hxxps://www[.]youtube[.]com/shorts/z6spfNIPw4g

Analysis

user interaction
yes
max time kernel
51s
max time network
54s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/08/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/shorts/z6spfNIPw4g
Sample260812-llqxystdnc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3772	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310010761407852"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{AA56D3CC-1742-4FC1-A905-AC9BFA237965}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{B47CB855-629F-4D9A-BF46-69A9DC5651A1}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5376 wrote to memory of 5408	5376	msedge.exe	81
PID 5376 wrote to memory of 3772	5376	msedge.exe	82
PID 5376 wrote to memory of 440	5376	msedge.exe	83
PID 5376 wrote to memory of 440	5376	msedge.exe	83
PID 5376 wrote to memory of 440	5376	msedge.exe	83
PID 5376 wrote to memory of 4656	5376	msedge.exe	84
PID 5376 wrote to memory of 4656	5376	msedge.exe	84
PID 5376 wrote to memory of 868	5376	msedge.exe	86
PID 5376 wrote to memory of 868	5376	msedge.exe	86
PID 5376 wrote to memory of 868	5376	msedge.exe	86
PID 5376 wrote to memory of 4976	5376	msedge.exe	87
PID 5376 wrote to memory of 4976	5376	msedge.exe	87
PID 5376 wrote to memory of 4976	5376	msedge.exe	87
PID 5376 wrote to memory of 412	5376	msedge.exe	88
PID 5376 wrote to memory of 412	5376	msedge.exe	88
PID 5376 wrote to memory of 412	5376	msedge.exe	88
PID 5376 wrote to memory of 3200	5376	msedge.exe	89
PID 5376 wrote to memory of 1736	5376	msedge.exe	90
PID 5376 wrote to memory of 3200	5376	msedge.exe	89
PID 5376 wrote to memory of 3200	5376	msedge.exe	89
PID 5376 wrote to memory of 1736	5376	msedge.exe	90
PID 5376 wrote to memory of 1736	5376	msedge.exe	90
PID 5376 wrote to memory of 4688	5376	msedge.exe	91
PID 5376 wrote to memory of 4688	5376	msedge.exe	91
PID 5376 wrote to memory of 4688	5376	msedge.exe	91
PID 5376 wrote to memory of 2548	5376	msedge.exe	93
PID 5376 wrote to memory of 2548	5376	msedge.exe	93
PID 5376 wrote to memory of 2548	5376	msedge.exe	93
PID 5376 wrote to memory of 5748	5376	msedge.exe	95
PID 5376 wrote to memory of 5740	5376	msedge.exe	96
PID 5376 wrote to memory of 5748	5376	msedge.exe	95
PID 5376 wrote to memory of 5740	5376	msedge.exe	96
PID 5376 wrote to memory of 3192	5376	msedge.exe	98
PID 5376 wrote to memory of 2700	5376	msedge.exe	99
PID 3192 wrote to memory of 1856	3192	msedge.exe	100
PID 5376 wrote to memory of 3364	5376	msedge.exe	101
PID 5376 wrote to memory of 3364	5376	msedge.exe	101
PID 5376 wrote to memory of 3364	5376	msedge.exe	101
PID 5376 wrote to memory of 1212	5376	msedge.exe	102
PID 5376 wrote to memory of 1212	5376	msedge.exe	102
PID 5376 wrote to memory of 4040	5376	msedge.exe	105
PID 5376 wrote to memory of 5140	5376	msedge.exe	106
PID 5376 wrote to memory of 5684	5376	msedge.exe	107
PID 5376 wrote to memory of 2184	5376	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/shorts/z6spfNIPw4g
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ff87433c188,0x7ff87433c194,0x7ff87433c1a0
