hxxps://www[.]youtube[.]com/watch?v=6dtzNMbaWwQ&t=24s

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/watch?v=6dtzNMbaWwQ&t=24s
Sample260804-2vnf7aaa77

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303576939747583"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{032447E3-0341-49C4-B288-887A9E79E400}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{E3FE5117-B82F-4036-9833-F1C69B5FF730}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1732	4828	msedge.exe	89
PID 4828 wrote to memory of 2600	4828	msedge.exe	91
PID 4828 wrote to memory of 4612	4828	msedge.exe	92
PID 4828 wrote to memory of 2600	4828	msedge.exe	91
PID 4828 wrote to memory of 2600	4828	msedge.exe	91
PID 4828 wrote to memory of 2864	4828	msedge.exe	94
PID 4828 wrote to memory of 2864	4828	msedge.exe	94
PID 4828 wrote to memory of 3512	4828	msedge.exe	93
PID 4828 wrote to memory of 2864	4828	msedge.exe	94
PID 4828 wrote to memory of 3512	4828	msedge.exe	93
PID 4828 wrote to memory of 3512	4828	msedge.exe	93
PID 4828 wrote to memory of 2392	4828	msedge.exe	96
PID 4828 wrote to memory of 2392	4828	msedge.exe	96
PID 4828 wrote to memory of 2904	4828	msedge.exe	98
PID 4828 wrote to memory of 3932	4828	msedge.exe	97
PID 4828 wrote to memory of 2904	4828	msedge.exe	98
PID 4828 wrote to memory of 2904	4828	msedge.exe	98
PID 4828 wrote to memory of 3932	4828	msedge.exe	97
PID 4828 wrote to memory of 3932	4828	msedge.exe	97
PID 4828 wrote to memory of 3568	4828	msedge.exe	100
PID 4828 wrote to memory of 4648	4828	msedge.exe	101
PID 4828 wrote to memory of 3568	4828	msedge.exe	100
PID 4828 wrote to memory of 4648	4828	msedge.exe	101
PID 4828 wrote to memory of 3088	4828	msedge.exe	102
PID 4828 wrote to memory of 3088	4828	msedge.exe	102
PID 4828 wrote to memory of 3088	4828	msedge.exe	102
PID 4828 wrote to memory of 2548	4828	msedge.exe	104
PID 4828 wrote to memory of 4716	4828	msedge.exe	108
PID 4828 wrote to memory of 1240	4828	msedge.exe	109
PID 4828 wrote to memory of 6020	4828	msedge.exe	110
PID 4828 wrote to memory of 1348	4828	msedge.exe	111
PID 4828 wrote to memory of 1348	4828	msedge.exe	111
PID 4828 wrote to memory of 1348	4828	msedge.exe	111
PID 4828 wrote to memory of 2684	4828	msedge.exe	112
PID 4828 wrote to memory of 2684	4828	msedge.exe	112
PID 4828 wrote to memory of 2684	4828	msedge.exe	112
PID 4828 wrote to memory of 5572	4828	msedge.exe	113
PID 4828 wrote to memory of 5572	4828	msedge.exe	113
PID 4828 wrote to memory of 1172	4828	msedge.exe	114
PID 4828 wrote to memory of 2964	4828	msedge.exe	115
PID 4828 wrote to memory of 2964	4828	msedge.exe	115
PID 4828 wrote to memory of 4760	4828	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/watch?v=6dtzNMbaWwQ&t=24s
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2f4,0x7ffe4df3c188,0x7ffe4df3c194,0x7ffe4df3c1a0
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,13282765174577536487,5274396384513150621,262144 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,18348950046801181547,9291271188394888800,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5706590309140264876,451357090270413334,2097152 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,9996716105310964282,5711200124624429312,2097152 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,4182731454503673631,15377108344512133992,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:13
