hxxps://www[.]youtube[.]com/watch?v=ps1MC82U4T0

Analysis

user interaction
yes
max time kernel
42s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/watch?v=ps1MC82U4T0
Sample260523-cbazbaax6j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239748381558051"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{453493C2-E0B3-43F4-B8D6-6051FA17433B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{B95CF424-FB8C-4CC8-9BA1-DB0CE5440466}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3308	4856	msedge.exe	87
PID 4856 wrote to memory of 2260	4856	msedge.exe	88
PID 4856 wrote to memory of 1092	4856	msedge.exe	89
PID 4856 wrote to memory of 1092	4856	msedge.exe	89
PID 4856 wrote to memory of 1092	4856	msedge.exe	89
PID 4856 wrote to memory of 556	4856	msedge.exe	91
PID 4856 wrote to memory of 556	4856	msedge.exe	91
PID 4856 wrote to memory of 4748	4856	msedge.exe	92
PID 4856 wrote to memory of 4004	4856	msedge.exe	93
PID 4856 wrote to memory of 4748	4856	msedge.exe	92
PID 4856 wrote to memory of 4748	4856	msedge.exe	92
PID 4856 wrote to memory of 4004	4856	msedge.exe	93
PID 4856 wrote to memory of 4004	4856	msedge.exe	93
PID 4856 wrote to memory of 452	4856	msedge.exe	94
PID 4856 wrote to memory of 4816	4856	msedge.exe	95
PID 4856 wrote to memory of 452	4856	msedge.exe	94
PID 4856 wrote to memory of 452	4856	msedge.exe	94
PID 4856 wrote to memory of 4816	4856	msedge.exe	95
PID 4856 wrote to memory of 4816	4856	msedge.exe	95
PID 4856 wrote to memory of 2444	4856	msedge.exe	98
PID 4856 wrote to memory of 2444	4856	msedge.exe	98
PID 4856 wrote to memory of 2600	4856	msedge.exe	99
PID 4856 wrote to memory of 2600	4856	msedge.exe	99
PID 4856 wrote to memory of 2600	4856	msedge.exe	99
PID 4856 wrote to memory of 988	4856	msedge.exe	101
PID 4856 wrote to memory of 988	4856	msedge.exe	101
PID 4856 wrote to memory of 5112	4856	msedge.exe	102
PID 4856 wrote to memory of 5112	4856	msedge.exe	102
PID 4856 wrote to memory of 5112	4856	msedge.exe	102
PID 4856 wrote to memory of 4212	4856	msedge.exe	103
PID 4856 wrote to memory of 4212	4856	msedge.exe	103
PID 4856 wrote to memory of 4200	4856	msedge.exe	104
PID 4856 wrote to memory of 4200	4856	msedge.exe	104
PID 4856 wrote to memory of 5116	4856	msedge.exe	105
PID 4856 wrote to memory of 5116	4856	msedge.exe	105
PID 4856 wrote to memory of 4776	4856	msedge.exe	106
PID 4856 wrote to memory of 1032	4856	msedge.exe	109
PID 4856 wrote to memory of 3064	4856	msedge.exe	110
PID 4856 wrote to memory of 3064	4856	msedge.exe	110
PID 4856 wrote to memory of 3772	4856	msedge.exe	119
PID 4856 wrote to memory of 3772	4856	msedge.exe	119
PID 4856 wrote to memory of 1812	4856	msedge.exe	112
PID 4856 wrote to memory of 1812	4856	msedge.exe	112
PID 4856 wrote to memory of 832	4856	msedge.exe	113
PID 4856 wrote to memory of 832	4856	msedge.exe	113
PID 4856 wrote to memory of 1924	4856	msedge.exe	115
PID 4856 wrote to memory of 1924	4856	msedge.exe	115
PID 4856 wrote to memory of 5720	4856	msedge.exe	131
PID 4856 wrote to memory of 5732	4856	msedge.exe	132
