hxxps://www[.]youtube[.]com

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com
Sample260818-e4l86awcpe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315009934209717"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E583B700-528D-4761-AB1C-CAF418DBA25C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{1FEE6949-0723-4B14-BA1E-FD16D524385F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4872	4788	msedge.exe	85
PID 4788 wrote to memory of 2108	4788	msedge.exe	86
PID 4788 wrote to memory of 4712	4788	msedge.exe	87
PID 4788 wrote to memory of 4712	4788	msedge.exe	87
PID 4788 wrote to memory of 4712	4788	msedge.exe	87
PID 4788 wrote to memory of 4384	4788	msedge.exe	88
PID 4788 wrote to memory of 4384	4788	msedge.exe	88
PID 4788 wrote to memory of 628	4788	msedge.exe	90
PID 4788 wrote to memory of 628	4788	msedge.exe	90
PID 4788 wrote to memory of 628	4788	msedge.exe	90
PID 4788 wrote to memory of 1056	4788	msedge.exe	91
PID 4788 wrote to memory of 1056	4788	msedge.exe	91
PID 4788 wrote to memory of 1056	4788	msedge.exe	91
PID 4788 wrote to memory of 1440	4788	msedge.exe	92
PID 4788 wrote to memory of 3360	4788	msedge.exe	93
PID 4788 wrote to memory of 1440	4788	msedge.exe	92
PID 4788 wrote to memory of 1440	4788	msedge.exe	92
PID 4788 wrote to memory of 3360	4788	msedge.exe	93
PID 4788 wrote to memory of 3360	4788	msedge.exe	93
PID 4788 wrote to memory of 2192	4788	msedge.exe	96
PID 4788 wrote to memory of 2192	4788	msedge.exe	96
PID 4788 wrote to memory of 2192	4788	msedge.exe	96
PID 4788 wrote to memory of 2600	4788	msedge.exe	98
PID 4788 wrote to memory of 2600	4788	msedge.exe	98
PID 4788 wrote to memory of 2600	4788	msedge.exe	98
PID 4788 wrote to memory of 4856	4788	msedge.exe	99
PID 4788 wrote to memory of 2256	4788	msedge.exe	100
PID 4788 wrote to memory of 4856	4788	msedge.exe	99
PID 4788 wrote to memory of 2256	4788	msedge.exe	100
PID 4788 wrote to memory of 3512	4788	msedge.exe	101
PID 4788 wrote to memory of 3512	4788	msedge.exe	101
PID 4788 wrote to memory of 2284	4788	msedge.exe	102
PID 4788 wrote to memory of 3332	4788	msedge.exe	104
PID 4788 wrote to memory of 1708	4788	msedge.exe	105
PID 4788 wrote to memory of 1708	4788	msedge.exe	105
PID 4788 wrote to memory of 3040	4788	msedge.exe	118
PID 4788 wrote to memory of 1680	4788	msedge.exe	119
PID 4788 wrote to memory of 872	4788	msedge.exe	120
PID 4788 wrote to memory of 3468	4788	msedge.exe	124
PID 4788 wrote to memory of 3468	4788	msedge.exe	124
PID 4788 wrote to memory of 2092	4788	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,757748409311436017,8305109354937199256,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16835485825219492096,10531173328476721198,262144 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,4380949238467946168,5434793714700209414,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15619795785876484724,6961270421736534579,2097152 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,12815895185328651687,14878794212455337161,2097152 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,3116624558338094794,3990046102625108590,2097152 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,5547630405014191919,10348135171775268404,2097152 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4864,i,660786879431853422,15105502637677718498,2097152 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5248,i,3427630354457572205,930884374614867472,2097152 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,1191050493886772026,2242169723622221657,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,6401712950834835346,14424218447661607135,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1712217231243289588,17137484282986312990,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5861670312608408088,12709522440940446007,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,5908106933309365196,16032080567174204590,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,5908106933309365196,16032080567174204590,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,15738891841571362452,6944783803411742478,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,8744492966893062239,1018483633728292699,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,6961787224860858795,14433785777646142126,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,4773243634345332163,6647103509039189879,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,10353302182240526880,1595888891833018936,524288 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3728,i,4915408311445923419,9155427223353914399,262144 --field-trial-handle=2220,i,11262660300167288311,6541299534692557403,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 204d321e40046ac72752b4b1c93dc25645c3b49772796f4b3efea3d702f5ca76
MD5 0ce23ee8d418cd5433c15450c37b9cf6
SHA1 ed0130f8f7841eba88bfd65ae76827dadf1393e2
SHA512 ef01e40eb9aa2436048d97f84f65dbc46bafd3d13178bb568c8d34103c6578d9c27747d84053556619692926f31ad94ced03b82e77f20ec01a7a9f2e3540484f
TLSH
T16081B67A09D32271EF158233A8DD055D3AB3C6F7FA179E8A90805D37651231EB3149AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58969e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58969e.TMP
Size 3KB
SHA256 3721287c387d9715e37a8894b3810e0e6ce2e1daea1c372cf218c4d0189eb3c9
MD5 db1da628fa1a2f5520406644d452b3e9
SHA1 49110b3dfd46e5967a6283359da1acb571098b9f
SHA512 fa663e532c1a50d2840b33c3382f02e42f59241a67ab1d7be57f09538c983c66f32b1ed5a4d5aebde7879de69c0978d17ee66840416c088b5824e8cfb0109d0d
TLSH
T11C61C5750A9312B1EF14C63294DD025D3773C6F7FA1B6E8990805673761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 84KB
SHA256 ec474c44774a6f4b3ac4514d3b7a4a1b7d60f0caad63b44d9ee274b3dbc62ce7
MD5 955c4ccbed8b8554bee101423b67991e
SHA1 ccdf60cd6ec69eb02472ad14fbabc2d56c1388f8
SHA512 36cd6851184ad8e450942c660f3c123f9ecdeec82e704be9779eadcb7985e5cc360b2ab44307b7b2f71cd31878be7a827a9fc91e293e727e826d6be8b1d67d35
SSDEEP 1536:72OSc7R6auuF7sFv5AEibLBL690lnm85758Rl+R3Hk1:72OSc7R9sFv5AEibLBL40lm85758H+RU
TLSH
T19383A22F09D49AD7C619C1F248260F965B7A2D056CD8B0EFF4C6776EF876A900631E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 bd77255f875ba94528926d83e8f1f88f10c5ed78b1dd7849c91c35a41770f941
MD5 9e63a5758485ea2f0334849d72f0b2e3
SHA1 f9497bf20e5432c84cff07352b7e701b8ef5cfa8
SHA512 463b4b706ee831f62ed84aee3e73b4c9265a5bfa2e699d417696749d45636d70895b68f9db80b34e869c7cb92586619e12b69ba40d7ffefe1e87d318d8155c63
TLSH
T1EBE0C02C88D8C61F715023DB24357B0ED1A7A10ED7CCFD820F89C814F08A04CD07E190
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f6acb4f50623d34ae80966d104e892800943130f4fd9a76fe59a5438c9c7886f
MD5 7699217d20f3178a354d7a93df9a02e8
SHA1 599495a7a1eea0ba65826be1099ddfac0f50014f
SHA512 4c3e327110d9d15934b16370514f162a560a3319430203fada3df52e8e4dae456e83c581675aae902377ac7aa1630b3f73deef7629c06b139899b0496fd59a06
SSDEEP 96:DXOuAVuGuUu3uhucFEeuwHzcuW1u+u5GuJufuUE5ugPugeuvrXuuuPOwQ:D+BBtAKCe7YRDxIaG5rXe2rXVpT
TLSH
T1ABA19CB7C3D4822DD81116F4A6183D1BDE6D0D2483283C6AD9E5BF4BA3E6071E241A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 617e374da4898485481aac076f511080b35f3893408a2ef5c9e9874f46a0fb3d
MD5 ca5ed84c8f698c10dfb4e80564d67676
SHA1 4d84d0786fe3b03abdb886438f70529091141b51
SHA512 66c05e486efc060070fcb456261b120ac7bc69ea81c16939e7df4ba6f074c3eaefb75307cc3b1d4b37994ded21056cb541f2b4effe80d75f9e5184c5f917ba88
SSDEEP 192:sxZtJ2xNROFyM/jK1Ml8UQpkexk/f+Fse+atCVOxKIdpitfzYtYtpHW6+WNntB5H:sxZWeqqN/fEspaf+Hbw//w1
TLSH
T11D52C6126A345977CCDBE649F991BB57E6F54462D2900E84AEFCCA1C04E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dcea4ec2093f930bc3266597633f40bae1c1b8fe1795696eefb48efe75772316
MD5 cd8d55ffaf62f8667471a06b367ca0aa
SHA1 9774f4a3a64b8fedf2788814374fc6a82eebb5c1
SHA512 fead04b73b15a7ade78348691545633b7a453c244fc61dce992cabc88855ad0c362b4e741e6af31c810e2f145f855afadc220819466bb045cff1ac489715e295
SSDEEP 192:sxZtJ2xNROFyM/jK1Ml8Mkexk/f+FsEBtCVOxKIdp0tfzYtYtpHW6+WNntB5W/Yo:sxZWeMN/fEsEBfUHbw/0w9
TLSH
T17652C6126A34697BCCDBE709F955BB57D6F54422D2900E84AEFCC91C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3e77857a7c4de3e8a16cdbced09b8c4310b06571fe5e12f6e2b640ead99430e0
MD5 aa1c8a0c0dcf53f3da3dc31dfb19340c
SHA1 b6ec90595a3567192e7559ab482f08a38b6f0048
SHA512 1ef512ae4c049a1e2308c5f69138f6966045341b021a5e2475970df8e170e3b580dca9c8054ddcdb630a7a930567e76d37a54c58f5a53d66ae8820c5fc6ba6d3
SSDEEP 768:DLseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp0rodo:DLseJ3xWvhfynu1jaVcL88pfu
TLSH
T15ED20B2B680CCB7E4F844E5CEC266F966EE801CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eee9eca0-779e-4ccc-b892-3a15b7bb5ead\index-dir\the-real-index
Size 576B
SHA256 63228f9a02d60bb52235af90c0dd0ba4df87e59d81c1e2fb5174412fbdd7d5d8
MD5 87da85d711dc6a3ceb905c7535685799
SHA1 bdb3cfc19f4a6b937bf8954619b9d2f9c53de587
SHA512 5852251732582874a02c293994ebbc9d34444006dd47692ca27f4f8d1504f498eaeb1b226857f90cd8edd291a3b49cc8aac93de513e10125facf437b866330fd
TLSH
T135F0ABF26AFD3886CF9AC9300E2E058056B4F9AD0B81B18B209444A7F97B7414EC9E20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588ac6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eee9eca0-779e-4ccc-b892-3a15b7bb5ead\index-dir\the-real-index~RFe588ac6.TMP
Size 48B
SHA256 d2c7e6e0485564b0ed5720630323095d67d78d057dea30de6c7c94825d4ac86e
MD5 05e3189f89fa5716df7ab249b4002780
SHA1 21215675f724d98f985b94061e3f330228543ef2
SHA512 85396f1a1ce17f0aec72d001ee90996cd8af1e6c6a457e7e798e213334a30d4f013ce9ad6d3c8d1309b1e659414bd0b52adba9ce8b91a47520931e4e6221f5a1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f62abd67-2114-43b4-a095-484bc913c78f\index-dir\the-real-index
Size 2KB
SHA256 f154ded2718aa61a0f371afe40db379ab91c9670c1fdec7234c6e308dad07678
MD5 414d0d24b36ae7229f586aa4b0a14691
SHA1 1f2f0c3548254f18513625c003553e69f03caec2
SHA512 5073f3a413eed26499f536b09a455928f9a091d7416e7c7fb3ab2fe1f9188095f21baee77870e3322ea5c9f2c4dc2515e5ddd013c10a2ed6b6a992c50fe449a4
TLSH
T1FE41458CC894B7ADEC7551BA2DD815F257752D38FC18C29245A4B1B534033B41B475FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5881ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f62abd67-2114-43b4-a095-484bc913c78f\index-dir\the-real-index~RFe5881ae.TMP
Size 48B
SHA256 f6ad008b1f76a78e05e2320339d2fa9ce309f81363ea2bccb14674225ca7d8af
MD5 e3a16ac7e0a3b8f71f1ce96a8d0136e6
SHA1 c6760a096e6dd4de1ee7332790e9bda123bb4657
SHA512 891c95fb270c8128266854a9d5eddde5f8bbc3d4ad231deb4a821a214b43763f85028c5a432e11991fd449d6770600b60e1fc690fae3860d13d4f00ce85afd71
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 4fbf888d1ef0b2186a8a4989f2817cbad4e3c636db1e77a64a9277cccdb4ec06
MD5 5ff6bc1a7ad0fb7d3b73c5b74f7f82d5
SHA1 776111e6cf52825fc89899db5296ac07ef766421
SHA512 2ec8c78086ea4874f36c7a432c8fe471af978b2ed857e2c1c5fc182149be77c4d608f8ef45213cd60d423d1c27551294d57dbfc4b793152e750f67bb47b2ce91
TLSH
T1AFD022CAB0329B821B30AB852435958E9D2E4D0CCC84C8F4F5B8B19278FC727C00297A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 c802a5e32e182f8f5ed33e0c8ed464c763f39c7f828fc8be1b5bb39483f35f83
MD5 00747d74a1553d9ff09b1e7be311e2b3
SHA1 fdcabe36d99c9ab1611dabe050df03d678da2d3c
SHA512 3d9f3ef5e4abdef5706ed7cb152e9449b4be0df6517fb7f95d8963825e45e13476d6f66f397bb552840c01ad618e7484bce5e0a77d1f43cf926e07c0bb102658
TLSH
T13CD0A7877E6116C50A349FD53074F26E961E8F8CDCC4CCE8A1AC7110717CA17C050E35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 3eadb186b0c58f9127b285d35935316cef12582143300eb839fd1072b63d736a
MD5 b76180f46faba1b214bbe7b11c5f16f0
SHA1 ec67d4db0699f67641593cc5d422c9f1b9aa4102
SHA512 37437544a445debcc15e9400defe58f1feb03a58dded566791aa3ab55e7969628b496afc50124811796ffdf700f4153dfe636b4a9a475a4872db86e83ac74ee6
TLSH
T1B6C09BD7541057C64734AFC92075675ED51F464CCCD4CCF5B05C5101747C6178402975
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 7d806876ecd0e2597d4346a87372f347700d89dc448ff282256e9555f6e9e8fc
MD5 a65ecc3a40d5757e01398f2877e31f0c
SHA1 22393a8f52563e5878e088cfa9232b9e27b55863
SHA512 1926186862190f78f05924a82adda8b43e4f920e67143fd6a663aaf36faf6dd18a3e3e3eed6d8bfc4841b7741d83db8ecd3f1c6afbbbd7b3145f33113b413cd6
TLSH
T1DCD0A7877F5216C50A349FD43074F26E961E878CDCC4CCE8A1A851107168A17D090D35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582cd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe582cd7.TMP
Size 137B
SHA256 b081031df2f7cedd16af3cb9c849b6e8e253c415056e382737b86d5eeb8a3701
MD5 f74ff3467245f9be3182e6211a0847bb
SHA1 094a40c82520ad2acd5b8bc31616cf6466a9d79a
SHA512 af9dc37b516709a54de25b9333486261acb898a835527a04a2d6dbe17a592d4d16382f3a06a9dd03a95682430b92bc5331d867aa2624fefe6ce461cde1c09008
TLSH
T1C6C09BD7542057C647306AC620756B4ED51F4D4DCCC4CCF5705D7101707C613C401975
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ad57a6a47cc8b402c0e7db3d277ddcf33d020b5643c6c454f6ea99b946fb1c74
MD5 13c1d2893d680db48abfcf9f4249aea7
SHA1 c5c7802c64b5613ba77b73552b59f28d1f02631c
SHA512 ba9394ad20ae2fe71e2ed189417441c1227749eb9fbb679a32602cf9e6224a32704b535064ead0326632cf91d88fc2a5229458db22025ee9a50998bce44a7e88
TLSH
T146B0029F2C2C5893C83E077A918509D8713C5C612B9B1723B7F900F4C9BFB55851A0BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5882c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5882c7.TMP
Size 48B
SHA256 4f4f52e836ae9a08e79c21f795b8ee08136b6076e009a0527462ff19884e04d1
MD5 797c2d011eeeca58bf4e079ee150ce65
SHA1 720363582af34166b75ca2fb779dcc80b37ff8a6
SHA512 37b1f2457aae0b9aa497571b6da861f06fd3be79fd70df1f0c2ac01168b209384c68f377413ec49874edf9b61dbb5a3527a68c3af21dd0aabb8dfc8a1d847228
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 766e4ec8ea86e8d20b96e3aae132d61dc7a5739584c3f9194b21623b5caf0517
MD5 035b2c09eb3a689ec6f9e9f8b88534f2