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,7904505971422145814,15291869810887775264,2097152 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,2938801066895547006,11869322074053333765,2097152 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,8302371511034275939,3168332031272059779,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,4135884401634229608,7877072049535337508,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5720,i,12080482417108406005,14909123157269715859,2097152 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,13844845217403477253,14101779511519205965,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,13844845217403477253,14101779511519205965,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,12686574278792124590,15477165317209269694,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,9576462797806466429,7054161458508714818,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,18372747821770792021,17258061348706154950,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4408,i,254028405606709325,17306909106218880406,2097152 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2764,i,577286101595781135,8575502410151169528,2097152 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,9356626155294219399,14630696964596821966,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:12
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,2886779591849537815,6138477832159774114,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,13886323166946988944,5953442173473815649,524288 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,38078984276078285,3472870242104505162,262144 --field-trial-handle=2536,i,2968292059079761956,8071773185272354669,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b8d97e4bfe76263868dc72c487f88b593c508bb56f5f05c8f0831f7519e431c5
MD5 e6ca92142374b5f7b7fee8b1cd01a3f5
SHA1 193e1426257ac1180a62ff4edb195220203ac6c3
SHA512 950f13005d8dd3a43c51d7621a643abe5460b94edc1b357d17dea7d9b09c2ac1e9276949f334dfae01cd87498474ded34801f690e551497840d446a4d556150a
TLSH
T1E961311CA3B500DAE7944771BCE394883FF48DAA05075E1B7440AE7864C6F57ADD2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7929.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7929.TMP
Size 2KB
SHA256 7f73613d52419dc891daf5f84afc09ffab330e909b800d468db0477082642e08
MD5 12fd1299b495d41146ffb4cf569f5af7
SHA1 8e49d2fb2b3829814db75944de0a4b055f7200fa
SHA512 beebdbba16488e2803135a7d50b2e248686d689fcb4497a23f6cc0461cc621bbc7511ab3b554e08f974afe802ef1269de90fef3640e879e7049d0ea434666f3e
TLSH
T1D4512E1DA37514D6E3640772BDD394883FF5CC9A08075E1BA4419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 226KB
SHA256 86ec6f56d3fda32e89284004f7b778254250779070f050c99141d09027979a7e
MD5 6b80ce0040c879ef25b2b59acad979f3
SHA1 45f8782e1de8652887caf4afff65f2f8cd88a897
SHA512 43b7253050dff09b3d9f7ecb4c215b5a8230dbf7a540081b4a2cb4ff6282c845b93e0fd6ba8a25a72789f3e6c7f64f6d9cfae1e71cf743ec2395d751fb6515d6
SSDEEP 3072:7AdGjDXDM2kpubQhCjOdlXDm22AQ4Pdr8yjPIReU:NJshv/i
TLSH
T12B34083561AAE296D02F433626529C1EC377CAC85A5C2856F8717D0E1AF7F843BA072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 edb67a72a8103fc01e5b4259bcc08810ce78ee11bb02c95dffd70a3e5ce26aef
MD5 3fa1e4bf7722b204fd0fa8f004d1b7a6
SHA1 4b72cce1110523434c98085aa587df9854a273bb
SHA512 f95d6785eaad8572d65f941f3f553b5d7bee47c462f165205fdab3f9ee5562e279dda7dfed2ebe77711ada0764487ce6d08a94c98987cb3e16e79381d1d1a750
TLSH
T121E06838C8C9C27F121420DB1220BB0ED1A7750E9ECCAE910F00CC04744618C906F950
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4b4c6a0b3d2cf8e73ac74d9b7524096a25f63a5bc289b8a7fcbbb929897e64ca
MD5 843948717f64b0bb3e116a1408e10aa0
SHA1 d33f2f14ad054f95a91d43c8117d2917063f05e6
SHA512 77670f4e086bfbe90b9dbadef50d77cd74d9e14426fbb96d6d541bfc129d569c5c773a8696df370f8139102d596d63021743524ba437287664f58c06e45adcab
SSDEEP 192:DmYmRnYu/QgE9LQp5ziGRGYMqHIavga8mHrJz38o:DmYmRnYu/QgE9LQp5ziGRGYMqHIavgat
TLSH
T118F19CF7C3E8C22DD81156F4DB147E1BDE6D0E2883283C66D8D5AE5BA3E5431E205A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a016179439dfaa58814e8969028141c27b164f97f00f31a118f4afbe2752d085
MD5 1026e2de6fb100d0f493e60128db3c60
SHA1 d7eb17d7eab08fa115ec62b477d5c26d25f82ec7
SHA512 2ed283d63cb35d6d6f4b19db3a672c931348f97aa567d38d1104a3194157c5f5fa80944a83ec37855fdcfc91f4eadb688ad1ceb3371e5dc08dda7a467290fc22
SSDEEP 192:sxReRDbj/fgsNPprQ5lzoA8poY/g6+WN9eUXYnY3zaGNIgDuJ:sxRehj/fgsNP/h/5PXZDT2
TLSH
T15142B8166928A93B4CCBD21DBB55BF63D6F96032A1D01E58B7FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c74a257321e681b7929a38dd2d67acc20f337d2bcf0a763bf174b736348692b7
MD5 4e37a83cd44ed8d1422aeda3a8ccebbc
SHA1 819999790b305e8d63340dba025335a363276c7d
SHA512 42150b7399e35e67a37641403b171d9532a99cfe8924032804f7bb90ea7035b08f6148d5c0d4658025855e5f990e496a39d693ce9bd1fbc8b0de9846aa24fb99
SSDEEP 192:sxRZRDbj/fgsmPprQ5lzoA8poY/g6+WN9DH/Ynt3zaGNIgIJ:sxRZhj/fgsmP/h/51/IDTs
TLSH
T19D42C8166928A93B4CC7D21DBB55BF63D7F96032A1D02E58B7FC9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dd4c9e02455a1b44c9e061eae270bf7c28b34ae6fb3fc90db6665e71cc03f99e
MD5 74802b6ba8279ee584882a16f405fe7d
SHA1 e9510709b31cc786cbec3f8ce6ce2c0da1f0298c
SHA512 978dcb56d38e07276e09202fface59d029cf55aa03c6eba04481827a93f9513c283e8518559b09193fc3912faaab3d3ccbbb59af262c8db5503e8d59b87e3445
SSDEEP 192:sxRpRDbj/fgsNOprQ59QzoA8pFRzGx/g6+WNnHSwZYnkpzaGNIgD0J:sxRphj/fgsNOIW/5BZt5TE
TLSH
T1DE52C81669286D7B9CC7D219BA15BF63E2FA603260D01E58A7FC9A1C10E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f4eb7003a7ed8fdf732ab7ef386de7a416e1c3544daaf93a53570c83574907fa
MD5 f17818d364754ea6d54f9b0b5401dacf
SHA1 5acd55a8ba1056f31f3a49010df6da7238499ff5
SHA512 83e50ea64f0600369e67daece00529151a6dd1ec7ce4be2b352c9a4560d5a78449c342a52bf98a5cacc74e75c220b130627aaf8b625623a0f330577ab8fe94de
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPBrohMN:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VQ
TLSH
T16DB2FC3B604DCB7E4F800AADEC19AFDB6D9802C79A948D4447FE990C03C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f9bf1570-b9b8-4d23-86c4-e9cba21a5658\index-dir\the-real-index
Size 2KB
SHA256 60813289eff9fde59ee464c8cba85d1e8d8e57a0747937eb388ee8180c7d555a
MD5 f085aaa9873c8b1e3bd505c02b5dd005
SHA1 d0a300e11ac5a54160faea4b9f16722a91e9a3f9
SHA512 f3e2556905155f5710bec717793add78092503d1a3176074f71461fe6f905e6dfeb7fb87f5520bbd5497582d5a01c9928ce9095787a4f355a0d88baf4e1ba1ce
TLSH
T1A451744CCD80ABADDC7561BD2D9414F297752C38FC58C3A28054B5B13053A791B5B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5d35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f9bf1570-b9b8-4d23-86c4-e9cba21a5658\index-dir\the-real-index~RFe5a5d35.TMP
Size 48B
SHA256 588a2cd8bbb82fa6cb2393b54e9cc775211d2b75eac0037bfad4ac6ac67ec31f
MD5 744c7c94ff48503342999be3e6b7cd69
SHA1 48cfd80b0a690cc1e191283e47921d8bb78d8a59
SHA512 ad89dd5321bc2af29736f9100e74c97f2892c0fc24dafb528da6da5df3e339e5f90d1cea11c817f56373808bf12a760f28e1ea82ce4025cc351df026538e1a96
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 5f2a09d4567f2f4b78995e47044b65d34f261c34a35cb1c9d5cc1b0db2251e74
MD5 e4d5a7f9ec36eefcc8f0ce86926d71f5
SHA1 76adea282d0a64343ca61df38314ecc8d60abe8e
SHA512 97b90214c4b4a5aa4f05dcbc5bf079af28166eef4ec0d56e709360d47322d5a4e7c64463e10e7fcfe6983094c9caf617fb91c4bd40ad0d935ec597cadb3f12dc
TLSH
T13BD023CB4631D9AA1730AB851034105DCC0D8D0DCCD5DCA075147426307DE12C403775
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 7789d4078680f1e8eaaa658488d5659451d1d97a77a0f66bfe09fb07dbb590ea
MD5 c7b7a466c8f67b285293245cbbad0533
SHA1 e861a6d428f75e052932b91e2adb21888dd4e639
SHA512 2dcb266804eb1745996c28edc6032a045352fec253bcc181ec5bf717160c8ebb35b7abb449e7e25d84c855f877e4edc188e9df59b293cfea4237996522c05d74
TLSH
T1E5C09BD75910C9DF4A70ABC91038667DDD0B414C8CD6DCE570145416317CD1348136A9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 901bd68f810fb89ad7cb100fb14fa9e2044a9eaf98d293618cee6cefc78c50f4
MD5 9b0cc8fc035f72e8e9524b82fbe1b8d1
SHA1 b9974561e09bd54133ec5f98137ce135459a753b
SHA512 a9064171da54b65af32998f6d49be4974ec9cd1ea95de75b324c43bdbf636babc16a1e30b346974a73908bcd2138386dfc71763c649d9286d45fb2d9205a1e50
TLSH
T1ABC04CD25D10C9D75970A78920387A6D990A81488CD6DCA574145417226CD1248126A9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a058f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a058f.TMP
Size 137B
SHA256 8a6122a2023075986aafc9ef4cb2fad1ef1144f56a38a7de5f427393ab1bfa88
MD5 b54f14b8659aa7f98f7474d5a79aaad1
SHA1 af8becf46a8315a9fa7c251b2917e0b62be5a71c
SHA512 fc8bddf375f18fbe57eb8ee27530cf7447ba6d2e9f1904c35a29a1172ff601a4a80fc143159d35bd3c1b6ca8772ca8d27318c60a57f7b501267f2855588cf66d
TLSH
T1A7C09BD35920C9DB4B7067C65038666DDD1B5D589CD6CCE470157416317CE1388156A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2d3b54c7f7046b0fbc460d4a1159d8d023b1f1c8532351632fe7ed7bcfd3ea5b
MD5 29874cc4af81083cccbc55447a5d8390
SHA1 f11a45a5db54b450f588c9ed6b0bee8870d1caae
SHA512 de8692e91bb1112cbe718fecfc1946e5863c56408218f206b8ba0e4148fe7f16bac0927bbb4678a3c81e1030c4b04ad23b2eb98bbc3696e6d751f1831fc8abe6
TLSH
T1C6A0025995892049CC5407F0189951482351CCE645010201D698E8FCAD951617589202
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a54c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a54c8.TMP
Size 48B
SHA256 d131968940d7e994ab0ec4ec98f4f7ed3e349b787360cd13e8e6a1654e3bd789
MD5 dd393af52da9f66cbc2248e563eb9e69
SHA1 72bb13ff864a3916047dbe130f326370770c6496
SHA512 0288e4607987d82b39b5f6096ce6440452503950c69156ae9afe42eca51219ed5640ef0ccf4deb8d0cc790dfc3c8038e284444406992ef76b8f3ed5abaaeda34
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 967869087ce92aa75d4391c2fa2258766f1a9390c6a93560cf79134e18f21cf9
MD5 b24e460d7c36c2913176bf5c5279181f
SHA1 57ece698506cda052dfb2b774110b366eb005338
SHA512 ea3aeec61d5c84ea78acd065db823b95ae09ea168e00425cedd18973fb28a04622a6a91b2b83fc222f5613a2307e71dfd70f5de467c35ffdae704603d91bcd70
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkveXwgKtiu:CoZs4q26neDsgU1gC/wgziItHU1gkeC+
TLSH
T19F915750307B02853C3E692C85B59D6EDA827862345C78AFBBE951610F67E024EFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ca7814fb-ed80-4fb1-8936-49a012510b25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ca7814fb-ed80-4fb1-8936-49a012510b25.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8eedca47e467cefbed1a27cc9ac4f644ec7e580adea25035a9fa3b4f0f87a19c
MD5 a27dd7e7383e8e542310a210225c2d52
SHA1 5954910c002454eb3d12ee786a27b547298b5d4a
SHA512 5745111ebf3132ddb4e41e03c9019d24c69915de9714c92a2534e0c79ca84af5bcb92f14f5ba1635b7d8421a71e97ce5a8d10ad8b59959a6725b67a1bf1bf79e
SSDEEP 768:lrv+4UNbdW3DTGhhDZIO0Z/TNzc4ReyIsPJxLtrAo4KCgG:lbsbo3Dy8tc44bsBXAo4v
TLSH
T15513CE32E9288D77ACE66781B10B35637FF4A11B82C91A94DADD6F4C064B1DE131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 fe6a8088619bef182b05ac3b319fe39a1d44279b56d37974b7f1657ae2f75e23
MD5 c078e32c5f50609bad0c1727a0b5d116
SHA1 b3f3da4bd9bcf8803c3b52c5a5a6b51fec989ad1
SHA512 90cdfa0583c06c3a2c11e58e2d0077a69974988dbb96f2ad9c134378134b42da9ac7e57f75f6c56700114063deaed0be07f6b3ed8f23538b8dc3da3b2206cb0e
SSDEEP 768:rFQl3BwgITGsIoo+xhDZIO0Z/3Nzc4ReyIsPJxLtrAo4KCgcZUM:+l3IyFtc44bsBXAo4P2M
TLSH
T179135AF298D38976ECAD5743A73E2D61ADFDC117B1846A50B7D95A0CDC421BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 161c8d6f7a58adcb5164b4bf24f1ac8b99faf9ce8f1541e78ff8e9805bbf1e75
MD5 7ff10afc0303eb819ab52e2a7c450707
SHA1 e4e685f713d34bbd5cbab0d4871ed9c875401b28
SHA512 0108a2fa6f42b6bef73c70b779cee321d57d0796a0ab394931d421ab6514c5587536b02303a10dbe88dfde7722b82c427f5db0f5fbcf43de500518b53a7432bd
SSDEEP 768:N93+TGqhDZIO0Z/TNzc4ReyIsPJxLtrAo4KCgcZUM:N93+yDtc44bsBXAo4P2M
TLSH
T19EF2B032EC308D67ACEAA781B60736627EF1911782C82E94DAEDAF1C154719D035F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c44f84838c3daa767014d4659ea19d59634d743dcbadf86d7e5822eb3e941cfc
MD5 80b0a7468087d4014bc9e8b717d9e0a0
SHA1 ba3f7a4d8a1fed46705f51a9acedae593120f0a5
SHA512 e29f7d9afb980800045fe8eae20b943a165fbb815586806fbd361e91314f5f538d7a5b7ec75f1d25fa82075269e126164529d59ee21665305a8faa855386bc33
SSDEEP 768:6rv+4UNbds35kDZIO0ZaNzc4ReyIsX+eVH1S5D:6bsbS32tc44bsOEH1Y
TLSH
T11C03CF32E8788A37ACE66785B14B76533EF8512782C81BD4C5DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcf61003-4ec1-4db6-8cb7-1a2cd0663651.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bcf61003-4ec1-4db6-8cb7-1a2cd0663651.tmp
Size 35KB
SHA256 14f86d1aa155a62bdc392dbc04ebdd587abb3a3f86d8cfdfe0f1049b05a2adf0
MD5 acab6ed2b0724fe834031929e4043bc8
SHA1 38fbccd28be91a13c0de5d3fdb4d4dcd4164f886
SHA512 88c57bd7718c09de454df02bf521a8195127e3a703b82391ddae5815d25f2f1bf7064c23aaa61284a13b455b16d6da0d90a7665ecb2aa13273ab91e0e2d2ae28
SSDEEP 768:b93tTGqhDZIO0Z/TNzc4ReyIsPJxLtrAo4KCgcZUM:b93tyDtc44bsBXAo4P2M
TLSH
T114F2B032EC30CD77ACEA6781B60736627EF1911782C82E94DAEDAF1C154719D035B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddfe24a9-dc07-457c-9654-162ec15cd2af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ddfe24a9-dc07-457c-9654-162ec15cd2af.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download