PID 4856 wrote to memory of 5740	4856	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/watch?v=ps1MC82U4T0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,15750203083982561520,10132681149411462002,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,10672939611945188288,10163257137419951172,262144 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,5947657779171675414,4431519516933411135,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2725714964237729841,3044239013434729719,2097152 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8817773302652390892,15115430057872313622,2097152 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4966558730286600750,3351043307858204223,2097152 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,6533065687697421921,9255352210646040442,2097152 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,11959991895533865996,15012493268155842610,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5096,i,18283264038058683657,14560219204815281967,2097152 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,12087536939799607780,16129947204364579803,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5576,i,12591074455834722261,16532863276511178723,2097152 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,6047658282635342564,11700264353347620470,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,4158971235844386129,12899131230277300130,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5446461195175796146,18100577288808643403,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,11220915765019208481,6408463895784891919,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,2797285579362893887,13027653817100794757,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,2797285579362893887,13027653817100794757,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,13258542834261947184,13345720461400065966,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,8501730877204599539,16088405895145973103,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,17174589593288860223,10258580107400484556,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,2156656432531520681,3340190956077626499,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,7587589717544945055,13825394369980189559,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,7007641095123906186,11397790303307488074,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,11511538685475290846,15536777321514891613,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,17069892349932488455,6744910915052953459,524288 --field-trial-handle=2072,i,1467098685754763558,14950243180892996008,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4628

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4970154c03e71372a250182be039e454337be64d232075875a85fe45679e9791
MD5 f5c5af3b32bf2f99864931d9fb64fb42
SHA1 f24e357193c4d16a3e2dd7ccb217f49678a9ab6f
SHA512 e13cff7f429aabbf53f978beb247cb48c5b6dc77f3bd5cc5401dd0008d1b0788c163e99967285b341713f8d21e369c5402e6a1776cbc28df24efbcdd678eba70
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 57KB
SHA256 2747644ba821da5e2e77993408a94682b8ce42b30660f816e0ff07366c0ff66e