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,15296159495272296218,6177981906902931448,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,5895489998333757659,10128397864891637607,262144 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,15741119071591347458,16936706565170881681,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8170692197311812097,7199977437916355971,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4846362088433747901,1122149737365617788,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,9426327573320014669,13344104403923450231,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4296,i,7029132691003733745,12050566864289314439,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,11477922991177930660,5555201220543169027,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4252,i,5227581949028346023,2890095409071761955,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5396,i,10167569848469131787,7758468094714895426,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1564,i,3794696523812725892,6693349093221336857,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,1188858149494466597,6265826244202325059,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,16903794067053424972,11120838536047455731,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6484861819200963718,3475071657678447314,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,16903794067053424972,11120838536047455731,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6676,i,10773951829940856052,12772471893904540838,2097152 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,16207012743569584353,3346588005810261807,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:12
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,2441636992512828559,18187673660038604225,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,5205782447414490072,9146856534254939494,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,10185089238851868769,7581100583430374798,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=768,i,1046872593767788618,5979642329704869169,524288 --field-trial-handle=2244,i,4836274731231236838,17941539715975939914,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
  2⤵
  PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dfd94c748e674ea9fd9501a156f36fe98a91bc30e4fbb7a050b3e07b6da87251
MD5 48d2a74b9f9b337cd4d5ba5e79dfdd84
SHA1 6ba022dce5af70c1a5595b902b4e5bce7ba7ee3e
SHA512 26bb29893c5ff0f3c85dcbf16f331db1f6ab01b4ae8d6d9c68be344cab219d9861e101be415b454fea0375470c85b7e982f35351ad4c64e248be7c2bad9702e1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 191KB
SHA256 3539687232fff15ff582a41e77284dc33a1160793e3e94a684eda901caea9911
MD5 9b7c10728fb28b17755d7efd0fd41fe7
SHA1 997b1c2844a4c27b4a17ff9386f8bf39adea9a3f
SHA512 555f392c1db37d1174c4c0346f6e26700ed226d31e72b1995af3465f638bf262637cd7891b169a3aba4a05fffb65a0e7f23e23e54dd8f4268fdda455253fff25
SSDEEP 3072:7krRvl7AmFeHMXiDnZONRx6oPZeWDhh0w/ZjNRxdGcVOUU+7T75PH:kX6Aei1
TLSH
T16A141A6921B255D1E63E83370A02AE07D33AC5C0B66CB096F9617E5E37B7B003B6572D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 604c14fc1976026ddb200b56c75b41bbf3b9d1e09f6afd285d28f696fe842a22
MD5 64cc96e9ba59230211ba85d8ee801b57
SHA1 b76e5e1245b300c6f6e6c01de15ba4009c52b3aa
SHA512 2e480dd5cefc724e6a715ad40c9b35dc65f0cb072de8ef3a8a4981bea19b02dc7bed5a1ee25ba959651081a708b68c5db13ed719a10e39722b0d3f69a79f46b8
TLSH
T1DBE0C06884CBC1AF1155A5FB19347B0DD597691FE7CCFD410FC8C850B08A448E42F1A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 15326a86b63abb3cceb382635e30510f815ba29623bdc2da8bd64d1d780a3978
