3f890b94343e980582a3289864a8a
MD5 8c75fe1e034b9ae163f6ccd59c603a85
SHA1 7f425618a2ccfc142da23ed36231b20c483aae50
SHA512 78006078703c3338a287d1619e649e10401d0498a0ace356f3ab00cbdd9808d56dcc7462f180822c1f62da91879b74bdef9a139520fd0d288487bbb6dd7ff175
SSDEEP 96:Rc7e9WHYq66LEZOkB/zKZbyX3Y9FPyXKNH7+P:WC9WHtLWOSbKdy4u6H78
TLSH
T161C11A2C144AC476EBBC5639D0D748C976B0C8420F9B0E9B52F06D3F268EF968FE4068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5919b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5919b8.TMP
Size 3KB
SHA256 60c186640d2de1ee4cc01a51b159c7f82e3b25143daf6f9cba5371219db78a5c
MD5 a694b2a081aa39ca067d1922d0441b76
SHA1 71dda8cc12aea5b7e90bf0455f9ce03adc8644be
SHA512 8c681d13873e7c1deca0e9a536807d424e07e8518bc156c82102b0ffb878ba53e2a770068b3df3ee84f47b6e9a7017d4b70e4b33dac9f02993abc335dcac899a
TLSH
T19371F92D080E49A3E31D2732E0E3098EB274CD994FD74EA35038993C568EB56CFE546C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 d32fc1d9965a76a7a2e80a57d5a1923873179ed3e8a13a7a30e364a202a85888
MD5 334c338fcfa8eb15ce255c38850a44a9
SHA1 a98028b945544d3dd4e26f83375f54be364f8a17
SHA512 51f723f866ab94f8aa07aabaf9ad1dff18c9eb4b8ec4b6d622069b982a43f397ec95b77b801cda7400aa4122bef318e00a4b7a60b229b58be552ec940f4325bd
SSDEEP 3:MsEllllkEthXllkl2zE/lXY+tl:/M/xT02zh+tl
TLSH
T1134404147FC05407C54011304071C3D01371D4500753574334D34C375CC5FC00C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ac4795ad4a7aa5f06e2ed031640e0c5c4fd1e7450315f45cb6d4d82d1170c0fb
MD5 fb7c8ce8400c7d926d37d635a2a3ac31
SHA1 78d1d98e1c3897a16f0e9893212c316974f4b298
SHA512 112cd59b7b1b0c2cc41f279bc5715b21590f7da608ef7b2f5be50822183abad3693d4f1fac4eac4ca8bd1609e200ee10ab7f63891b85ac85ab39f1ee2569b663
SSDEEP 96:D9OcGr5Q87ShhA3z9XU4IqjBBhij0g7YZRvIEBqwBAj2a:DQcGr5Q8eh23xXU4Iqj3hij0g7YZRvID
TLSH
T152C1AFF7C7E4C62E891162F19A183E2BCE6D0919432C3D17C9E4EE5BA3E2471D141B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 a69483574f7b3c8b05b21c8a19e7f447673f2e56af22b5fff19be734a6c66a4a
MD5 7af56dda5b34b44dd04beff90e46d5fb
SHA1 5237a21e447f07cc89099dbaeca4f7de3a650096
SHA512 4fea5e096cd050f1d7a206f03a3f3b382ed99a42d80bd9c451fc05ece6015da6c8de9c7bc515be5754fe15cbec5493832b3730931c92922ed92b0a2e293f8630
TLSH
T127D02223670431FBA6ECBED1A0ABFC8FC73610380842DEE810E0A8DC16358AC4907194
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58a5a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58a5a1.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8f1bf0514b2f6c5d5dbb39d54f43923219f699a96bd5c63aeeb3c257d924c7bf
MD5 317ed4a66f73d9940f98d4898ac4ad51
SHA1 00cbd714fb7b0e0f8b124faac4d1835d434954a1
SHA512 fe3d0331b1c574d2b88ce60d02941bd13707bd3cff7a50a6b61a6151e2233602a2dce48d13b74f92a2b9845e21b0ef80416feac090e2ced68df222bd98167306
SSDEEP 192:sxZOR2yM/jK1Ml8Mkl/f1sNdgXIdpoIlH0f6+WNxVr+HO/YH+MnAI+6IgrJ:sxZOgMl/f1sNa4jHHbMO/tJIr9
TLSH
T16F52D716AA385977CCDBE30DF955BB53D6F85462A6900D84ADFCCA1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 cbcc346828e1c7e70c2b708e6effd6094e3fbd726af7bedc5f26653d6d96253e
MD5 adaa905533d3546f57dd73a683e1e640
SHA1 a73dc6ec7851ab7cc44e48c8dbcb3044f97cd680
SHA512 1ac7600bf8acdcc845d5e0069f09b2e7645bf1dad06154d0bea60d85122af542deac922c5af3ecaab43e94b24822a16d3f8a66d208f6c678a758a90d42997f87
SSDEEP 384:sxZOgMm1l/f1s7WvlqXhHHq1tMO/IxIhwD4nRhY8QH:sGfm1l/f+YlqxHHAIG3nRa
TLSH
T1AF92E752A5349977CCDAD619F971BF12D7F9146299900D88AEFCCE1C00EA7FD220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 eb3c6c7ef3b0e2eefed2a55c47200ed260fc0d076fb08db98ca55d5d17f87274
MD5 ad4cc02c4e385e2c0b42809367369aab
SHA1 eb131e4632154a36f9c862ca67c6e815dc2e208f
SHA512 20d758be79d8cd9104f47145da8d7f53ff5d69d10a84b9ed3aca71bfc0c92ebcbfd86e616778eef8d7fe0faba2480339214f9ad137ed1d011e7f2af239419549
SSDEEP 384:sxZOgsm1l/f1scavxHHRTMO/AIrsD4nRhY8QH:sGBm1l/fBa5HHB5pnRa
TLSH
T16172D852A634D977CCDBD609B971BF52D7F904639D910D88AEFCC91C00EA6FD220682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 5779cecf49ee2ea5e4ca159a2a7c2b31f3b2cc7ca232b001e1f391b6101e012f
MD5 c156bb5e10fd7c99649f7a8e90463303
SHA1 1c7d6b833db8cf1bb8d4d39983f23a9ca0113477
SHA512 08f3e9ff8ce82cf46fd7f82fb1e60107c180db13e8db32d17065e6fc51293ca47352e72b7e414b88b2914ea461ceb2d0d24cb52d0b295d6245873c4b2339f917
SSDEEP 384:sxZOgrm1l/f1scqXTHHq1tMO/uCIrwD4nRhY8QH:sGOm1l/fBqDHHAuP9nRa
TLSH
T1DC82E852A5349977CCDAD609B971BF12D7F914639D910D88AEFCCE1C00EA7FD220682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8c04a01d58591e303e8179ce5ee380c333e9bbf3b7e8d2d789acd874cd81e669
MD5 52be5ee0c798969151e429950ca4c1d0
SHA1 7721d40e04b7d5a3340b12cd42cffcd6c79e96e6
SHA512 fa232cffc7625ff24ad45992afbfa9bb3183f5c99d7cbc37ed24581f94d27024d9162c5be8fdb561284238102f816e2a4674bf4a63e734d923404f41c444cdc6
SSDEEP 384:sxZOg/m1l/f1scqefHHR8LMO/kIr+D4nRhY8QH:sGqm1l/fBq0HHql/nRa
TLSH
T16482D752A634D977CCDBD609B971BF12D7F904629D910D88AEFCCA1C04E66FD220682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9190cdfee4268137264b341be97d57cd3c08710e4ae10b8b54b7e463f3da5d4a
MD5 cca54461001d4939f00c1ce05154032c
SHA1 3340379703d97966b0f3a0b078d5087a37691b2f
SHA512 8794d882d30e4f7abd2ac96fd1345bed31610ad16d65182190617fa83b99567d05ce92108dfd16314d44a1c716e35e62faf1ad8bd6e66a0d38d0730360339dc3
SSDEEP 768:dgUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RCroVO60Ee:dgUZYTMWvg0Pou1ja7eLZmRZUpEe
TLSH
T1B5D20A2F280CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA884C03C76EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 501f822afc7f13b3e837bb6523e1aa6f31253ded1eff81f967cf2ec7643db982
MD5 a24ef8dd20f1c46584a5257c128bbcd7
SHA1 633fe15ff3cb30ed8557a05d3a11db773395f97d
SHA512 0f3e8b26238f991e282843799614d16ae9cabf3d92e92bd42411377e3f611098d6a535a70825225f5c28077d96403d92e2b71215038c85bce001c9bd1cd7228f
SSDEEP 96:KA1eK2AMaMKXqOCOkKHqUdOKmkS2LWKEg7VoJ1P9:EurfyVlh
TLSH
T163D1F10276BB02033D3D2918A39987764F85F6A33818A42B7FA840B15E67E345DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 282ed320e154b5b2a6b170bdbf7c8ef65a8375bc72712ee06d979fd93a53a5ef
MD5 8c0895c0eb1b3e463452e616f49f19cc
SHA1 74123e34948870238a33642d32dedf3054b84690
SHA512 f92f02e59a6572ac4af7910e094b4305d7745b563b6649f775534ed59539972997c032b3944dcf042bd9ace3d69a3acddeed596dd618a5b400e751d9be59b4b5
SSDEEP 384:wZcIhsN4UrfJH5izX5od+d8y0VuXRArAQiYNudBuB:Oh25WO7+RArANYNqBuB
TLSH
T1EF827D72A878AC675DE7F145F44B31138FB981A7DB843F8095EDA71D01EB6A8031AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 114172900d6f7a4f00caf781c4e5cec5668f287590d27b32a902441f38a8605a
MD5 54f93eea79c7e556b156f84e5ab262bf
SHA1 745590f4906288da17e69f9956a419e6d8548b7e
SHA512 43abe3f53c49794273c691e2e688f9f9345d689914aa625374730bd0f03c3e39d731c71aace85718bc7160d9b0faab93f7b7302eece41c2e8ac90a71ddb75666
SSDEEP 192:yONR61VWQmiUyDWgGX5Obd+j1jzory0aoX/ar831IU6:yONR6WbgGX5od+d8y0VCr2IU6
TLSH
T17C02D935A9686CBB8EE2BE4AB48737135FD91067EA552F84D6F81B1C009769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3979f5f646817af63073a364cdea2ccf7fbaa9852119caff7ff0a9f6fc93171a
MD5 bdf4d1ed7d3ff135c84f55864be205d7
SHA1 e80f2abb31673b4db9c6bae04f0eb592d04c52a9
SHA512 7334f7f73bb7db97a97e62baba73a0c69d9efceeff564024319a23996a8f13b6e071f00022b50aa59e23cb87e0dd2a3a588ec6b6d29694676f26529f42e9c415
SSDEEP 384:2ZcIURsN2UlfzK1zDSzX5od+d8y0VuXREsHVSwp2h/ssPK9YlPAkQiYNudBuB:k2fxDmO7+REYSGf9aYkNYNqBuB
TLSH
T17BC25BB1E8A45DE748E2EAC5A646F1121EBC4177C5885A4CE6F9B73E309F9F81311C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2933337a74d3b12975174c33833eed0bad06980a006d7447842c016f86395055
MD5 63966d9611a492e48a02c4e9a9cad266
SHA1 886e657963b6de00fd8b7e3d19e162c5302c69de
SHA512 822b2c354c59ed41c95ab5e433ea44050d8358b7b120bc1a32d9bb7893e17d3f1f0cd5bda8e315c855f7c571670bd929919a5b087e908d802cffec8d46a123e8
SSDEEP 384:tZcIhsN4UcftHtD2zX5od+d8y0VuXRArAQiYNudBuB:1hBtDqO7+RArANYNqBuB
TLSH
T12F827D72A878AC675DE7F155F44B31138FB98067DB842F8095ECAB1D01EB6A8031AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 702952d78ab2a9df7cdcfd4fe81631a705c5ab8284f70b481bb9f24da63755a2
MD5 d80ce8c1425295f788f9bddd46d6c458
SHA1 d43d89fa298f974f459daf9c8a0606ae0580267c
SHA512 f86a8fdb841519f8ceb58dc5531785e127a4a78497a4cc62fee2cf7c1ee91eced12ac3bc93472117616a8d30fe3a4650c65204f5f39f271179a9b9609c61cf1e
SSDEEP 384:tZcI+sN4USfxHRDSzX5od+d8y0VuXRArAQiYNudBuB:1+nRDmO7+RArANYNqBuB
TLSH
T122827E72A874AC775DE7F145B44B31138FB9C0A7DB842F8095ECAB1D05EB6A8031AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fc8022121e43df826416861f6312026eaade61d1ebf06a49c98bd2c2f7b364d7
MD5 6babe4972bd72919f31785b045d73b12
SHA1 c312bb668bdf19c93800572b15eddf82e0bc5455
SHA512 f128ef610af5543565f6ca335e1f4c763e72b9c317cf68d44c528c62348235455b20b1f0164e1b241e4c4711da8a162521c7fee890c0c5a44909d56f5af2b694
SSDEEP 384:eZcIURsN2U5fzH1qDSzX5od+d8y0VuXRYr/HVSwp2h/ssPK9YlPAkQiYNudBuB:c2YwDmO7+RYrtSGf9aYkNYNqBuB
TLSH
T11DB25CB1D8A45DE748E2FAC5A646E1121EBC4177C9885A4CE6F9B73E309F9F81311C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 74833084eb76cb73f25f292e2ea73cf0ee2dabc2861c625c0870e8b1103641f4
MD5 9baa1d9d3a776dce2f2b5307232fd096
SHA1 f488d8f869182ac3b0771ec1576aa3a8263e76e2
SHA512 ac05f5c614ae46470a8addc310973408693cb33934b4ec676a30457983f433848ede11f8ae48adf5b33abcf172c0ad28240288cd5aeb4f523132136feb338edd
SSDEEP 192:CONq61rWQmiUyLXW+GX5Obd+j1jzory0aouX6ErjJrGqfUU6:CONq6kKG+GX5od+d8y0VuXR5rAU6
TLSH
T118121936A428AC6B5DE2B595B48731139FE98167EE447F80D6EC2B1C00EB5AC130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d793f61919ac96c578bc88c9c8514454f5f0d463f00b2208f08df1b46a5b7a40
MD5 20d671d1642dd49cbc716995aaaa2b1a
SHA1 d763de448e66aa7e46a84732084bacb099c2025b
SHA512 ca5b937e94032fe97308791fd3061f64756075afe7e215a2a9dffec64fdecf050c54f46d3dc9e38215ee07c8c0d74acdf22667ea7c1ee1da111fb1e53a6e2222
TLSH
T19FE002115310008AC131133400C71B323BA5C2010252434B977042B82C213002F001D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 82a96f44e2218684403fff3d777c88252703c39aad7cc80ed6b6609902fb714c
MD5 5548d54a54012fb178dcbbf37f805ceb
SHA1 7494762ccba29d6feee13bcef1dc0a7cf5fefed2
SHA512 b2a9fefcb9e578297cb62ab89028f1396bee4f1c6ecf50fc44fd444f4bf7c4200f5267904165b81909e7b24db940f91d0e718d17f63eec3cd1a051cd15f3fdbe
TLSH
T1E1E00116531080BBC63D173400C71F323BB6C61143EB538AAB704ABC2C263007F20AD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0d80f7126ced273ac485e71d4cf1641c8d1a354c6ffc021820137f98169daeae
MD5 af50760f0775b5649c713cf4407fc67e
SHA1 7ebb57490e8b13809ddd1355bf7a81c17748b644
SHA512 d61b8640710235d01d5b0dc77e1a4daaef0b28a80c64d462ecffc06af45e79321a647e2006b60bbf53aeef216fe835ad2e6b42c39a523027951d30c4beaa9aac
TLSH
T135E00211531040ABC23D133400C71B323BB5C20103D7434B977046B82C213002F209D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58895f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58895f.TMP
Size 392B
SHA256 300e5796e5201842baa7b7b649ffe769f0201b8e20f7b6dbbf4f7cd6ce3ac281
MD5 e258af24331cadd3206419893127cd09
SHA1 a461d385d39260012d162ce0ff4b51a12929b1b0
SHA512 42dfbff9c396e4a537193cc6138284f22cd080475049da328cc3742a68e55a4fad8a21176e9d80246080d71f3af0d9fe2d1422dfaecdd65de219ec770fa66508
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1bda188308bf9f8eea099b5cf4029466b976d566c29494911a4691a09878d13e
MD5 54a7ae04b8d13c2c2d443a501c4c012d
SHA1 f06eb30b482161139c4c39d620f2ef7b8d588f88
SHA512 da6434417906cb7970956054e3af6948ed40e49ec26ac7f407b9d6cbb7ad7b0bc54130ef505461eb097daeb44b333f17d4642b5999a16609a099f799903efa0a
TLSH
T18641F84CA6E91148B3B76F5AABF7A86E447B7C372E06D55D00110D4F0927A40C971B33
MD5 SHA1 SHA512 TLSH

Submit Download