MD5 8395a757edaaa154343b98f88b096256
SHA1 49557acaba0650e0a2b3c32133042129d5a77a50
SHA512 ea9b05e8c9e2de126db5342b024a9b96f0f0716c662aae7f3a1f3cd5957e8cfb0bb7b55737eca982e5bff7cdf0989ca067e20acd42b193a538414e1be67af473
SSDEEP 1536:lrjx4c+45YMN6l3higUAaiBQ277QE+EpNQNUW:lXOjS5gUpg9QE3pi9
TLSH
T14B430277D7E1499E2750E4EF073AD1F9CF859E07A1DA0E2096C98D3238B6937A10069E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 271KB
SHA256 805d63c53db1638155e5fae66df52e779a684438431f00e4b8e6e219cca9d2aa
MD5 3952ffa3d7f2dd968c891861fb199c6a
SHA1 2a62bad801be0e12d2b9c2da5b16b325bb4123c4
SHA512 38faae3686ef47759fbc79cfac938448366a82c694d8d8895bb33142e2c668df58945526a5bf220bd981a81b340813a11bef30d752af81147145b9651d562dba
SSDEEP 6144:wTaHW5kFWVKixuNnUauJBYjGtGawsRyA8K29hRfSzSsc:xfMKTUnfuGtGqJ29nfSzK
TLSH
T15844237C05464AC0EB655FAF8619940C8CBAA8B30F95BCD5735ED39C868321A6DD08FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7e43186fa6fa5018ee101d2e857d4b4eb9992b31127e05e57906e6049095fae1
MD5 f7e069f7f1ed739b758f2a68a496c8fd
SHA1 332a3c81fa5283d1d95ba7e96cbcc476a0d3c39f
SHA512 a24023ffa221423aac8d6c822a6b48e1ec1b84714841ed196531a2237824fbac54ab8e21b6b32c08bc503714540fb95f101d6c104b1436a93483e4df45500951
SSDEEP 96:5LTvXMZvBroSH573ZMQsZuMuCurrxUI9Gsr:9TvXM/9RZMhZuOuXxUI9Gsr
TLSH
T1E8912C163A924B01F3654933E0D5072D367C40B58D33DE46C390B83E5AC77299EDB09B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a35f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a35f.TMP
Size 3KB
SHA256 cee76d683db77bef5b266b19b5061c15b137d86b9cdfe35493e7395a6ff01a62
MD5 6bf22585b0b4c11ab37de916faa69ea7
SHA1 db43635b56e7a3f452a9ea88c13151e44de28cf1
SHA512 8198b7d057d336e303ed5b433bc8177b5f4f703ecfc1832e8b94ba8e4d0ca4c21ad9ee62d0da86ba74f040b7ea33e3b47c815810fba0897ad45f100933fd2923
TLSH
T18B61B5183E928B51F3320973E4E91279357C41B98D33DE55C290B47D9A27B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 313KB
SHA256 a3c4f446f97f3acd9b5b2b110add655dbc09e39e34118973b86e5835615d824f
MD5 1c29c7d4603683e96c4baecf8f49d18f
SHA1 c4aaf2b483381ee97a1a7161f2082ee84ae4bad5
SHA512 f4ec7b1132e710f6b8a0a7a02af05c5fe8d0ef32b4dea722fabbb3e633b0eb7e6ffaa53e3b77e9f59e201bcda54548bfe6540826fb6445bee4bfd3403cf8f375
SSDEEP 3072:7vSquPCRP9JCfv/homapZWW3gBThGpwlLkGPdGZ+xyXzBDfKIDFr2hMGXxGe2hjL:D92nPAjl
TLSH
T13A641929B1A6A2D7E11B823B0D974D8AE37ACFC836597056B4327A0C72F7F44365172C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000011.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000011.ldb
Size 30KB
SHA256 ab32ae9ce4f4d63c43fe35a96ad4e8a6645564cd0b25caa37d74fe8dfe44bf9c
MD5 aac2b504d0228f84fdeecd1afc45de25
SHA1 76bb3994b81f01aec18bd5bc77e7dd8ec4b650fb
SHA512 b516505145678d28d6a1c67f7d7784bf89dcb7058d022d27f7be089a9a615a82f5a216704622fd957d13615b3462182700b10c6fab44d699c66934cb8b8b4525
SSDEEP 768:BpvDtdabx1rv0YQtMRNHJlE89t1fwcycXkY9sglJe264:Bpv5Y1DqafJlE+fwcycXlR
TLSH
T18EE2BEB697C440D5CA6AD3F2D5FE438DFE3899422DEBA4CC9200310E09426E33E1AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000013.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000013.ldb
Size 1KB