MD5 ec4217fcd6b919d4c977549778cb550c
SHA1 141b0bfc6c258abba485cc52e2f917fc9c5cdcfb
SHA512 9bcc49cb85bead96c3ab0dee5d739a10077e59ce072af5164aa7ad01986a8544a051c5c4707af084465e845e09d3e40cb0d6d15ae05c96d7882b10779d831db6
SSDEEP 192:sxZ9RoyM/jK1Ml8MF5/f4sjYMackOIdpABnj/W6+WNGa7/Y05bpV+gIgrJ:sxZ9id5/f4s8xpfI/bb/5T9
TLSH
T15952E901BA746977CCDBD209F955BF53D7F9056296900E44AAFCC91C04E6BEE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8befde2eae71cf9aac00b6dff0d44dc7c98035bca5b81a11064657f30a8e265f
MD5 47c2b9a61abd8a66fb8d0aa7fd7acd37
SHA1 cab9068fc85657eeb5e11c73eac56af4d99911d9
SHA512 35e82f26a795a378d1f034a2739a6f8151638bc1cc4c136e44f2794561fdf6d7bd720a5160c4ad0f6d4b98b8da5450cb18cc485382a422069a47a2f5b35a3d09
SSDEEP 192:sxZ+RoyM/jK1Ml8MF5/f4sGYMaFk8Idpz1BuM/W6+WN6Da7UL7/Y05YfV+gIg5hJ:sxZ+id5/f4sFx+lj/bHs/5yp
TLSH
T12862E852A6345977CCDBE20AF950BF53D7F5456296900D44AEFCCA1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 d921a65c2795576256667f897183a709e22374d462878cd01999d04822ef2956
MD5 60e17344d5c400603a830ce76d0501e3
SHA1 ed39c27ee862bf3757204cd36ec9b0ca850f0844
SHA512 7b5288f0bd3b14f64b3f672675fc4afc9c110a4366348a5b887284440298b024da87df140eb2a529f182ab1cb26d80cbd881e0c37e3104d96888f0c13e775c6f
SSDEEP 768:1QS+zXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hSySF:1QS+zXl8pZ221WRmsYQL0u1jaKu/LpdZ
TLSH
T116E20B3F244CCB7E4F844E9CEC266F966ED801CBA6984D5447FA494C03C77EB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\39f13e51-3eb8-4edc-b1b7-11217a876983\index-dir\the-real-index
Size 576B
SHA256 812b6ac74ebaaad8324e15304523511e696379834b76b0740cfddbfa78a02282
MD5 3d98907e9ef8bdb369672a791e4368dc
SHA1 7ba80d122c909ddae449f61e48e34c838c1ccd72
SHA512 639683c3613030a6a1ecc8d230ca862092f9c45b94f6cd5bd8f2a09ef703ffdb49bba97744f1623e6fa8eafd79f99625904e2a01bbd4d5f83904899426ae795f
TLSH
T1E1F0F1A4FFD0D455DE505BF0013741503178A9AF15852D177C0A7779A42F5428F46441
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588604.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\39f13e51-3eb8-4edc-b1b7-11217a876983\index-dir\the-real-index~RFe588604.TMP
Size 48B
SHA256 fb1b02bbba693d9d1bdfe29e26fce9bb882cf9cebb61a661d55faf0f198b5d48
MD5 5a7d91ba819d11ff7e34368921803731
SHA1 1971538bfaad03ed88a2074ad342866ab8aba7c0
SHA512 2a481cd786c807e379d2cb7c3405e9e4b996a6d4620977d16bf42d1c7623e157c5d8b0ba6484106dbd2add66780fb3092c2d3e7c095a272a9583d241752918c7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9e216bec-9021-45e7-a63c-cfdb7ba01d11\index-dir\the-real-index
Size 2KB
SHA256 610f2b111e3f1bad62f7a181b1ff627ccfd1e6d996b77468b694ebdec3bcbffd
MD5 6e14f79b511a250ec35dc70c6301e577
SHA1 a9a90d84fff34575e63999083bb1641ce4e91bff
SHA512 6d9d9dc44351b41a7ea524e0241fd84990b10768546805c1458830ab3436c9f7717df2d03fbda395d8562e44417a8c8042a83e4ba28ef65c4331fba0bdae4cb3
TLSH
T1C241414CCC90ABADECB550BA29D415B267B52E28FC58C79241E4B1B538432B81F979FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a9d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9e216bec-9021-45e7-a63c-cfdb7ba01d11\index-dir\the-real-index~RFe58a9d7.TMP
Size 48B
SHA256 9e9a471a4e7d1f6b36a6d1ee6dc2a3ba1876ec006f4cbbf6fe29e42069ef50ec
MD5 f74682c4f6f94e9dcca838ae43ee921f
SHA1 873c029730326746983b13aeb671802c251548d2
SHA512 d9960239c48248708e8f58a7cb55fdd08617a066a2c9da2b5996b1d28992f6c037ade1bf663fc4f5b00da84098866e23ad247a966d0cf9eaa18044ff503e2dcb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 2a9279da927b11432d7e2f69ab4a64a728160df26f3b1e43418ba6951a58153e
MD5 4007d71c560b9a7254f3c513be5d17e0
SHA1 5eec7f21f8cf635af73328dd4f320002bc96d235
SHA512 d4b0daf0116c9ee34faeaab3475cd692defbdd0b2582ec6a56ad6ef9384c002ac042eb31f129eb38a61a021182fbf235ceee3f288455f3a2fde69a7477acc400
TLSH
T1F6D0A7E9433165875330DF419528A5BC455A4C4CCC86C8F88D04B0963075213D002531
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 d6632f00546c9dd64ce67c09137c1dde2fe0eaef8641013d7f597be6e53a43ea
MD5 5090c2614078a7be87a917435eaf717c
SHA1 251206c7ccb975147b2ee64cd7d765fb101cb01b
SHA512 1948e6d18f6917be2ac2472b31972ffec4bd2ae147140eb5373bd22113fb572443330fb560ef50dcf7824db1f419af1db7fd725a26e32699cf6e0d75a754e1a8
TLSH
T1DCC04CEA1511858B4674DF84102866BD964B454C84C1C8F89858505560746238502965
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 7806ed589779f1543de1f3c773e55c9f868f00896db15332791a99629f885fc2
MD5 82c2918afd15a21b3b26a5cadf72cab5
SHA1 b1bdf9b43e0e3ef633c3e7c8ed6b3be0e8ca076f
SHA512 723afb2724248a0156122203018481f42692fe384b7ea01f1f6daf3a323f1e0138b7db360b09ef8efe3210e85d563bfd58251b7a78fd196f142bdde97f2cc2c5
TLSH
T1C5D0A7AA2D31428646758ED43038B6FD925B5D4C8CC2DCFD8E5870657174937C153A75
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 0dc0efedf21f47531764ff178cf3a76fe0a3b8679409419e0da4227bb0de2cc7
MD5 6d8fbd62010fd19233415fc755e7908b
SHA1 a59dd73bcc56737392e5da621e20647228e193d8
SHA512 9fc049e7938953bce84835c416ef4a00a94c148a0cc2c5433c878c30f8aa598c4e73e1ceeb9f5c00fffc261e23be86bc848a545a8f4f32f4725dd53e98caf385
TLSH
T1A7D0A7EB6E2142C656719FD43138B9FD969B494C8C82ECFD4F5850256270937C163A64
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5821eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5821eb.TMP
Size 137B
SHA256 f2b0a9e10845013f34963b8d55593a3f711bfb3bf207a69905ca9d59d849801e
MD5 a2acff7ebf87b33017a30e8ee9ab5216
SHA1 3d19d00cbcfbd491b98642840a75452f3353f842
SHA512 f9e95946ed53abbc944c9003a319eed8f6443fa0b81f0581049a472495a66e6372a6959955a86140f3ea2df5fa4d5a2385847968210127280dc8ef87d9187e40
TLSH
T1DEC04CAA1521898B47709E85103466AD965B4D5D88C1D8F8981D705570745238902965
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f78bad3ae97650d03e96e10fd25e41db75f7c7ea7d1d31b1cb484faf6ec7d3a5
MD5 b39104f9f6e69c0bf59a82f7f1c62bcd
SHA1 a357d4ea02ecac66d4ebd66f36dec6c52c46c801
SHA512 f1278da37ff7e6068e91af4a4ab5d7dd3d09ac08a4d0b1575e18291848678dbc292176d5c175800b9bf7408f7dc763f9df6301b87803bd01a2dbaf06446c2fb2
TLSH
T107B0228A0C0C3283CCFC833088CB088830380C302BA32833A0F808B2CCA3A80C00F08A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5876f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5876f0.TMP
Size 48B
SHA256 05ba58ef2e2b96fee4cc2010204deafc618ef038c31994aa27cc3466a77463bd
MD5 87f9cf803cbd04ad6d4c1d2cf4491543
SHA1 2ed40053b0ee1d5bb378cfa94615bbdb09e6d053
SHA512 e134737f452eee7b1d37562afd5966220cb203785f137052a8f3e49a08a5d728a8f9ff3c7b98821171b65658e4eedad5f3622114645d76cc40d1237116d785d1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8492d0eeac8b8b453288ce374bfdfa8665dd6762adf99cc6eef78dde34da3541
MD5 45b4eab91fb73a2e5b2975f618188c74
SHA1 b41f1e48644555a3d7a9d7db223ed14d135baa3b
SHA512 223059d4b0c295c31965bbd8c7bb117c18b0daef01090fbb0b231063f598bbbc3edb7b7e7fc7c80949fd921bda1834563e8a9c2c0e1a72b5f46933818b7b69c8