SHA1 65b18f7576036de960b1147055474fbccae5bc08
SHA512 08ed460121976839503d9ea50be72c8a3047ada2fe69c3ac628610292947f09f4dd9c7f9bca9b9c1b1eed1b97a59e670a9d26c3380b26240b34ab483b8f27dea
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1El:KYHIhKggkXySdIxK+cMjy1jIlK0UYLyr
TLSH
T11C914382347B12053C7E294CA2A696364E4131A37499A5FFBFB800551E6BE124FFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5910b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5910b0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ba02bfaeed83f1b74c9b097eb0235a22bb8888b69edef5aba235e4c2a63ce924
MD5 c9fa742518bb47d5be05a62ef6340377
SHA1 715c5b6b91654ff92435165fad4cae7fefe0af0d
SHA512 0b451ee9ca715368754dd9a6ef1161da520438fd4ce38785171b594ecf1f56c817616298fd2852959115c931f27ef56424ad1d58c7d1a6060c4424f909135a43
SSDEEP 192:ug2ym+xasuheOwQxMGsNbB08dQTsMKoM7fwU+PQmiU1tDtCErf4MTobWCIK++Wy+:L6ZcIhsNFrdKK57aRv0zFIKPl84Zt2
TLSH
T1AF626D72AC745C3B6DA7F645F48A32034FF8C027E6C49B90E9ED6B2E01DA568030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 3a384a3c3534d294c56eb0f9e959cf3cb34f9f1372e020637d47d073215e688c
MD5 5f040c4867982200423fdcac4369da37
SHA1 4e95beea3e2b12e488ea014e8ea10817da8e2881
SHA512 6ac0d6a8622a1c74dac156b7a164310fe4a3b117c10238703dbe97b445a4a369d6a6031e81f57458aecae4e878d86d861fb95b419804db5a2357287a808d4f0e
SSDEEP 192:ui2ym+xasuheOwQxMGsNbB58dQTsMKoM7fwU+PQmiU1tDtCErf4MTobWCIK++Wy+:h6ZcIhsNFSdKK57aRv0zFIKPl84Zt2
TLSH
T1A4626D726C745C3769E7F645F48A32034FF8D027E6C49B50EAED6B2E01DA568030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 20dd4f3ede18bc15b7d2b57fd2a12fe223a20809c32dd494915abb451b94f83b
MD5 d7017f2d0016da0dd54af7cd098e4b1a
SHA1 0c94c102ca029b4781fee8e4e3c17ffaa9815915
SHA512 ea2cca79187304da6133a398c004d0825cd55bc98a7f1b30a22c32053731d518c6e00db1c2bfff7a55600410f508ae52694bf7c3e60e237bfaaa7f09f4acd839
SSDEEP 384:pNiFiZcIIsNf8TUNTUlIlSdKK57aRJ0zFIKPl+4Zt2:pEFQIawg075KmFxl+4L2
TLSH
T1C9B21AF35CD7883AE9AEAB43A77D2E024EBCC067B5809650B7D85A1DCC9607FC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cca1689f6541da8986ed2e8fba45955718fbf9b857c64db0449367f60b38b07a
MD5 521dde5f1e9b154547372a0eb0c9033a
SHA1 dc29f54efbb3f5920911628b4f164227dedf3fe6
SHA512 183b6e1431e3b3c81bc545eab317b004e8bce800231ac8a107d884c747c972c7ac8cc8297724d900db4eabacc56a80f69fcc9e69342c867adfba00e243a16764
SSDEEP 192:lONG6vMtPQmiUytItpThTobWCIKp8478cLU/u:lONG6UtRZTiFIKR5U/u
TLSH
T198021836BC686C7B9AA3BE45F48E23131FE4117BA5905B40EAE82F1C00D765C1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6707a0d1eb45822497145c8050e9648ca6e2959522884fda38150b7ebc81c03d
MD5 edc41239c9075730982cce43042951d7
SHA1 6835ce05af11d2fa1b39a0f43dcf0de4c1ce042d
SHA512 430eb66c7ed5b676e68599f09fc2a14b2c24c5d12db68ab9c43ed6e8d16b34d3b708948b936f81f175b4b46b9631825fa76a0fd163226a183c0cf5688e46120c
SSDEEP 192:rgON/w6vMS+PQmiUytmtprQhTobWCIK++Wyir80I8hqeU/u:8ONI6URRFUiFIKPlR4U/u
TLSH
T1CB121972BC649C6BADA3B551F48A32131FB4826BEA809B50EADC3F2D01DB56C1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 85c38fcf95d4c89f6fa0110c465c5d58b1185c741b8e777d35f54e7ee9d5edf0
MD5 6c7c8a2ee5da733698eb6cb07940030a
SHA1 e7d8cbdc0890584a8501e0904eb8f3ce8d1863f3
SHA512 d4edb2097be34d864fed59eb5fcddc4d9891967dbc5298eb11d0e4bfbe9be3715d1382ba35870f5e132a48ec8652d8cd4828a448e7b3ba83e03da12e907a9dd1
TLSH
T15B415B58B6E91058B3B76E5AAFF7A86D887F79772E0AD56D00110D4F0A36B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download