SHA256 277fe501287212c9c5d81dc87885149d1f5c18f07c60ece89f1fc5927c2a9035
MD5 360666ab1c280fae71badbfe39abe9f4
SHA1 3c70068f7da3955cf654eafb91869cd61d542a57
SHA512 28a62c7253f938a020cf94ee02ac3f22a5b7eb066b2c0bd71f9649d984f861bc0893acc280adad9ade11d1a46c4b978f973d73e77f7b9ec5e87297e28c318aa8
TLSH
T13E1184254FB96646DD3A4EF2E0D2769C3BB2F4C62390502A554D42190CB2002DC87334
MD5 SHA1 SHA512 TLSH

Submit Download

000014.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000014.ldb
Size 13KB
SHA256 bb6c2b3cbfa6df045b740575cf1075ad28032ef34526780a752858b7e1a14823
MD5 231e5774e8fda0ab79fd6d24748329ce
SHA1 8f1d1eba897dd23e363da3ae8fb7017b093e04a7
SHA512 4011fa9de906ea8e3ac341f61d7d5b01ff1e7c8178b2667229100c0a6b607bca88f5cde8e3d749c77fe0703d1560e53f389a7278d48c3c32a2a55bff3ed1ea2d
SSDEEP 384:joAgEG/b7NDb7cyAmlDU7okYvV0HcsIZlJeibuJ+RaXq:jrG/beyVXkY9sglJe2Iq
TLSH
T1A1529EB65FE991C8C1B6E37BA1FD624EBD21AD4924A6D0EEA210300D0053F533C4AF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 34a905fd60a988605802e07360ede3ae2282411cd0c6e5a734edb3026db7153a
MD5 d9ddd057b511c25cb9460f298089f394
SHA1 f6a81006d1a047b04057c63bd82230287508035f
SHA512 c945ab620cb1c3adfce5546ac0dd9aa9dc7f66a5579e21b17bb60f2beaf82fc96f0f2ee68fddd6e4e960c298acb7a2b86676ca947edf906e4b1ec32ad4819a9f
SSDEEP 192:sxZHQUnhRByM/jK1Ml8Mkj/fQsr/27xkLgIdp0v3GHW6+WNnXb/BQIGL2Sg0Ig8J:sxZLnhTMj/fQsr/27chXHbL/eftg
TLSH
T1AA62E952BA34597BCCD7D219F651BB53D6F9153296940E48DAFC8A0C00E6BED2303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2ad7901f189e988b3ce7c03d707b23eca21a804f3b77fed433650195ccd7dd4e
MD5 1b4e4e4d2aa2c3fca76808e70fd61e1c
SHA1 31fbfcc632060687837744956b60bbce4d2c0286
SHA512 12cef8f9eb51ed217ae0befee70f965728a0dcaaaa58d76ce3ad6b9dd88762abfdddf15440c285dbfa76731c5994ca267a2c71dc6895a9980a83b62e96bd3c77
SSDEEP 192:sxZHQUnERByM/jK1MlnMkj/fQs9/27xkLFIdp0v3GHW6+WNnXb/BxIwL2Sg0Ig5y:sxZLnETJj/fQs9/27c2XHbL/bVto
TLSH
T1EA62E852AA34597B8CD7D21DF651BF53D6F9153292940E48EAFC8A0C00E6BED2313C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 eb355f699aba1ea74bc8b5c088dbe92d9519f8db114340b69f88dbebb7086825
MD5 179dec92c77276c63cbf791ec97efb93
SHA1 10c4d46ad3417928bac9aaf957830867fd297863
SHA512 5ddaac6578d45f213dc2abf39fd47ba9e163fcb6246a177df553308f7b51c0760bd3683d1a4e850740ca111f0afe0ac1954b9713813bb28676a1591ce7d8b864
SSDEEP 768:7/s6pjd7pLuLXx1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVs6wILlWwJNqrok:7/s6pjLEXx1WvxzWju1jal6wILIsNBD4
TLSH
T174F2FC3B6C0CCB7E4F844E9CEC2A7E9A6DE8018B96D8C99447FA444C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\279782c8-813e-483e-baf5-5669a6808b9c\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\279782c8-813e-483e-baf5-5669a6808b9c\index-dir\the-real-index
Size 576B
SHA256 048d9ceb2b34fc2ed5a11a6829284183ae8c0fe65a58c2f7f22dcebdada6c938
MD5 dde7013432c8d375b8ea6c4ca0b3ca44
SHA1 c92adbbf2af1b7b6ac0843c07a3e55701a029509
SHA512 a4576dcb91be17f1216671e0db93d888804649c545ddc8f057a5315d00880220c301adaace49afbac1f69b8ddbea6f8fde2cf16341b1a92de386af115db2108e
TLSH
T14BF0F1B27696041ACE60AFF9033340409B78C80E1B9AEEC724947D36485FB414FD1704
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a93b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\279782c8-813e-483e-baf5-5669a6808b9c\index-dir\the-real-index~RFe58a93b.TMP
Size 48B
SHA256 68cbe63d5412f9ddd65dc32e048191b59dcb503c0547f4e51dc1081d69997ca2
MD5 19e413eb7be8f62915d8d67c80f00969
SHA1 15ed1618621aa32d9b4bc46bae928ea8406ef462
SHA512 4d93738c50df9542d3ddb3d3bfdc9b05a14e16d65cf9c7af5fff4d40a45008731100315a511ada67a9ac4aad10cafbca8e191b75b8ff8b4e86afdb9f97d61f76
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8eea7824-ffe1-4457-8d5c-c8a08001eb7f\index-dir\the-real-index
Size 2KB
SHA256 35863d1106f35c15b33521b3a2422c0f2926e3a5b010c442f9a86200167750a2
MD5 7ab15499e3c84b8435ce602f90d18da5
SHA1 4969009afeb44a8c2a979abd3af92108cc6f3e0d
SHA512 5ae3a075cb867b9c8e04062ccfe9ad2c8efbd7d1126dd05800ba3e1ce6b93be07751bf18522c52014078e72d3e99017ff5881f6ceaa8cfdf1b1fd423dc11326c
TLSH
T14451654CC984A79DD87551FA1DA415F287752C28FC58C3A1C054B1A63053A6947979FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8eea7824-ffe1-4457-8d5c-c8a08001eb7f\index-dir\the-real-index
Size 2KB
SHA256 49057d622b823d22427621d276a15ad7fd7363b909c8788e861ad77ec78f6c45
MD5 9142186768e0b051d4ab62f2e9b80ee7
SHA1 a875e0f3d1b3d1a877713c03bf677341e98322df
SHA512 37e34ff2d5dae1651521ff2d71635c5cefd8111cc978172e073b3b44a862dba9c239f6d80a5614000cfe23fe185e738cdd8656253447ffaab0b945b221fcbbfe
TLSH
T1EF51744CCDC4AB9DD87451FA1DB425F683752C28FC58C3A1C098B1A63453AA94B979FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58460d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8eea7824-ffe1-4457-8d5c-c8a08001eb7f\index-dir\the-real-index~RFe58460d.TMP
Size 48B
SHA256 0013af2962bd82b75a880d8c2ad4baaccacea215b7a045063ce3a9e0b51adf11
MD5 e2aa455e22fd60b16d3f23b45950e9bb
SHA1 b3f49357779d73abd5db3d6e5d8b1cb303a5617c
SHA512 3650c2b868b32c6bca8dccb83537ed72091f1e6fad7b1dc33fa8960d879e561050550e712208d4c5e318b32c83694d003b1b922c77b59b48f67392d0c5523e2b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 073d8beb4762021fa3d4b29d0682594f32200049d03d675708da2a5c4e20a20d
MD5 d3b4bee579276b56132340e7771ce5ff
SHA1 4438f69691563445d6e68f0f1242c48b5615ef05
SHA512 582d78e481492aa12a94c33e66d6ef444cc16fdc9c14b3c4be760bb1cb0b18361fde47c756ac5a7e48b7f46de637878489bab983bdfcaad2117ba4569fe8f6a1
TLSH
T123D023D74730C44717349D4424345A9E500ECC05C5C1E8E8D654B0E73074703C022D75
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 0a3d480553a5a6ad11b047a0931082aebf2b845eb97053112b9a6c36712fb1dd
MD5 a9ccb13e3c4fb5d289ca4663d098bb8a
SHA1 378afb9b3799ce7b44024d69d78f831089034642
SHA512 83f607c31517a07bbc275c69e07cd0972a94483def0354b25e1388d55a61263355f2ca9c9416f3ca1b3a8498e36bd7d06a7eff5679df061a45e4e5843fd306c0
TLSH
T165C09BF7561085960B34DEC43439575ED54FC14C85C1CDF8E118509B2134513C413DB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 57896af8f9c8617542568c97a8b1198937e11f5da33cc45b91eb6a43668bd429
MD5 1aa8c1806cdceb1030f86968237015bf
SHA1 312d54db3b13f3642762332bc27b14f6c54c8887
SHA512 08238f148e1f1dcff0aa70c7624b44f5fa44ddfd08025c6af8f6e1684ac96be8243ea25bc422982fa5ec7e38b5fe116e9fd821b08cfd1782fb63f5f9fd7c3dfd
TLSH
T167D0A9AB8631889607309A8438384A8EA05A8E4A99C0C8ECD944B19F32B9602C0429B1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 f56899d7bd21c4291ba122ddaebfa896157ed1bc9472fd24b705a594d6c5f084
MD5 137f23baf7ca5f4e3251b9c2701da0bf
SHA1 5d9e1c5ca9a0861c4186bfcd22e1c16bfdbab376
SHA512 6d91390db752b10355a2bc8e41f35c0888de009d42b90ad5c4b9c4f64388b8e4e967eb65f037bbe48b65b79867fa5a78ee03e998cff5767aba71ac2d0a6755d4
TLSH
T1AFD097E73A2100450B308ED03438AB8F800FCC888DC2CCB89188300A3334403C822D38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 5c1c9d82a2aa7a22e7a232d531d4053e0448a0fb8773aac867870a913ddf9772
MD5 9a93509f435369e8024f48b60601779e
SHA1 9006ba80c681c1467c006bf7ac6c819f5c0fa03e
SHA512 2fce346e0e79f949e70adb86de9eb189d5efd9d31f7d86252b611225eb8b3d0585c188a6bd0e37846efd5ac2de3028814a68a8845ff943f044f20243b28b2e51
TLSH
T177C09BF75A1045D60B70DEC434385B5ED54FC14C95C1CDF8E558609B6364513C412DB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 43d73edd5ed9d737a9e6ca02c5a982e011a693cf2c56402c33ec43534047928c
MD5 5ee55336e2d4bd06ae3893a042410588
SHA1 8cb9c5347a79bd338e46955d11800df52ad6385e
SHA512 98932d1d7d04ef590871209ee1b9caf1d07be1bb1b82b6046aaafad0c45bad361041e224b01d90c1d4ba2915cd1909b6d4c25f3ea93c4b66c922f1402aff8cf0
TLSH
T1AAD0A7E77A6105451B349FD43938BB9F810F9548CDC2DCF8E65C125A2375903C862D78
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582d16.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe582d16.TMP
Size 137B
SHA256 cee2aa649ea02225b5d2147a81a41a94deae88663bdcb32c39bd7135057b51c4
MD5 7857f9a34a2cefb70ee17719eab7c739
SHA1 20a803da3580c89beceaaec41f094d4557cc52dc
SHA512 21e26e0c95abc47448d6e8215abe7747b082c16b2f54d22550d8a493596059515b7778d51fe0007a1bec477dca18a6bf21ee23f5607f936c88a4f8f515b4b796
TLSH
T1A6C04CA7562055960B3099842838564E955FCC4989C1C9E8E119709A2134513C512DB5
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 96B
SHA256 160c800d54aa02c7430ea87c1fa11fff0110377b32da732ef2de9e69a8ca3151
MD5 362d224b006bd9fb47e2afedb96b88c7
SHA1 0c718bb98ec0c39b16033fa619de16131c055be1
SHA512 d1578cbf5e717bfdae0793e517e4c71718cade887089036343caaf66f417f22850756e9d0142b0240fee37b1f3d677220623ac0eb6e9c3027b41be3305a2d16f
TLSH
T12BB012CC001C3052C53C0738308644A120E40859560502411850028CC0771409181913
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589bed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589bed.TMP
Size 48B
SHA256 cf2d07a6fe016c7a8247b37f2649e18b295d0028f93b9e4b2bb2607cb2b1cee0
MD5 5254d32151201b3282e21d870dc1f7a7
SHA1 e72054656539ae309809f2d1345e502aea3c7d28
SHA512 ea2df5777a400ac259eb8109f811ce180900a6294e04cf0f5bea126a3725c978e38268e3f79014b8790fca8426374ebffa104c2f51dc98904a35df28ad3e7c83
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8a4a993a818fa0a73174e2604d7249ab70861762c6c139fc29efadc3b3a5de6a
MD5 982e6b91ac50c108b7fad49629496c1b
SHA1 b0e55346da800ffbef5a303287600b255af78295
SHA512 25a54f41eadb64ec8eac653ba242052a45376d887de3c7d171acddad80b3b04c11b4839dc9aab2811e4a899816bf19e6c624130c306574c395ec8a6de16da2ff
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFy5IZKakkzyzZ4NJ7nzkDn6PI6BkK1BI:KUAAKteP+y52KakSa2oKDiL
TLSH
T1ECA1060632BB12433C3E2958A294D7279B46B1733058B82B7B9851760EE7E344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85a896a062de84a7fb5117582aead55cde50c1621f4f9a78f649718af6536dc2
MD5 cf654f2dbb0a5298d2b1ada8802240cb
SHA1 38690c1f9a6af4ea786b71fc1bb630c719df6685
SHA512 10ef0f309664c4566b731fb9382493694a7468a18e3ee04554dfcf17b3df248d52fd1268c2c7fcb56caf4b8631986a2d64ea628c70dee59701b96699b3d48b14
SSDEEP 192:qON86O7+3hQmiUymsmIGttb0oO2bKh2hgGDQ+RU6:qON861r1IGt91ONMBDrRU6
TLSH
T17702E8356C286CB78EF2AE06BA8737235FA5103BE9952F84D6E81F0C00D765C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 926b0d4c5eb1867113e67756512b70a12d1d2dee5f8865318de692a22eaa3628
MD5 b8aeb7adc7bac59be0bbfb3f31122ce1
SHA1 a17ee8a1f9aa7994fd7bbf4f85f774a2e04b5a64
SHA512 81d073bcae14b87dad609f190c2be8a590fb45e0faf6feb7cb7e99307bcd6c29691c5c02ddaef4c932a018ffd2d1afe24a9ef37613b7351ae544eabb7c6923a8
SSDEEP 384:nftNnNnb9fsNZpiG0eiZ8R8ukgfa91ONMGgzJr8DEIiU1Lq2m:fjZbF1PBpPO5Eh8gIiW7m
TLSH
T195928D3168386DB79AF3A945F61726175FE510BB98D52EC4E9DC0F0D02DB6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0f662622830016a986f5044d34b764f743af7e6ea1d6ee8c58c9028c3cfbb99c
MD5 98155dcf6d32b23c4559745e977adcad
SHA1 b96525ceaa02b1721e5052fa8dff4356cbf189a7
SHA512 1606f140ab3b8c29da2df1ea196f2fdfc29ab336a43a27c075631ed74419dd8181bb248694ebe66ae5106c37aab6100b898f33216b08f0dae27cdcdd2f28ba63
SSDEEP 384:nttNnNnb9fsNZpXG0eiZ8q8ukgfa91ONMGgzJr8DEIiU1Lq2m:tjZbF0P2pPO5Eh8gIiW7m
TLSH
T1BB928D3168386D639AF3A945F7172A135FE510BB98D82EC4D9DC4F0D02DB6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b7810f894c7b3cea475fc2810e8754a809db92d6ed58b46c10c97c81174114a
MD5 e4ae821657065f52b57d3ee20e5b41af
SHA1 4573f53065f9580af5a92fcd4993a75700649350
SHA512 24168d2062bd479432ea616276eab5acb5a4adb0a1de2e1cba88dff92c6e8d2397363b3aef1d6e5022b50386b76448d6674387d33e1949ddcf312f20ccfbbda7
SSDEEP 192:qONtI6O7+3ZuQmiUymUmIg9ttb0oO2bKh2GkF0SJrucNDA/MKU6:qONtI6vqrdIg9t91ONMGgzJr/DEU6
TLSH
T1AA121B7578386CB79AF3AD42F9877A239FA4107FE9961F40D9D81E1C00DB65C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d7f084fef0b5fd89b1960b6101947e51b2b1a64b9c3fe9a291632e5380bad78a
MD5 3fef313eba60004c108f24ff05ea093d
SHA1 394ca7964e7372b030b83befa6e156287e6743d9
SHA512 0d7c567bdad456e2d0fc21ba0149a8b4c6b9e27d3852e613004657e601da1b49fdab1a17f755fce1164d77ee14c37b2e620bc00ce8e71572b4618b25747f860c
TLSH
T1DA413A5CB6F91148B3B77E5A9BF6A86E487AB8372F46D49D00110E4F0A62B01CC62733
MD5 SHA1 SHA512 TLSH

Submit Download

188b8041-338b-47ab-ba2d-33490d2146f6.tmp

Path C:\Users\Admin\AppData\Local\Temp\188b8041-338b-47ab-ba2d-33490d2146f6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

edcd3b7d-052e-4e21-984b-3ba4a39508be.tmp

Path C:\Users\Admin\AppData\Local\Temp\edcd3b7d-052e-4e21-984b-3ba4a39508be.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd7d5965-543f-4308-ad4e-7da12a43f416.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4856_215986860\bd7d5965-543f-4308-ad4e-7da12a43f416.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4856_29759034\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads