hxxp://www[.]youtube[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.youtube.com
Sample260818-e4frdawcpc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3568	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315009754524622"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{78FD5615-FD43-4A7B-ADC2-2C10CE353AD6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{886F1F0D-8154-41C4-A913-FD3A5D8641C0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 1468	2768	msedge.exe	86
PID 2768 wrote to memory of 3568	2768	msedge.exe	87
PID 2768 wrote to memory of 2904	2768	msedge.exe	88
PID 2768 wrote to memory of 2904	2768	msedge.exe	88
PID 2768 wrote to memory of 2904	2768	msedge.exe	88
PID 2768 wrote to memory of 4676	2768	msedge.exe	89
PID 2768 wrote to memory of 4676	2768	msedge.exe	89
PID 2768 wrote to memory of 4780	2768	msedge.exe	90
PID 2768 wrote to memory of 524	2768	msedge.exe	91
PID 2768 wrote to memory of 4780	2768	msedge.exe	90
PID 2768 wrote to memory of 4780	2768	msedge.exe	90
PID 2768 wrote to memory of 524	2768	msedge.exe	91
PID 2768 wrote to memory of 524	2768	msedge.exe	91
PID 2768 wrote to memory of 2172	2768	msedge.exe	94
PID 2768 wrote to memory of 2172	2768	msedge.exe	94
PID 2768 wrote to memory of 2172	2768	msedge.exe	94
PID 2768 wrote to memory of 980	2768	msedge.exe	93
PID 2768 wrote to memory of 980	2768	msedge.exe	93
PID 2768 wrote to memory of 980	2768	msedge.exe	93
PID 2768 wrote to memory of 3776	2768	msedge.exe	98
PID 2768 wrote to memory of 3776	2768	msedge.exe	98
PID 2768 wrote to memory of 3776	2768	msedge.exe	98
PID 2768 wrote to memory of 4568	2768	msedge.exe	99
PID 2768 wrote to memory of 4568	2768	msedge.exe	99
PID 2768 wrote to memory of 972	2768	msedge.exe	101
PID 2768 wrote to memory of 972	2768	msedge.exe	101
PID 2768 wrote to memory of 972	2768	msedge.exe	101
PID 2768 wrote to memory of 1104	2768	msedge.exe	100
PID 2768 wrote to memory of 1104	2768	msedge.exe	100
PID 2768 wrote to memory of 4300	2768	msedge.exe	103
PID 2768 wrote to memory of 2504	2768	msedge.exe	105
PID 2768 wrote to memory of 1520	2768	msedge.exe	104
PID 2768 wrote to memory of 1520	2768	msedge.exe	104
PID 2768 wrote to memory of 4692	2768	msedge.exe	108
PID 2768 wrote to memory of 4692	2768	msedge.exe	108
PID 2768 wrote to memory of 5052	2768	msedge.exe	118
PID 2768 wrote to memory of 4428	2768	msedge.exe	119
PID 2768 wrote to memory of 4920	2768	msedge.exe	120
PID 2768 wrote to memory of 5040	2768	msedge.exe	124
PID 2768 wrote to memory of 5040	2768	msedge.exe	124
PID 2768 wrote to memory of 3572	2768	msedge.exe	125
PID 2768 wrote to memory of 3572	2768	msedge.exe	125
PID 2768 wrote to memory of 4640	2768	msedge.exe	126
PID 2768 wrote to memory of 4640	2768	msedge.exe	126
PID 2768 wrote to memory of 3740	2768	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.youtube.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff9095ac188,0x7ff9095ac194,0x7ff9095ac1a0