SSDEEP 48:K5wh8AC2SgW+jzIXogKA1oags4wlT6Qtyj0J2q0GmxzKjsIkCxKZ4RUx1MhebCma:KYHOKsEqedWKGoCqUQK5C2
TLSH
T15B91165231BA12422D7E35189357879A0E43F1673129FC3F3BAA05BA2D2AE111EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e5d6fa223a17d2b1bf0f4d459abafde72f053837a0cd8a5f023ece1ca85634ce
MD5 fabeaa890290f95f05d84013389775fa
SHA1 bb32133a185ce631b8a8b711d141aff77bdf6298
SHA512 2a864ceb22cd173f3df765e217917e95deec7f61d73b0a079ae379d1b75329aadda490d6709133fdd65870ce4fdbd03c05544349366c3240699067f4188d0155
SSDEEP 384:sZcIh8N1LX3E7RKiK/wC+29tEMsRnlYWu:6huN/Rl9tEhn2Wu
TLSH
T17E929F32ECB4283A98F7E546F58735175FF8902BA7C56F8496ECAB1C40CA6AC1307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3031b077281eec7d6593e755edfa182b6032752c0a4f978c36fbc06a01801fc2
MD5 72c4cd275e9daba9361a5d3535a5be00
SHA1 e61faef4c1226220db659fa4402afcc3f4fe0075
SHA512 eaf076420ac1e97399fa2f7d60e8c98bc2fdc3dd0b3a5de22c4f14a8ad77f3a67ad87696c8d4b7ef085e12ccda106a0d1178cc3b3ced7acf6044e6836040cf36
SSDEEP 384:WZcIh8N1XX3E7RKiK/wC+29tEMsRnlYWu:EhQN/Rl9tEhn2Wu
TLSH
T11F928F31ECB4283A98F7E546F58735175FF8906BA7C96F8496ECAB0C40CA6AC5307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e85fa44e5417e692c0836820e7f5ff9366bce7a93f43f749e71bc0753d1622d7
MD5 6bc46cc08d0ef6b3a149f5bd98d2645d
SHA1 f0284d4bce326c90a60f9cc7e47f22d4460f8aa3
SHA512 7e35705cba8c1ac933f722cf7b17c0be3f46abf445ddca86cb1ff9616a9e7530b1eaf649e358ce1f5dce487d30b965f2cdc006963f1bd2d703bc145126f343c8
SSDEEP 192:kGNw6fNXQmiUy0Sv+L/GPTaXRCNC+2NV3Zkq6U6:kGNw615tu+L/wC+2NLEU6
TLSH
T177120B35B4A8A83B8DE2E555F48335175FA55117DBC96F90D6EC2E1C40DB6AC230B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e8643feab4ac17262c4a79ad687f1dffd05f58d540054ed35dc8d4e8204999e
MD5 c9e2765d25c5749859c848e55a46a91c
SHA1 8401193d8b4e351bcf139a82194e00cf24950fdb
SHA512 f59f273e50cc417034f7df8b9b1074ed7faa9fafc318429ef3727a57f4611c3d74cdfc0e88143de7e755d489c6e53244e132e8ae1fde19616269b221aff69a40
SSDEEP 192:7GN86fNNQmiUyzzHvPL/GPTaXRClV7q5cU6:7GN861LQzPPL/EUOU6
TLSH
T1BC020B34B8A8687B8EF3AE49F5873B175FE4112BAA951F84D6E81F0C40D769C1347832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ef52b9b9bff6a86de7876147843d8f11431dc2158dabb271a3e0f28701dfb546
MD5 d8a0e4e34dfb27b2de1ec3cc18f6c685
SHA1 6bfe7351c3a7a51f1daa39d76062df4cb0c1bd25
SHA512 1428ace6f04097512aa304cec2aa84d074898f2ada62b159d4b04f995ac3995281dcabf65c10b45142dcd0ac90549c9f2291fbd9cbae03368d433af10b933f22
TLSH
T197E00243D3000147D420437441C72B143FF1C120573303078A30017C3D333043D00380
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 35e831178fe871f08950c4e458bda1906c2f4ff8ac2f35482f3506907c009950
MD5 a1af19990d3c24cb11be654af1508649
SHA1 f9bc0e513ca340e28a6dffca2faa38d11c36f469
SHA512 e4c68f1b99e6a33273e59da23391e504a0b331c0316b8637cbae1d575da0f0f204c892b44a9bf50fd9f31741b61c3624eaf76b5496717f30a59fd2c082c9365a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe584c27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe584c27.TMP
Size 392B
SHA256 da6477c7d78ae6112e3f58c1e97290d61783a5b7af0f6134071d003b24afa64d
MD5 eb62cf7132f8ccb93190c3a03b889fdd
SHA1 ac875f46dfaf563c95a92d6f79bbbef3f57a9b43
SHA512 7ee8dd7b54705b96709129e5ca8762a4edc4241bb52d42972260bcf7d97c86299e88cf37b8e839930a701ffccfd2ac0d37c293580c8d841431486cb1edd2589f
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads