hxxp://youtube[.]com

Analysis

max time kernel
600s
max time network
546s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youtube.com
Sample260629-wv78psc13p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272314237377313"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{DF9C3B1F-895B-4853-B7D8-89652DAD73DD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D31F9509-7909-481D-854B-C8FDB9499710}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3104	3848	msedge.exe	83
PID 3848 wrote to memory of 408	3848	msedge.exe	84
PID 3848 wrote to memory of 440	3848	msedge.exe	85
PID 3848 wrote to memory of 440	3848	msedge.exe	85
PID 3848 wrote to memory of 2384	3848	msedge.exe	86
PID 3848 wrote to memory of 2384	3848	msedge.exe	86
PID 3848 wrote to memory of 2384	3848	msedge.exe	86
PID 3848 wrote to memory of 3116	3848	msedge.exe	87
PID 3848 wrote to memory of 3116	3848	msedge.exe	87
PID 3848 wrote to memory of 3504	3848	msedge.exe	88
PID 3848 wrote to memory of 3116	3848	msedge.exe	87
PID 3848 wrote to memory of 3504	3848	msedge.exe	88
PID 3848 wrote to memory of 3504	3848	msedge.exe	88
PID 3848 wrote to memory of 2848	3848	msedge.exe	89
PID 3848 wrote to memory of 2848	3848	msedge.exe	89
PID 3848 wrote to memory of 2848	3848	msedge.exe	89
PID 3848 wrote to memory of 2744	3848	msedge.exe	90
PID 3848 wrote to memory of 2744	3848	msedge.exe	90
PID 3848 wrote to memory of 2744	3848	msedge.exe	90
PID 3848 wrote to memory of 436	3848	msedge.exe	95
PID 3848 wrote to memory of 436	3848	msedge.exe	95
PID 3848 wrote to memory of 436	3848	msedge.exe	95
PID 3848 wrote to memory of 3944	3848	msedge.exe	96
PID 3848 wrote to memory of 3944	3848	msedge.exe	96
PID 3848 wrote to memory of 3944	3848	msedge.exe	96
PID 3848 wrote to memory of 4464	3848	msedge.exe	97
PID 3848 wrote to memory of 4464	3848	msedge.exe	97
PID 3848 wrote to memory of 2624	3848	msedge.exe	98
PID 3848 wrote to memory of 2624	3848	msedge.exe	98
PID 3848 wrote to memory of 3024	3848	msedge.exe	99
PID 3848 wrote to memory of 3024	3848	msedge.exe	99
PID 3848 wrote to memory of 4648	3848	msedge.exe	100
PID 3848 wrote to memory of 680	3848	msedge.exe	101
PID 3848 wrote to memory of 680	3848	msedge.exe	101
PID 3848 wrote to memory of 2436	3848	msedge.exe	103
PID 3848 wrote to memory of 3812	3848	msedge.exe	116
PID 3848 wrote to memory of 5080	3848	msedge.exe	117
PID 3848 wrote to memory of 1480	3848	msedge.exe	118
PID 3848 wrote to memory of 2288	3848	msedge.exe	120
PID 3848 wrote to memory of 2288	3848	msedge.exe	120
PID 3848 wrote to memory of 3028	3848	msedge.exe	122
PID 3848 wrote to memory of 4708	3848	msedge.exe	123
PID 3848 wrote to memory of 4708	3848	msedge.exe	123
PID 3848 wrote to memory of 2924	3848	msedge.exe	124
PID 3848 wrote to memory of 2924	3848	msedge.exe	124
PID 3848 wrote to memory of 1376	3848	msedge.exe	125
PID 3848 wrote to memory of 1376	3848	msedge.exe	125
PID 3848 wrote to memory of 4884	3848	msedge.exe	126
PID 3848 wrote to memory of 4884	3848	msedge.exe	126
PID 3848 wrote to memory of 648	3848	msedge.exe	127
PID 3848 wrote to memory of 648	3848	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youtube.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd46f2c188,0x7ffd46f2c194,0x7ffd46f2c1a0
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,8804745919995788944,15321645022419729627,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,8689443097671223983,10674528573381215854,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,714758805942551101,16350454594332039792,262144 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16903114102377360613,10901118275539367002,2097152 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16054150874561958737,18306320888815533563,2097152 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,1837807787478600790,8852382044515425675,2097152 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,10469572342271373679,7394653429151277064,2097152 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3560,i,17605825264282568211,9472934238003754699,2097152 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3512,i,8794878814103592582,12756076123935345894,2097152 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,18258704465416819386,6607726002791296884,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,12879199159473335075,12615111616396860469,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,5121418653415731590,17798642215424410587,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,17318457951703557265,13320945210663868065,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,6443909019758528742,4963024027632425866,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,5716800402227151103,5327126557286638902,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,5716800402227151103,5327126557286638902,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,15030735892146583079,1031000344422042819,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12058076862680306454,16108997597016156823,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14988709050806501000,12228141127122211817,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,8693033796090217789,13414333873252853627,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5664,i,13228280988244931025,4971166004494046789,262144 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,2978536420072596067,13529285502236835982,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16369641164059142539,12923732618236928170,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,6141872814941035342,12157562518238589766,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3088,i,8833023268976543074,314690767067896069,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,15102993057766429020,16205772408505362979,524288 --field-trial-handle=2212,i,8798448566700769736,8814339876661941565,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2d970aadecddb1d8482869d8b3159b6dad243fb44184b7808b0cfd8a3feab8ff
MD5 8af73ec02f7141642aa190c0001b7110
SHA1 f95a5e6f4440aa690f2c88e47ff2bef41c06752f
SHA512 68047c8aa43916cbb56fe5342e41062941289e037e78f9525973b05d718fed81f48791cc669c129fa1adc9d2b40259f7b14685943dd51bf1b6dbfed11a226cf6
TLSH
T1F0E026A985C9C33EA204A44B927C770C82D03A0E9AC8ED0F1B048486B441340F6FE790
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74087e99559595ee006d23d9380254a848419c093c1dbb718a52c8cbb99c9cdd
MD5 15bc938c07c9cb7bc97aff6aecfa8d5e
SHA1 e545279caceab291d575fb1052bdb0ebea5b3f99
SHA512 08278fa2b607eeb1f6dfe1373f76256d8d6a6928c49796d860edbb969434a6af34b39b8e2c49a7600b96aaf05654182130da744b720fd15f1a9242aa892e4040
TLSH
T10581A17403410061EBB81531A3E225D972716AECFD179E4A301C68F9A9F635DD41CEAF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 86a427143d6a56487363ebd6eac69025abc5eb81425f6c1fad5761a8ccdad2c0
MD5 27ed39cd6a1a0e716bbd339d1588f255
SHA1 8ab4bcbabbf40111118de40cc1da96d78c8ea918
SHA512 9c4b431de96161a9b94a6949622e91fd237e963c6c2bcc232ae65c820411673364265ad5ed05405a07f5f0b56a41ec4a0ccfb8a6f3e881dacf027076eb65a02d
SSDEEP 96:DoOu2VuZuzuXuIuKVuvu4lu3uLAz/uSurfuYusugNuHu5Bw7uPHuIj60Umx:DTfyks3BKnKkA7x2ZNpcSiUrj60Xx
TLSH
T136A18AE7C3D4C22DE82156F1AB647D1EDD2D0A2483283C69D9E5BF4B53E6071E205A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d5081b2a39bb95aeb7a573aa8eb451bba7340896a4b1f1646978fe14962ea2e7
MD5 d0361e17cbe226220e96b2329b901ffd
SHA1 acc72d47afcb36b272d637fa59c4704624cc7ce7
SHA512 6b664e6caf8e504e0c99bec29dd55990ea9307b5554333e6b0da9ad257922cb83ddb6fa65b6ba9a684e703eef0e8975ace5275a2497836ecfbaf502f6d1a505d
SSDEEP 96:DoOu2VuZuzuXuIuKVuvu4luGAz/uSurfuYusugNuSUmGu5Bw7uPHuIj68:DTfyks3BKnJA7x2ZNp/XGSiUrj68
TLSH
T14FA17AE7C3D4C22DE82156F1AB647D1EDD2D0E2483283C69D9E5BF4B53E6071E205A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5394a1310a9e272790fac47598b4c4eaa581207a7de3661dee64195e8bea6f42
MD5 21b9d5fd8bbb57a395a1387f42e90a74
SHA1 7b358932152e559fac63f188ceb73de9908d37ee
SHA512 636d440ba2a71fe52c3101c14d1789f78956ebbc032d0dd3b2c19e75c3dbbe96c8dbf586dacd9bec85e1d3e27d3f5994f9e4e93dc02b5da39443bdfa905375c4
SSDEEP 96:D/OuMVuWuzusuQuKVuOuIluYusrz/udu+u+u4ugOuHu5BuIj6VwQCsGuPOj4/3:DWFNcX3JzPBdr7mDvB6cSrj6VXCsGpjs
TLSH
T16E8178F743E0C22DE82156F0DA587D2FDE6C1A2483683C79D9D1BE4793E6031E205B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b54210be6be9da5ac3382534cee9c2022c0292e363f9454078c20729875c8df3
MD5 5a508f061cd221ebbdafa059adc9b387
SHA1 f14f9c9f8a63fb3b0ec5cb08ed9e3b30686bb4d2
SHA512 0eefd1602445d5d5cdfd58a267e2a51b8ca0bd0563dcd4c512495dfd24382ca3928fcab964799e4851bd29d75ded48e17c90423312ad7d7518f0402dba3c4362
SSDEEP 192:sxZ7RfyM/jK1Ml8Mk7/fgs6hegVVIdp09HP5tHW6+WNn75/YvOow8aYIgrJ:sxZ7dM7/fgs6hexO/Hbd/3W9
TLSH
T1F252F8126A386A77CCDBD209F941BB57D6F50462A2900D54AEFCDA0C05F7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ed3bcbc166e0b5634d88b2e6499e428fdc3af6ad671338935b03fef0b9aa886b
MD5 d226d61c82dd6ccc0706ef0669b776dd
SHA1 b7c7595d6679c60e31a2d17cd0c05d32ce0394f5
SHA512 e8137d4423a54299df45684727f77c4b6f32adb0aef1c20a4be6bef6cb960ab2b5ac19d9cd3c5f283dd2d08bec6ad4d2b1bddf0f4c96e53bed8216f65f07ef1e
SSDEEP 192:sxZ7RfyM/jK1Ml8UQnk7/fgsghRgVVIdpi9HP5tHW6+WNn75/YvE/f8aYIg5/J:sxZ7dqk7/fgsghRxk/Hbd/xWT
TLSH
T1EB62D7126A385A77DCDBD209F941BB57D6F50462A2900E44AEFCCA0C01F7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 c056ff7f09146af4087ca36fc1038398deb7a42d147744933bbfb7f4ab39a39e
MD5 590f0fc2920d80bd4f3918377f9c13b6
SHA1 6abe5b462cccc1e6855b7ea2fb501afd85c571fe
SHA512 56d073ed5a5965f1fff87c232fe5892e79bd3da490c0c4a23ccad89a40fb2c9809c93bf3a8a77536fbfe939bfc96fd8a2e060fb37751a9192d1f9e20021a97d4
SSDEEP 384:sxZ7Mqk7/fgsghd66sjqMpRiYnazAW8pZS15posJWeT+Lxk/Hbd/x70:sj7k7/fsr4nnc7WeT+L2HbhxQ
TLSH
T156D2F8065924C8779BC39D19B47D7E33D9EC005262C4CEDA5AECCA0C01AE5FDAB57827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aa2eaab2967dea9c1a245aeac4aac48ccff7ea0a1fa52cdbd79a2c5c4935671a
MD5 f5aceda3e7fdc820386b3c6cb0641186
SHA1 e6ce66190370ba6af06bf5c6e0e9a87dd999774a
SHA512 b1b6ce7db848d456522fd0633474082c53ef32ad23362ce49f56181cf192297490b2fdbd2de326aa4dd1e2cf1e13be4a3fba0edae940de081891f8ddb6970a5b
SSDEEP 768:SEseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppxrosK:SEseJ3xWvhfynu1jaVcL88pKp
TLSH
T1FAD2FB2B280CCB7E4F844E5DEC2A6F966EE801CB57984D5487FA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1627cbf2-277b-40e4-8c34-9357c78c0c6c\index-dir\the-real-index
Size 2KB
SHA256 3d7cbf17b72bf320b4032d03bcac7880c45e64b2040584c51a49dcf0ba708d88
MD5 5260e35e40d6e924bca67a9acb38e652
SHA1 3f33b3ad26ca1def4e72e00d4edfb02e1f1cf572
SHA512 899529074d501949d41f9f982d87807d983a3242fa34155b46f259688534e6b97cb53a9d515ea385a0e72b9458517c8c17408c2b2f30df6b1c67f0624f908b04
TLSH
T15041748CCD806BAEDCB551BA299815B287752D24FC18C6924494B1B53403AB41B879FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1627cbf2-277b-40e4-8c34-9357c78c0c6c\index-dir\the-real-index~RFe586c90.TMP
Size 48B
SHA256 53ddb57c9e9402ef46188ff592e5d70c7dfaf11aa3adc5088fe65e319df938a3
MD5 b4a410f8439f279d9f946ac53a82e31e
SHA1 814177b1a1c2c516ac712bdaa25e7c20945545ad
SHA512 8c9735555fb79dec0ad62ddbcdcfc801ce13d29f921a699ef2d090a28ab7ce5791f86798d1696808177fc65320af2e93662c837c43cf7013d9fad2d23bc722f7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 f360ea26af144a433f869f0b5c96710cea5db0972104a8c7f21a5988b153578c
MD5 52c80b8ab644b95a47033bcd28e92056
SHA1 e8ca27cee411d1abbe12e72cf4e6804c3a6db22c
SHA512 ed520d295222055ab3dde34fab5c304568692bf2b12b9cef4a3351bb9c32ccc217d8a3c6a4d4cb9f8612ad2dc0c2c609a985749f45f30d0bd0fdb82ff0b5d2f7
TLSH
T1A8D023D6C632D4973574DE803038214F416FED48CD81CCD84544F2473478603C406435
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 53f6c662afffc2db9236c810ce147132866011366d5e84340a38f2223975e50b
MD5 464fd22cc7dd6d97dbbff3cf70dfe7fc
SHA1 7e622715bceb002ae5bd13319435170c2664bd0f
SHA512 b252f4b9fa700bdc901d996f7f6a24213fc0038a814178d55173be50d51da602b92b429ee69a0e642ddfcc3fa82b14536e7999e0f01f8668cc3681f83d251be1
TLSH
T14EC09BF3991195D70574EFC42038565E964F928C88D1CCF8915CB14764389134806539
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 bb2131cd42d0b413e23bbfb548110a72854635518f343374edb067f631549568
MD5 ef76035ed70dcb70249a827ea6512932
SHA1 1a6424e3d7886d50c084d77125d39dcf0a44a3a6
SHA512 c872a8a8940e349486ee95c6a83dec279889f7affa0e459f91986e9e66e0a9ed78140a765d335135b5ad8a889cbe457527f0dd948e89bb9d861f5ddc13f703a9
TLSH
T1B4C09BF39D1195D70674EEC83038665E954F928C88D1CCF8955CB143617C9134405539
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5817c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5817c9.TMP
Size 137B
SHA256 e8b585aa5da50a2c6a7441c301d96609ef4c61f7ec1c167f56291983a3562aa3
MD5 fc3eddb5525afacf5084302969f25dd5
SHA1 c4bbae5bd1095c0e08843253c21568c4f08bad6c
SHA512 f599ee4e3601b8aba416d22faae871b79f1da2ed9c9f469b82ec14f7acaea028941cc9c0d15b3d9dbbef9077b8fcf866a172c02206d34d1f2b52a7561a1f2c93
TLSH
T130C09BF3992155C70775A9C42038564E951F9D9C88C2CCF8519DF14370389138409539
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 912B
SHA256 16686d9e99e06c2b49183d409a25d8ad100cb53f6222ebb5cc8882ed6991ea47
MD5 9bc17083418dcf46ee5906bd3442885e
SHA1 10707dbcc6e95fd7e505da56df99a69ede9f01d6
SHA512 b1da486bcb18884f58eecffc4e832b93ee7b017647542926af1d084401dab5017a42ed5f6aa242d5911b0669180a5267848dbde2b592128e82037db8ae572cb0
TLSH
T1BF1128464E95986FEDAC45B710B930F43370C6DC2711B237443D1A3A2C2A35E68070C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca9d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5ca9d4.TMP
Size 912B
SHA256 f9a8121302d01355403905d80446c64c105f85fed6183d1a06472e06c1a48d78
MD5 0c6c76e7e48b4221f5b6012c37c587f5
SHA1 65f0f8339096aac36050966fd9a84559a8af1588
SHA512 3fc927fc5e667fa7900a5f19684f9352d933edf48575322659f1f0e49c71fed7d9292384ba0a576fcd995fd5b128d92243c68767175f00a3c934d40cc7695676
TLSH
T13C1102868BA68D1FE99455B7055A64F87330CD007362F7A3943E263E1C7939D9D470C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8a59e5bc4d4faa858edc27d5075f73295d463869cd6270858588b5df41c5d9b0
MD5 d125edc74fcb5fde2863de0fbc011de5
SHA1 ff5a33cb721650d8fc1e73714543eb46032e9569
SHA512 9367f84d7e1edd3603e7c73da66dec4ee7253c5403891ba7edf384e0b3f4282ce4bae090be0749706a889ccf861349f4db633fe78804cd4ad1379f0d82429b0d
TLSH
T1AEE0C0762DD32510BEAFD3D120308090064A789DE901FC0E541FF6C310B231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 08b24786956ece7c627c8d03dba077652bc8bf9352387a356e8ee3fe09458e10
MD5 c7b64ccc346ac27dd026f99f8f451531
SHA1 b32a3d1ac1c2af3e52067d1c15bbfcd17b5a414f
SHA512 a0bb8c1d7380590487c258c42e3dde783622bc9bc0b8bb3a9b96ca0675da33502cc462e8d1b95999de8e0a1fb6788752d733bbcd7853fd3cc4f5be8a26ff5d50
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 46b12e2bfca7182b5eabe9eec092e6c9ec8aef716794b0c765d675c7f60fdd77
MD5 52c027c1bfd195995b468b1da8c44031
SHA1 1bec2edf3a05b3c8fb6e65b17b415bcbea250e61
SHA512 3f940e043b636a1dca88f43ffd7c8d4286ab4a3a341959ebdffa7018586274c1337355b46a78b0354a1437a1651ce0b03da6f281d42c550b4a9face68e900382
TLSH
T1FBA0025D01D91001C81416F0194A6358635D99D11515060668BCE9DCBDD99A07189109
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 140cecff08aa0b021a74f7ade51192bea31b1271c57f04e53385dda31d3a6028
MD5 8748ff66652163fd9fecfccc66cf377d
SHA1 39dce32369a935ef4cf95f9229194e94e0e0522e
SHA512 d749fcac773c6eb86a15e417e6c949cf5a38aa3f46b50e7b5e19ec705413121d70e795a47b95c84fd28ca71f8988953bf36c6c7f051df13cea4b2868b901068b
SSDEEP 48:KYHIhKggkXyh+IHKnKIXyxmIHKbaMiLm5lzRR9z:KYH+Kggmy+cKnKqimYKbadLm5lzRR9z
TLSH
T194917616367B06423C7E2548B3AA95374F4132A77458E8AF7FB810A15E26E112DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f894.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f894.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5dee8ab3e1f8e90593cde94036c26ee70955d524013432db069b11c2831d2b5d
MD5 7b55488fb099a7f1b464bacd795f1dde
SHA1 a9ce7ecfde9f07afb15e6d11d8cb1f094875bcad
SHA512 883fad50d2d90779da00b3ec6ba938396f5e873c9d930896ecc7af6669319ee32847f612be4a8467d88bec92d34ea36d9a3209ea0ad559e880226c289cbe97b2
SSDEEP 384:qiF1tNn/s3n9S6zsNQ8TUNTUlIlggLukK37bd960dbJrahuP:hF1j+9Vxwg87XhVhahuP
TLSH
T1FBB209F248D7983AD9AE9743E33E2E074EBCC067B5816950B7985A0CCD9B1BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a49d0f2a45b77ea7956733e799226e78c60973d79d5c95b4fe8aa271fd419c2d
MD5 2c5d7bd8a47b09d08dec817ecb735b9c
SHA1 725d176b2d1ee83fb2b2ee71fbca3e16f2b81ca0
SHA512 24587e62b42313a29a6ce330003ba91ac69c85f5b5a7060a3b8346bfd1c7c9b38968cde551f055407e9c720dc181b884aa0fd23176b02912d7cbc0492f8ea1b7
SSDEEP 384:wtNn/s3n9SfsNQbgLukK37bda60dbJrahuP:wj+9UZ70hVhahuP
TLSH
T12C625B326C396C2B9AA2A585F14B33075FF4916B97C12E54D9EDAF0C01DF2AC0317927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cf155847678afc2246c5b32d72c15db1e56bc3097942c0c4faabc735bcaa5771
MD5 71275bc93e55b051a48697d727618184
SHA1 c83c83fbc977d0eea42f7f273f2110af810e1582
SHA512 e312ff67372abda9f3083196b56cbdc1ae7f175698b5a067cea2310b9cd12715e7d05e08bc1b04742112face1d28e15263805cd82f832a0e98df68fdb268f8fb
SSDEEP 384:YtNn/s3n9SfsNQggLukK37bda60dbJrahuP:Yj+9Ua70hVhahuP
TLSH
T1FC625C326C296C2B99A2A585F14B33075FF4916B97C52E94E9EDAF0C01DF36C0317927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e73a93b86c4bbf781daae34918efecfcd3a83cdf041beffcfcf61d5afe9063d
MD5 aabef5c6fa2b66811349eeb93c2216c2
SHA1 fc84286cbae5f1c182d29068442f3e36ab65e2a8
SHA512 83e31bf848bbf80971531cfbfbb40cf3987f5c2053e1a0573224fa2b5f21e88d0aa56e532a89d257ad45712087d7ba5b549b82102cde05f1f6a2ee734f5ad101
SSDEEP 192:lONr6vMtPQmiUykNThTwz+FdLDf847u6U/u:lONr6UtRlTnd/tU/u
TLSH
T1CB021A35AC786CABEAA3AD45F48A37175FA4507FA6D05B50EEE82F1C01D725C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9d32a2493345eccc3850ab21e8e93c78108bf2f19305210f18ea193e5090982f
MD5 f6542be25f201bb005e84625fa41b84d
SHA1 78da370134f205b71e65e983fc54d40ef6574a99
SHA512 3934e62aaf9766ca42e1e259614d91821a4fe91efdbad191356c305d51bed8fa4655575793e7f9e8679604637c55d49d30208d3be1ec3ff1932907420784eb59
SSDEEP 192:zONB6vMVPQmiUyJNmhTwz+FdLD1WSJrn80IJqEU/u:zONB6UVRQmndbJr4hU/u
TLSH
T121121B32AC68AC6B6E53B545F08B32175EB0916BDBC56B50EAED6F1C01DF26C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccc10807-b5d5-4717-92f2-dd286c304748.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ccc10807-b5d5-4717-92f2-dd286c304748.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d371f34cb2bf4c590db3758d654fe6eaa0f3776dc37f13ef9db37ca956771dbb
MD5 211ad47198bfcc299c3355edfa4862d9
SHA1 f2fa904a36786e126beb884017760c76689237bc
SHA512 c107140c83e5da110cc5947ce1b917aa4d42c7f30f507365fa0320b75b0f324455e8717a1867d10cf4e5f84194307ed89b4aa7b295bbbd30bdaf01f28d518bdb
TLSH
T1E641FD99A6F91148B3776F5A9BF3A86D447FBC731E06945E10120E4F0A72B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download