hxxp://go[.]you[.]co/youtrip-8-birthday/

Analysis

user interaction
yes
max time kernel
898s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://go.you.co/youtrip-8-birthday/
Sample260824-ebezdaxzay

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320167573635532"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{18E0F030-E375-4504-B98C-D380433E47B7}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 5104	2252	msedge.exe	85
PID 2252 wrote to memory of 4436	2252	msedge.exe	86
PID 2252 wrote to memory of 4664	2252	msedge.exe	87
PID 2252 wrote to memory of 4664	2252	msedge.exe	87
PID 2252 wrote to memory of 4664	2252	msedge.exe	87
PID 2252 wrote to memory of 3080	2252	msedge.exe	89
PID 2252 wrote to memory of 3080	2252	msedge.exe	89
PID 2252 wrote to memory of 4644	2252	msedge.exe	91
PID 2252 wrote to memory of 4644	2252	msedge.exe	91
PID 2252 wrote to memory of 4644	2252	msedge.exe	91
PID 2252 wrote to memory of 5076	2252	msedge.exe	90
PID 2252 wrote to memory of 5076	2252	msedge.exe	90
PID 2252 wrote to memory of 5076	2252	msedge.exe	90
PID 2252 wrote to memory of 2052	2252	msedge.exe	92
PID 2252 wrote to memory of 2052	2252	msedge.exe	92
PID 2252 wrote to memory of 2052	2252	msedge.exe	92
PID 2252 wrote to memory of 4072	2252	msedge.exe	93
PID 2252 wrote to memory of 4072	2252	msedge.exe	93
PID 2252 wrote to memory of 4072	2252	msedge.exe	93
PID 2252 wrote to memory of 4888	2252	msedge.exe	98
PID 2252 wrote to memory of 4888	2252	msedge.exe	98
PID 2252 wrote to memory of 4888	2252	msedge.exe	98
PID 2252 wrote to memory of 664	2252	msedge.exe	99
PID 2252 wrote to memory of 664	2252	msedge.exe	99
PID 2252 wrote to memory of 4476	2252	msedge.exe	100
PID 2252 wrote to memory of 4476	2252	msedge.exe	100
PID 2252 wrote to memory of 3996	2252	msedge.exe	101
PID 2252 wrote to memory of 3996	2252	msedge.exe	101
PID 2252 wrote to memory of 3996	2252	msedge.exe	101
PID 2252 wrote to memory of 1516	2252	msedge.exe	105
PID 2252 wrote to memory of 5480	2252	msedge.exe	118
PID 2252 wrote to memory of 5488	2252	msedge.exe	119
PID 2252 wrote to memory of 5496	2252	msedge.exe	120
PID 2252 wrote to memory of 6044	2252	msedge.exe	123
PID 2252 wrote to memory of 6044	2252	msedge.exe	123
PID 2252 wrote to memory of 5096	2252	msedge.exe	128
PID 2252 wrote to memory of 3276	2252	msedge.exe	129
PID 2252 wrote to memory of 3276	2252	msedge.exe	129
PID 2252 wrote to memory of 4044	2252	msedge.exe	130
PID 2252 wrote to memory of 4044	2252	msedge.exe	130
PID 2252 wrote to memory of 5900	2252	msedge.exe	131
PID 2252 wrote to memory of 5900	2252	msedge.exe	131
PID 2252 wrote to memory of 5152	2252	msedge.exe	132
PID 2252 wrote to memory of 5152	2252	msedge.exe	132
PID 2252 wrote to memory of 784	2252	msedge.exe	133
PID 2252 wrote to memory of 784	2252	msedge.exe	133
PID 2252 wrote to memory of 3572	2252	msedge.exe	136
PID 2252 wrote to memory of 3572	2252	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://go.you.co/youtrip-8-birthday/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x278,0x7ffa9c43c188,0x7ffa9c43c194,0x7ffa9c43c1a0
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,7789663039412231165,13311091817839713451,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,229239835136777400,5616476744131543372,262144 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,716151305827937851,4065120677707042697,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,1655661810153805232,7674729727156797310,2097152 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,18059613759403399928,13576951909741387417,2097152 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,17404429522816572873,8125050159528031629,2097152 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,15420576798749996995,8415975715973298292,2097152 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3444,i,10693479449563627138,11996331693694552213,2097152 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,18398017423230615815,3952340238021669917,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,13284777737038999901,12374152997492228777,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3636,i,14525247190374716616,13662734679058111341,2097152 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,6864446391708438895,10177621440065828842,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,6864446391708438895,10177621440065828842,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17728006540803275954,7388307769274975936,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,15060154976937753413,7469896186656773672,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,14752045203558620246,13985248081927181512,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,2958912825160373971,10625981092342706745,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5676,i,1826010774345204191,12087794507973171501,262144 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,20619331188481572,13920466800419450051,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1056,i,13435075140073660773,17074106110566531891,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,14640659266663690740,6808446974979522617,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,7993776017781761690,12528863138297765441,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,13369625813976041672,9657797178741457271,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,18277002323946805913,11889814545772667523,524288 --field-trial-handle=2260,i,2314173609250912182,17760052664538115928,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 180f8cfdadcd03363ddbb9385cbaabc80d7a61cfd0273cd7ea399c35c5fa0a1b
MD5 dbaea070db3d80664b19d14fd206b9af
SHA1 43edbf1498d3c82ae21303dd11d01a2655eaa733
SHA512 b9795e469e9da1754ef97b82b5af832b0a2296062f67bf27939465758ad8d6c7085402fe4a1c8668ca65bfa6ee2808beb4fc6e69474437db570762c9c77ef8ce
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7n:fwUQC5VwBIiElEd2K57P7n
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c6e909f9a8dc0d055eac9d1736e476bc342e7256507614fa46c7f0b606d027ac
MD5 aeac3b3da2b3d2bbe919221370a7800a
SHA1 4fa12313199763783dd6554ddf793519b3fe25a1
SHA512 33cd6b94aaddf90b9f72a6c926dc59fb348069a7280e1a71ac784cff3586c7e67ac42b909a394f4b076bca7b73c73ccbdec327f62489e9692e53c49ebe9aafc6
TLSH
T1A9E0208519C4C35DE64464475268470CC3C0366AB6C4BAD75710885630C51AC62DF964
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d187c5f946f8a2a671166d84e92762c4f0aa83af172d5258b7c40c1d6ac6d9f8
MD5 786885761d911f1d127bfdf0593285a9
SHA1 8235c2b63aa00c849e5f33d6b4e117248b023601
SHA512 5a5d41257f02a9c5874338e672bb41ea4415cd6313f6ae72b550d2cb31cbd7a1513c8e7b5cd04ef468458055ce17add56c9962f5339b00f2e4be4d5adb3ee7f0
TLSH
T137E0C00406E0C7E4E548E0B79A864708CA207007F64DEAF9334660863CD009C4528CA0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d5916c768ada32bd7bf4041fb211879666198401cf247848b81e583cb5227d3a
MD5 b3c11eb82bf1a6349929511055f3a6aa
SHA1 0164fdb5d9923b7030360213df1fa9c13e1bca24
SHA512 706ceb4f8c1793112e28d59292eaec54803fef290b8a5dc6ec82349121a8c4baa4205459866fbdf68a72588e55798854277c01e9f4e20e34ad13ef7534deb722
SSDEEP 96:n7Y2hKr5XaP7P2RyDK9YHu9bm9oY39ziR7BzvG:cppaP7P2EDFub3Y39ziR7VvG
TLSH
T14B914E17869D6022DB5E4671D0CD2B0237B2F9FD096B6FDA8648B07F6127AD0D3A90CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 723e502e5c903893977057ba3f57d2ef6d2e504d18d56281155d2710993fe91a
MD5 7acbe0e70d0b6fc40020e4747bcd80f4
SHA1 b34f9c7bc20a9b291949d2523d505fe306d83992
SHA512 094c479604890a5bb903450ca484689478cb76110318327292c7de2172e06ad63b04cb16f666a15f2aecb197bd58365ec1ee8566df2730f969e2cf3197a33d99
SSDEEP 192:DWCopDG8eBe2oMfKgMO1lA5vHsLtmtGrRWArvnVrJSeH575qk52SGj4v:DWCopDG8eBe2oMfKgMO1lA5vHsLtmtGt
TLSH
T179D1CFF6C3F6836EC911DAF0D5156E33CE58050343583EDA56D4AE8BA3B14B2E2D1A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 657f36c6d03a4b67763db26a95e75cbfb267a501170ca66e9de5b2e37a934f37
MD5 b81a9026ed3a2c2a6a29163df6003ecd
SHA1 e1ab5f559d6cdf4a1ac9a370e28a989845c2f9c5
SHA512 3abce9e61f250a332796944c515ebf7fdf60482f99523e9d12da52dd128995a5cc11d3c49e6c13f2339270eb163b9b540b4d9355da60cfcec1f7637c715b6af4
SSDEEP 192:D+pRsKA7AReikeBSBsvSQ7E41lAD1GIfLPmtGrR2MQHrvnVrJL0o/W/5qT:D+pRsKgmeresyqQ7E41lAD1GIfLPmtGk
TLSH
T1D302CEF6C3E9822EC9119AF4DA152E33CE1C0A4643543E8B95D5EF8F73E18B1D29194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8b124da43a620e983b3ccd46a3b1fcaf98ed7d529814ce79b334b2be5f1687d4
MD5 8417eb277c82ed0a40ae5afa5e1ac6a4
SHA1 fb12ed3466fed9f10a2234e5f7b784f8e8c56c4e
SHA512 ca191c0ffa3d245ee56d379ef54348cb10e9c8a91121a99751c5a4e089a781e6b8b58d819d18b596d89b359f72b5edfb5aa99148e4662ad6ce72df06b8b450fd
SSDEEP 192:sxZ8RsyM/jK1Ml8Mkc/fvs5hWIdpalEHW6+WNW9j/YwttBxgIgrJ:sxZ8OMc/fvs5hXvHbg/y9
TLSH
T1E2520A056A34A97BCCDBC609FA55BF53D6F9457292900D48AAFCDA0C04E6FED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 491d67e59d0424d9e130d4f1dec1c1207577126bd01e3b24dce9fd396e337258
MD5 46e07308d40b5d7deaa5dc056842c07f
SHA1 d3f4e23d16393e5f4aa154201808f3fb3f8173bd
SHA512 029f4024b699183288f5dddca48cf3aac3e9b6562de6722097b704dc18989fbee0ea9e400bfbf526ce6327ba75e9c58f42d869a6e5f000680c1fde24dbba7c58
SSDEEP 192:sxZ8RsyM/jK1Ml8UQ0kc/fvsXCWIdpYlEHW6+WNW9j/YwhWQxgIg5gJ:sxZ8OqPc/fvsXCXdHbg/G+
TLSH
T1B2520A05AA349977CCDBD609FA51BF93D7F5447292900E48AAFCDA0C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 24ef8c45bd54c385d02888dae45b7d328ec860a51384c9148ae707af75e1aab0
MD5 8e771bd2899591d094bfd6e1576e94d9
SHA1 9d30bda58a155e7364ca8eb99e0339728cc1c7d0
SHA512 19759851e4935f0ca40b86c902e32dcd72d6781fbf2173a652f86ef2e3633a7ca83df31a5e503401cfec9ac8e8304485d708272bedc0eed3b42e4a22eefdfe1b
SSDEEP 768:vI4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dgrohNLaT:vI4jeXmWvmKxEu1jacPLZQdrM
TLSH
T151E2093B250CCF7E4F844E5DEC26AE876ED802CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\temp-index
Size 816B
SHA256 d4272e5d8d767b2c6e67a7d396c81c6d809308cd4d6f83e9a4f5738db0e8c2fc
MD5 d0d591fde507eb8b76da18e6146b789f
SHA1 64d93646e1c0f1470a361327c98815f9d4abf039
SHA512 7c6b62948ea90622149582e616f9169db20c4072a84bb41d3d344920cf1b4805f946fd32a96f635cc1983b7b0fc27b4842ce20c246f936d38c435d77951b1c4d
TLSH
T1020141165E965C1FE854027B25FAB4F8B3304DCCC720E223E82C01732D3A34925571CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1223.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5d1223.TMP
Size 816B
SHA256 a8df85b25a8f0db41f83c4d9435634f85c5123fb36148aaecc1af0fe9c37dd53
MD5 6e86d18ae40547c00a896790dbd68d6b
SHA1 d6cd2e5211f7904f2bbbc5acafeb1d0a79b4de16
SHA512 6d4d4d6f341d1329ea97114cbf0dfe6158941243fe1f6e925beedf25dd71b45cefd8429e2016f103dba0601ba0a24a14d6742acad718f3f9e6090738a7cde5e1
TLSH
T14701E1578B924D1FD44811BF1DA5A0F8F2314D008326F3A3A42D253E5C767C91A070C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6c8aac63290b2dbab67dc6c02a2c49f08f828b098322aaa216dc9b0238e07f18
MD5 8613b81630a6f85fd043c44ad7432ce9
SHA1 e4a5e08d06398187dc55ab3214b95af16954f80f
SHA512 305255859cc87fd7d17c92d216072b03f0adcdda33425e57f29ba2b10028e24756a8736adcb926faaa33b91b98799b4dac4e03f072af4c72075f61cfef422766
TLSH
T113E020FA3DD72E20BC7F47E628B345B44156F469C595FC8F2416E2E751B03682056C71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 387f983e2e6375efc608e0898424556bc25091f0e6f61cb1354295b4c378b34f
MD5 2ee043656d6616eaa69884d433cb3ccd
SHA1 8881fb03a16fde4e324df81e59e9bc4d9f870f20
SHA512 e8e063e417c5c3a4fc4db5d0c1e01c4f3883ad5d1f4c287da42cd76551e63a5b8863b4a2aad13e398d13b5f8ee47e638dd8838ea2708c203d8eb79c674c85a88
SSDEEP 24:KdWf5qra4dsYU4M4+fIjuUKiXhaYU1E2ESmKMb8WJyXYafNWHacdwMI44k+bIjyN:K4TINKEkY7yFTI1KQE48mIPKv64/yRz
TLSH
T1DB91524A31FB03163D7E641CA6A19A678A4176633418E53B77EE00620E6BE240DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 72B
SHA256 cf810406909d90d868a774ebcca0b6f9b10f9d38b03cd4d1ce10406f157ca8f5
MD5 ee4a326d19204e16923e8802a8a65b47
SHA1 48c9568e59c1682a9035b5c6980207632eb52b65
SHA512 1cf788ba7b5887493294921e3731ec7af9a55257a95b4f7d75bcf6a23f165c6f3a5b50b3a0258382d754b557b9b5efaa2a051d668dee2e8074c8d3aef086df0d
TLSH
T196A002FB8800809A1F30ACF82134B31DE21B868C8DC0CEF4C40880572178B730006821
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 153B
SHA256 eb9d634d2c84769178cd28dfea799cec4c4fcc296747fa369ce36e4f26815322
MD5 5d85864f95c90d8b01324487a21795c1
SHA1 c7589d30475b967e65c6444841d2cc6f09572bee
SHA512 5b19cae4a279518f7659a954f6aa3a46cb2b709913730e59856d74529564ea8fc14513738bbec5d73feb95f8d83ce8b475862b5b2d3defb7a75bad11d5add728
TLSH
T16DC04CF7461245970B3159E52524766DD6EB4E988DC0CDE5D50A742A2074D138909935
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 146B
SHA256 99af5ac93a0bcd9f576270ce21dd381c09caf0bc4dbd23cc9ffae4bbfde61308
MD5 fcfc2c66202ff8a97c7f48785dfa7407
SHA1 5407d9b4051a1a9177aaaa19c1cb09c5d0a3018f
SHA512 badc0752137ab7f7ce037d5ec2abb47f81cc1dcdc180724b43183cc432e9759601658824470e88d078a6cab2b737ed6ca5bc3806fd33031d34466e0526aa66da
TLSH
T142C04CF74512859B063099E52514767DD69B46888DD4CDE5D509446A2074D138405935
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe588047.TMP
Size 156B
SHA256 154afb97d59b52db1a48732046b6a2f628e53f1ae3e34573f6390e9b446c122f
MD5 ee76951b41e78eade2c709f3865e71bc
SHA1 846482ad2a498bfebfe2f16872569b5c96aae05a
SHA512 59c0f8296e2f9929e04e8ed48a260aebcf73a70b218b25571c98ac382193c8e7cab028d70af7ed9d5b2534e04ecc3226353c8e82aaf285317efcf06c16f2e1b2
TLSH
T189C02BFB863090461720E8F19038318DE1134D0C5CC2DDE4CC40F09331FC3228015E22
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f347cd15-7f10-4772-bc0a-3327de953841.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f347cd15-7f10-4772-bc0a-3327de953841.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c5f9a612bc7339153df1681b8106c89da29555ad71f3a8763ece1bc7c8e2cb1a
MD5 b45c9f5f3e83d0befe32bc3e7a8748a7
SHA1 7cc9638f3e3e37e539e1ae1eab807e48117b6386
SHA512 afebf69f66471c037d16b6cc6e562dfa8c76a28ba606ded400d79ae87605a3477ec72b15808be6aa995501e3bdb1e309a31f6aa1e85f1c70bea456e87a946c67
SSDEEP 384:Z3yFaeO8WsNbYuYIiqNf+uOdKc+24FAiT9YADDF:Z3IzhWStjOAclmAiRYA9
TLSH
T1E1828D32A8749C738EA2AA91F40736539FB8406BE6D67FD4D1EDAF1D04CA2ED131B411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0fa5768b92b8a00c4439aa36aa60ba10c874cc0dd810648c9c55d55fe4ffcc99
MD5 907a2343b764db473e8dae9946c5cbf7
SHA1 74aff55e5713b229fa6d17bc36c0f2f9702bfdda
SHA512 fb942c660863fa6fcc89b79a7be6d0ef4a3443e9e3cb8e143d5c44c9a3ae7e5b6b094b99f8d4b7cb33e47a358728cddd61282f0e92f5a6f97a6f5257948909e3
SSDEEP 384:0iFZ3yFaeO8GsNl8TUNTUlIlduYIiRNf+uOdKc+20FAiT9YADDF:PFZ3IzhG0wgltjOAclSAiRYA9
TLSH
T18CC219F254D78876D9AD5B43E73E2D038EBCC067B591AA90B3D95A1CCC861BFD30A850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b62da928f56efa735313d17928f781f49eec135f2b698f9f8a012600cd8aca46
MD5 2f0475e69ae1223b098013ed2d67e6ed
SHA1 addc7f330c6a85861b05ba684f2861ad7ea7fd45
SHA512 b4c3c3697b274abdb74b8ae7a1c4e4e12e676c137a751619e036a2c7b1015d834044b2911e4b475acf4b008fdcaff19f763f19742f862c98bd1ed6084b94d9d9
SSDEEP 192:EONo6hZ0QmiUy1lpc/+jVQO1L75wOZNx1WU6:EONo6o8pu+uOdC25WU6
TLSH
T1C602D93568686CB78EE2AE45F48737239FE5117BE9917F84D6E86B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a41e16917f8c147989c134a868fe9d40a145ad2f4d3d381bf4434f611fdd408d
MD5 9a8e3156ab280016b167337ce9ffd240
SHA1 dcb5dc168052bad1c255c5994f305b00f08e5d2d
SHA512 ecbb5dcd3440ccc597cb91df7cef790851efc8d8fe9fada38682487a26e4432adbd56271769cda9fa60daf7dcfa8937d813fc0dc3e7626a3eb37d2a1df077821
SSDEEP 192:gONG6hZKQmiUyglPc/+jVQO1LKc+2Bo5cOqhq8eU6:gONG6izPu+uOdKc+219AU6
TLSH
T18112FA366868AC674DE2AA55F48736538FE95127EA86BFC4D5EC2F1C00DB66C230F811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 eca3d7c984fa0103b3951e28df540e6991c67573ac0a94a8bd48c4d1d55f719f
MD5 c3f4fb3a6a6d40e21f5ba9ffde395884
SHA1 1a337e07db71adbe6392f19796d74c32063001b3
SHA512 f9cf8428a67256629ae85fc3da2fde694b9b2f6b0fe57d822fec6801a2d0a1696f80517988acdaf95586e8d0029ac89e53e860e7e41d6e09ed15b0a561ead060
SSDEEP 384:l3yFaeO8WsNbduYIiqNf+uOdKc+24FAiT9YADDF:l3IzhWJtjOAclmAiRYA9
TLSH
T115828D32A8749C738EA2BA91F40736539FB8406BE6D66FD4D1EDAF1D04CA6ED130B411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e49425ec-5660-44ca-aa78-0be9b4842365.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e49425ec-5660-44ca-aa78-0be9b4842365.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5912ae8330b12ba126c279b7c95f3377a98f6566390e7c6682d3e0a169994474
MD5 e9e614e18a75f520c1705777664ea969
SHA1 c2d79443d842009b4977fef5b30a2c3a215f31ef
SHA512 bfa63a7d80af6d74ccd8bb6dfc01c6a3664f9565ba05f6b229aad240dab62aa81a93580c02fbdcd876baaf22400aed2ed47d18fb12fc20313d3d1019d8fb0e5c
TLSH
T19741189CA6FA1158B7B77E1AABFB986D487FB8332E07945D10100D4F0A62B44C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download