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6288689206296479179,9793312066025079297,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3313401853325467602,2118090235333952999,262144 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,10069120390200495505,5142703332766228526,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,16131953462331088185,12500270778065008464,2097152 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,421453137680550913,10721872597990961826,2097152 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,7236239682094071923,5959492276540539546,2097152 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,11817733193761136646,14407724289722213940,2097152 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,7210947897652328773,5205485538741736748,2097152 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,10043496751847927664,1294057901439776514,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,459069823390410305,16447713537389923255,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5444,i,6562435662960639544,7877008766899164008,2097152 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,892745884224214387,10188016958652051163,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,892745884224214387,10188016958652051163,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,15182961638064177977,5251049809790682150,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,432091795927368970,708361880725152831,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,1773528606268860802,780961577825790908,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,17072311081866108837,9606256688610766526,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12844696723001223847,17952897974886412485,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,14062121000978098556,8668400662127457502,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,16856965369437777198,17116025684365841424,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,16606264768719387957,17349669598752271732,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,10729718274068225595,12815951365879789777,524288 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4276,i,4062882092273294064,13591893701835365908,262144 --field-trial-handle=2180,i,11180601134576695630,8733364514518054965,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1513b6ab99453931663ac36b65717ad29b977858e57d2fa24179739f6f194435
MD5 906d8a8e37c605d15b747b22abdeb5f5
SHA1 2e13ea9b15c15666da9d7e0c0cbb77faa6d2eab5
SHA512 f3d3c0bb7e0103489baac166a4bda53d28cffffa887e29021898b835f6d9fdc22afe3ce4d4a986766182d67527f4659e55cf9a2de9deb98885ddd9de9c0b439a
TLSH
T190E07DC41CE8C22EFB446657636D430CC2C03A4BD3C9B9CB1780A8C8BB83644B2D7AE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 574f8da3423f760b690fac7b7fbd521716b99889f14812eef888194e64162757
MD5 b0901451c59ed039ae59bca134b6cca0
SHA1 c70d178df355016860f686076f4adcd39e9c9d89
SHA512 511bc550aa10101840fa338724bb826892fed0a23b37b8886b95045d565617f57f1ff6d0978294d96ae3bd5d54728341b1ea85921d7a8790a5688e6594282b51
TLSH
T14281F7324087DCADEB1D01726CD081FB34718DEAF957AECB91BC2E795D22B53B15A188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd9e.TMP
Size 3KB
SHA256 c078806f97581b9f3bb18284ef0e69635fe0f18c7e721979ee7298051c458513
MD5 c2a4e62d84a184c496aabfa1291f38f5
SHA1 a617ec1d72014306d538dc8618b67e7707748bc4
SHA512 e0b32025fd979bd08423761360d2acad2446580903da325e0702a952e680c472808319e2cd7455b03d668dc7e01d47978610903b7b0699c58727df18c8c86d7a
TLSH
T19D714C360087DCAEE71D00706CD181F334718DEAFD475E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 86KB
SHA256 9a1782fb2b3a69a4d4755343d91da19319c9181625f4feeae03f3cdc8e2ee61a
MD5 a8b238be139032d0f88b54c047055bc9
SHA1 92b4345a2677dced78fcb9d0b0889c925cebb14b
SHA512 58bc3fd6bb9350f40029568be9a1a8a00590fc5ec56f477edb80d481dc8512de7ed85e67d5eca23da92a3d12e15be6a15649b29e41a616f4e439cc251f5a7056
SSDEEP 1536:7h2eq40GgW0iEacgzuzRixhR2W3fV+w5p5+1Mw/HRPirKnuTuuQll:7h2eq4LEacgzudixhR2yfV+w5p5+ywZV
TLSH
T1C883C32F06D49AD7C619C5F249260FC55B3A2D0A7CD8A0EFF0C6772EE876A901631D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 d444939bb42853f43d3f23e3cabbdf65e5fb3b1f71d2a8ad30bfa94d737776c3
MD5 7f6f484e356c77c226f7a40512b0bbc9
SHA1 a372602c8713ebeea8c4742d6aa60c05bc6f2d1c
SHA512 3d18ac597d9368c84be6cc347be33d3f6238ef7119d3540eef0c1aa9125219a1d1e36ccea1561582c3b703e701c99ed458799487decf2ed62fc0d890465cf4d3
TLSH
T16AE0C02CC4D8C36F315020EB20347B0EE1A7610FD7CCFD820F85C814F147188A0AE151
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 29cf01cec878d80b6d720cf2a2289063ab8a1843cadc1b9726e92faace9d14eb
MD5 21236206639efc8764bf3e869536a64a
SHA1 81ede116221fe4018ea6cdc7cbf0b142664ad61f
SHA512 26095dde8bf2f6988a2e0a1896917a83fa1bcf6355de70d837b5ab3f2d443f78d7deb1defc73dc5468c2e103411c42e3a041788f5d7a0cd9be738332428050a1
SSDEEP 96:DvOu5VuRuHuOuMFEeuwMzNu8u+u5dubuUE+uLugfDuuuvrRfuGuPOwQ:DGEm09+eAJHD+CG+yTD92rRfRpT
TLSH
T15E916AF7C3D4822DD81156F4A6183D1BDE6D0E6483183C69D9E5BF4B63E5471E200A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1a1230fb248a42122c46482540f077a8a1d836c463a02024b0b2e3bfeaf5f6b5
MD5 e935535f8f3c9aa879040e9d9df4ed31
SHA1 e23cf240ce3ff80c44d20c020967716a6fcb6c87
SHA512 a471cff68f9bf8d396da3d2d859b243d8b66d657d9e0dec454485c48dff6f47e8297c142eed464ad499c4a7ef8bdba51291abdde8656038f4096263e5a0ebe5f
SSDEEP 192:sxZtd/bROIkeT/f+zsM/tM3NIdp0tJmatItDHW6+WNntI5j/YzNgtYIzH3PIgrJ:sxZLC4/fSsM/31Hbg/59
TLSH
T11932D7536E24A97B4CC7E719BB25BB13E6F54022D1D41E98AAFCC62C05E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0ae9d037e7452c02c027440fa364b76eb56aa3f2bd4fb4f835830cc5ab9147d4
MD5 f3356fde9bc30815e582633ab74feaaf
SHA1 d247a0f294f5f674bfdd6b75d273bb185ff89e29
SHA512 a456fb113cf78e788cbcb763841200030d472687ecd8351aa9f7a75507a00989c26315bd9a62bf385be6b3c71e6dfc8ec822ce9c004965056aff091599b4309b
SSDEEP 192:sxZtd/bROIkeT/f+zseMSCtM3NIdp0tJmatItDHW6+WNntI5j/YzNJtQIzH3PIgA:sxZLC4/fSsj731Hbg/yA
TLSH
T15232D7536A24A97B4CC7E749BB15BB13E7F54022D0D51E98AAFCC62C05E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 80ac028b847a560ba7b89fa0aab4f6db22fe35f62efbfbb24d18b4d337a2fc0a
MD5 d3e9036cefeae05b99cd50d0c2ec43cb
SHA1 738b52c7ce6f03941e3229eff18ff2029a106ddb
SHA512 fe747a5538a3d7b0dfa66385019c8d1ebeef8fcd38ad0dd234c06245627001105de0f9608cf620a0e5267ae58aa5deaee09f972d1018e85b671e1c5cb50ee36f
SSDEEP 192:sxZtd/bROIkeT/f+zseM/tM3NIdp0tJmatItDHW6+WNntI5j/YzNgtYIzH3PIg5E:sxZLC4/fSsj/31Hbg/5C
TLSH
T1EF32D7536E24A97B4CC7E719BB15BB13E6F54022D1D41E98AAFCC62C05E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2412b13cb515ba352678a106a2c317d066c0a1bd9ac0438c07be948d8be78f67
MD5 f754b7c0c6de139cdd14f627675f254c
SHA1 4a3f0a6fd05962c5f09da9dc10a1f78cf66ae7fc
SHA512 eec1b64e550e18fa6ebe1c16c2e1318a33faad799274d902ac9311b10b67f388448ced4ea432a5c3bf0eac62a866b779e2b153e3e79357204aa88136201d46c2
SSDEEP 768:Wok7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBVroyNYr:Wok7u70WvqiEau1jai5LA3BuZr
TLSH
T1D5C2FA3B740CCB7E4F801E9DAC566F977E9802C7A6948D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\01e74323-a883-497a-b70b-ef341193b645\index-dir\the-real-index
Size 2KB
SHA256 f4a79eca1c8a530dfa3d57a46ac0883a483bf56c8ad1a7b600540225974e0823
MD5 e4eb2af8d20a0514ebe9079835fe0d06
SHA1 9a21e449810e489e3bd18cea4d174b414216142d
SHA512 e09cc71c748936aa7b735a6d7b414a371d0a3bd9cf5b912949868c63cb874c712e0c9652294459b36d06402bbbeb8644add402c465e9a97d3e471921bb3b77ee
TLSH
T1B241428CC894ABAEEC7551BE2DD815F257752D28FC18C29245A4B1B538033B41B8B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aa06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\01e74323-a883-497a-b70b-ef341193b645\index-dir\the-real-index~RFe58aa06.TMP
Size 48B
SHA256 b1c4cf39f31b9c5cae27f33aba116ed1780e3bcbe1bebdde6cf35203c5f37f7b
MD5 301e52a214d4bc6e44a602d08a71c19c
SHA1 1d31a85d4a1829543431719f53298d6a6676e4e2
SHA512 0d37710a721ebf48171ca782f422586632c4276ae0437fa41bc986d79cba0ae2bd83b5db90eb1dfa8e685c100b4b0e43d0b5e099cede3a7394d9b6dbdc925f66
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\88460d5a-ffcf-44ab-9510-9fad569645c7\index-dir\the-real-index
Size 576B
SHA256 d6ff2bf79185c89a9f8f9e03a85e90571a648903909a28374da1433310b31e86
MD5 941b868ed35680ec8c8ebf6c9fe572f8
SHA1 d6cfc3f0b103ef94a590ac838a04654bd0b9a0b9
SHA512 44d5c9a84d9064557b70fdbbf1770338dcf72cfb0821bdc35b5c68eb02a0025ef73494e458e4d96b57f008dac7caad1414dfffab77af231021ec2fd900c740a1
TLSH
T1A0F0A3F17ABD3D45DF9795700E6640805574F46E0B8071CB20948467FC7B7050BC8E60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b234.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\88460d5a-ffcf-44ab-9510-9fad569645c7\index-dir\the-real-index~RFe58b234.TMP
Size 48B
SHA256 146b128ae682d4439b8ddf22ad531561266bd403b472b3557d41703d8f477888
MD5 93e57ab5d163925b019147e56c078484
SHA1 312d46abc65e3316f0f2e5955b9f38effca0f8fe
SHA512 c6a038aa6a882d3b6e015f7694781a1a33ac7f61c04a3dc77cb6e0257773d04d38743ab495481e4b5a92db88d1eec8b32fd8446189531d963bffa2790effe41a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 db2a2942b9029510b876f7d7b54c34c2eeaf4449663890d26696af439d89aabe
MD5 42f26d9ac43f2cfa6831eb4b6f42ed69
SHA1 3c59afbd88fb18dc16a40fbc95e8cdb8d78d6331
SHA512 d1df18b9dd2035c1022f9dd143f3c1e72bd2b0fa02b4c4bf130b47beefa783ac4fdfadf9c241cb13515d23b8ade4167aab8a760d8b3c676d466bf34f30c819e7
TLSH
T131D023D557715E5256305B482134535D54675C17DCC5CCF89445B26334FC503C402534
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 88f47b8ebc30f172f04edc1c26ce274a2b48bfd78a494910a30a1e2cf8c61f53
MD5 bb3ee85e44fc218e5fe24537900c16bd
SHA1 7143be06f4d1474fc0d85db4dacda074333451e0
SHA512 c2d19770422a5b29eee5d53186143627f5addaa43de65c84e5ac40f988685f4dff7c2fb7b4b07ecb2e52cecb13fd042ef7673e7be99b5fce645b0711452e9d55
TLSH
T1D5D097E32B110A418A359FE93034B3ED810B6C18DCD2CDA861007111317CA13C001B24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 9472ba75d3bd129631309bf47c8983c9cc9cffb1fcf58e5a9b3adbb14e31ba43
MD5 18ec69fd8bec381376bc398bce27767a
SHA1 349db4f65f70c5e273171b6b5b45abe34bc63139
SHA512 22e202015bfa48252fb1d1f9d56139fc4452c89c187b68f32f7aace1c804a306beefbc4797115f00415ea12df20997cdee825d18eba2e90a7fdb59321a6ae603
TLSH
T176C09BE259155F4789349BD82534A36DA54B4158D8D5CCE46049511270BC5135407A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 7495a8ae19d8013d09cb7b59202d4ace811ffd3cfa3481bcc6de7779e7a66424
MD5 1d5d78b57c9a59c08843232147067896
SHA1 57a90b9c2928380f32f20827c60d942019f4427e
SHA512 d1c0ea8bf59cf6dcf7b441666e5202cfda3aa504e241b3ad99373a731998c3dec49a64807da96bfc5b5cf8fa8a8e6179f82d5f2266b80bf54e57ec2bb006a1c1
TLSH
T11FD0A7E36B520A468939AFE93434B3AD915B5458DC92CD686544561131B8A23D011A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58557e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58557e.TMP
Size 137B
SHA256 129d93e306e23186d5312c98a1b7efddd415da1a60ab04d2fef458b63c5dac58
MD5 ee7495be06185834b6ca89dea1ee95b5
SHA1 9b1c63ea5b593d30c31945bf5c92d3074561a02e
SHA512 ad00d1676ae9fea911a11ad4b03efa9219263225f09db4f9db9f94ef0ccb68e67cbec1c12c4293fa015ad17ee654508cd4e424f0ca5928e8ca7fdbae97e8e799
TLSH
T15BC09BE21A355F47DB3497D52534A35DA55B4C68DCD5CCE4604A7012707C5139406975
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 33c2b09df2cabec6e1632efb054d29d16eb1b53c81f3462dc2d3d7429ec1a063
MD5 dc10a3a4e6d7915196d4f199912f5f52
SHA1 2328c7a82df77a89d9efd3b49fbdc71e7f2b5a4e
SHA512 36579f32831a0b561a54e898d6feac23bfe3836a3e27560d81d9d749362ed88716755dc2caeb87c9b144eb55f2ae144b1468893816990fe2e2305edd25ba3a65
TLSH
T1E6B0228C0C0B00C2C82C033E808802C83838CC003F0A3082C0F800F8CC2BA00C83B0A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aa26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aa26.TMP
Size 48B
SHA256 dc1d0fa3507a541c6a19f6c6c2924f2f3bcdffde37c246955e7aaca914a21fbe
MD5 bcc3f10af13e5320cfb65627517f38c9
SHA1 576dc5104318a3f59e05812cdd85c089296276ed
SHA512 e888c17f16015a307ae9ce2addc8edd9f6e5e9aff01d7bb418e15253671efd5cdaad837782a814973dfb798f53cdab1e17500f8e7acb007002f0dc524a767985
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2627b590dce7ad8f354a56780a4f40fa2c6f12c58d5af8d90f08933f3bfe1bc0
MD5 a498c56362739436c9bb43ffa4bc9a01
SHA1 1a7f086aad0f4da23314454ae99745aba70421fa
SHA512 efb50ba47a3e3a1e71e432c3ce60e5ba29ccb1816faa7515eeef53f56158c586aefbaac43ea7ca4898c9800b391062fba94176bce49cea1059e43f672b0a8876
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcMGTItK0Mgzy1dI9KWG:KIbCKcvNSKWc5TCK0M2+dCKWG
TLSH
T119914105787A16053C7E295C93DB86268E423963385CF4BBBBB844624DA6E134DFCCDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5937cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5937cf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9f61b5b73f2c3b25915fab02df568bf8ae10c80c20396482216fac35978d75fd
MD5 a59659781cafb986cbb7644430ec4a83
SHA1 dea8e99be6b30fea818d5bc17bacd4726a889aff
SHA512 5e449f1669dafb9f20c17e9e9ed05ce09aab055f5a2772f6a56d96ad542061ccd0244c3f96faee132cebd93f1e26f909b725538cf9742b0f60f9187fa1374f94
SSDEEP 384:+ZcIhsNCfAC3beBe7LC9y3ySllYJTfY81FKkYWBuz:8haC32cWSZuTHxbBuz
TLSH
T126929E725C6198B79AA7B141F48A37075FFCC077D3C86A80D9FC6B1E01DB5A81317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6fb705e85d60c467a7b28123f069aefa29f4c9b47e3232683a970b20493a384c
MD5 3a350b65e953a3bf97d6d1f14f4b2a70
SHA1 439e2a51c4ce822a44fb8d7f94af5af6f3f9b254
SHA512 7e09c2ccb4d62dafe3e71f803a82a99e7a0ecf18d4af5639cca2b33c4a9425ee75fd12d55caa851d6b49871e115cc9f23fae7432f419115c97a5966256f23117
SSDEEP 384:3iFiZcIasNa8TUNTUlIl2AC3beYe7LCCy3ySllYJTfY81FKkYWBuz:yFQabwgzC3PcDSZuTHxbBuz
TLSH
T1CBD23BF258D3847AE9AEA743A77D2E024EBCC067F2849940B7D85A1DCD971BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1b81bc93de3845de81e0fc317be43fcc067f0e1880a3195f82f843f9f1c33229
MD5 e97d99ede37f95e9e0b4ba017f4d30dd
SHA1 631af88f447de04e06011cf3d1b31f4bfa2a46ce
SHA512 2c3841669588e70545057501c81676cd56482389d25fcad8673cb6da03418c568257ced601a8c2fe1a4f0428244838e7693b510ef32dfa90c1792b2fa2be90f4
SSDEEP 192:MONx64BAQmiUytS1trW5GBPKIOCHruaD87QjU6:MONx6eAb7W8LL9U6
TLSH
T1F202FB396C796C7B9EA2BE45F88637175FA8113BF6945F44EAE45B1C00D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f325fb8680ee3f86c7e8f19bf6d24056eed314de2a5079581a8d0aeb5155a50a
MD5 65895fdc4976e079b8e727aed373fd0b
SHA1 ddbd3ea769c9a58192631d1fe641fceed24e6a22
SHA512 a42a9c38d0d6bae55c358624a2d3adf5dc58e2c35bd03a627f34f4ddfeece0ea5c64f259db4f950ab8706591cb4c4e5d37bc6638b500afff1cac5c2280b662db
SSDEEP 384:TZcIhsNC2AC3beBe7LC9y3ySllYJTfY81FKkYWBuz:LhfC32cWSZuTHxbBuz
TLSH
T130929E725C6198779AA7B141F48A37075FF8C07BD3C86A80E9FC6B1E01DB5981317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ccd5f02387af0d761b190c6da3cee848cba04624703799ddc7e339bedeb1e8d
MD5 d776646704cc3a60c70e4d6954ad3ce7
SHA1 edb06833893a060ec1802db3b119c71ef085f476
SHA512 fcf58fb078544bb9e60e34443eeea5e460c7d238d8c659c09ae8e1ac23f236f17019a46d421755b8fd0d0c2014a51f9df0ac2eba28fca1f112f4696eb2288043
SSDEEP 192:rLON/D64BybQmiUytdtrrry5GBPKIOCHrWTPNWWw87ZbqoU6:XONL6eY0a8LC0y3U6
TLSH
T11D12FB36ACA5AD6B5E92A541F4C632175FA8412BF6856F40EADC3A1C01EF65C2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c832f4f2-2857-4b89-8383-c6d1b8de0fd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c832f4f2-2857-4b89-8383-c6d1b8de0fd2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca6690397567047f883e3b276e09ce15769a63582066ef179a47829129179b09
MD5 48d8134cbf62a85f78d4e0409282e266
SHA1 eba4a21efa7e68e5668a36f464538cc9d0a4d4b1
SHA512 843e131866477a80b532a94b309fe3216b5dcb0edee57b8cf13ba44c7505232c1c58b43fa56b9a8b2d707a544f98ec5ec74c5ff11ca99ddf7c22522af7963483
TLSH
T121412788A6F91148B3B76E5AABF7686E447FB8772E07C45D10110E8E4622B40C861B73
MD5 SHA1 SHA512 TLSH

Submit Download