hxxps://www[.]youtube[.]com/channel/UCAuerig2N-RZWJT8x75V9yw

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/channel/UCAuerig2N-RZWJT8x75V9yw
Sample260818-pvbfeahc94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315303276313740"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{52DA30DF-FFA9-438D-8FFF-13C44EC08D91}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{D7EAD2AA-46DA-4F14-BCC7-F331042C5015}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4468	4928	msedge.exe	86
PID 4928 wrote to memory of 4652	4928	msedge.exe	87
PID 4928 wrote to memory of 2320	4928	msedge.exe	88
PID 4928 wrote to memory of 2320	4928	msedge.exe	88
PID 4928 wrote to memory of 2320	4928	msedge.exe	88
PID 4928 wrote to memory of 1556	4928	msedge.exe	89
PID 4928 wrote to memory of 1556	4928	msedge.exe	89
PID 4928 wrote to memory of 4180	4928	msedge.exe	90
PID 4928 wrote to memory of 4180	4928	msedge.exe	90
PID 4928 wrote to memory of 4180	4928	msedge.exe	90
PID 4928 wrote to memory of 4360	4928	msedge.exe	91
PID 4928 wrote to memory of 4360	4928	msedge.exe	91
PID 4928 wrote to memory of 4360	4928	msedge.exe	91
PID 4928 wrote to memory of 1084	4928	msedge.exe	93
PID 4928 wrote to memory of 2732	4928	msedge.exe	94
PID 4928 wrote to memory of 1084	4928	msedge.exe	93
PID 4928 wrote to memory of 1084	4928	msedge.exe	93
PID 4928 wrote to memory of 2732	4928	msedge.exe	94
PID 4928 wrote to memory of 2732	4928	msedge.exe	94
PID 4928 wrote to memory of 4784	4928	msedge.exe	96
PID 4928 wrote to memory of 4784	4928	msedge.exe	96
PID 4928 wrote to memory of 4784	4928	msedge.exe	96
PID 4928 wrote to memory of 4712	4928	msedge.exe	98
PID 4928 wrote to memory of 4712	4928	msedge.exe	98
PID 4928 wrote to memory of 4712	4928	msedge.exe	98
PID 4928 wrote to memory of 2100	4928	msedge.exe	99
PID 4928 wrote to memory of 2100	4928	msedge.exe	99
PID 4928 wrote to memory of 952	4928	msedge.exe	100
PID 4928 wrote to memory of 952	4928	msedge.exe	100
PID 4928 wrote to memory of 4320	4928	msedge.exe	101
PID 4928 wrote to memory of 4320	4928	msedge.exe	101
PID 4928 wrote to memory of 3520	4928	msedge.exe	102
PID 4928 wrote to memory of 1292	4928	msedge.exe	104
PID 4928 wrote to memory of 4496	4928	msedge.exe	113
PID 4928 wrote to memory of 3104	4928	msedge.exe	114
PID 4928 wrote to memory of 2468	4928	msedge.exe	115
PID 4928 wrote to memory of 4480	4928	msedge.exe	117
PID 4928 wrote to memory of 4480	4928	msedge.exe	117
PID 4928 wrote to memory of 3160	4928	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/channel/UCAuerig2N-RZWJT8x75V9yw
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf900c188,0x7ffbf900c194,0x7ffbf900c1a0
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,5171473212558510766,9013308492888680256,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,4962676103248317814,13803152937607367252,262144 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,11428006112913307373,4624280066739372818,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1766298246212295086,5118520021173459915,2097152 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,13851374401186236793,8425509919439891933,2097152 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,10429288329663700600,5820188910962205591,2097152 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,15550594418896330893,5743374076038303484,2097152 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,17508480107148010652,12315571398426400308,2097152 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5264,i,15814888096922960720,9122688051186146863,2097152 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6868201218267246808,9870495760343797343,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11937215280181507942,5142103734910302591,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2329526357859514741,430550241100727555,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11559142144004958167,4934706461263266084,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,2353706510010275533,4629707034339232878,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,2353706510010275533,4629707034339232878,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,11595137978207503507,13840317841623992997,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,8916393366160111160,6448919369733008872,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,6787043348579889224,3024907864977617227,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,703381448940973680,6120638547211753378,524288 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6416,i,9478294781635943119,2319228601007115626,262144 --field-trial-handle=2300,i,7154564135539564396,9368867149990190017,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2e24e08605c7cfca52b6d268d14d7afc67a5d9586b645c6f44aa25690cc0e303
MD5 4f4cd3ded1d1752b942c3addbebf89ca
SHA1 5fc0017fc251880a23bbf0593cb282f9a57583a4
SHA512 97c207a1b02c7e1049bb472d38ca09950697a0b231fe72a08ac3be1dbffb50841a7a605c2c037794a7e6a9554e1f3c8a08fff73a8459871d52d522effc66ac0a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 520fe8feccc200023d2aa9dabab4aa47a3ae043da961248c637e0b50bf9942f7
MD5 1b54f9c731503c29574f7f9e6ec3e5a0
SHA1 4b03a2385b6555cc4eca03a29d95e49501825b0a
SHA512 f1afeb8dc731d21f5950699640796af444c6f0fc5e7c326714af1f7b0595039d4fd7712d73c0454bd4dca8a638cc8aa8a9c32368d987116d4037803991ef233f
TLSH
T1DE81C5476E9B0CD1F3708FB1DFDA0A38707468A60F0F2F465152A8BD28363505E2D52E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588076.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588076.TMP
Size 3KB
SHA256 8fe51bd08621ff0e2698fef1400a29ac96ce2539cb6af73f0eeb328f2e49a789
MD5 5d6b80079458a38219087d2b028a16ca
SHA1 6fdd761e92c18f630119655a0b818c022a800c6e
SHA512 f237fdb59ab52a20120a31ced63f1b15f9b667f763811d9801886691a8cc6cc13a499cec8d9f2bbc996084e41f0293ad562da9d48c7fc0ae0b81065e50973bf4
TLSH
T1966160472E930CE5F3708FB1DFDA1A383074A8A60F4F2F461052A4BD25397249E5E52E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 202KB
SHA256 1d83ea23c98cc047d8762cdae455b98d530138c946d048b7393ef0f03e8d7a62
MD5 04dc6d07bd9b444c8c7ad1dcbda80a03
SHA1 9df11557c82273cfd88833c0559a6d7c0f2ba1ee
SHA512 9dbe60dcb979943b2667d8d7fec89932d5a159eda0c66ea9c4401b86a002c98fb00f979a962a207daae531dbc0331eb0f28c887dbd2f3c5cbc9085aaec243e42
SSDEEP 3072:7ZbodyDr2kinB+PQL5VzV/GiJzy2HwnEAbczt/GioDKUSXV6N1J1LZKfV:gkeuCtfuy
TLSH
T10414C61D31E6D2D5E56EC37307126E06D335AAC8A6897099BA723B4D36F7B403F24329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 5965da32709026052c4c0c51f70f7508905014cc21288471934da12ae5b269f8
MD5 69d31e750099833767ee014808614a54
SHA1 abf04c71bb653d749797b419ea1b36372e6fa6f4
SHA512 466da3d2dbf9e1e8ce60048ba94a96641b53780362003ee1758189aa20337e15ce41929d6e4d778ece0f9fbd5299f116fcef9057274efeb96f09894fc6dae347
TLSH
T103E0C03888CAC52F116021E71530BB0DD697AB4ED7CDFE670F84C824B446448E12F1A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 42477088d9d45596295ddafd964d5410c924d6af48ed584dace1c41015b35099
MD5 f81b4c62b5dc04e2fcf65d22c11cf129
SHA1 de83df2a1448cb4b85a767cf7739015e47146585
SHA512 ff11588f6bfe54093ad9d78464ade860d062017e1de24b6dae4bf2013c4516bf61430441cff43ccde3001a8509d5048af6ca9fe4fc2b0e44a3295e687451c04d
SSDEEP 96:DuwVuKuWuRufuQFEeuLu8uXzfuOu4u5quUEK5Vu/utuTuqVuIug/uvruu7uPOwQ:DZ1j2qKeYNKjLBpGKvoyGZVDj2rukpT
TLSH
T16CB1ACB7C3D8C62DD81116F4DB583D2BDE290D6483283D2AD9E5BF4B93E5431E205A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 044ae2ca907f207ebebcf53f6fa089af61d8c14894bca9864016ac4684d1d015
MD5 aded935884e19863db64196c5e87d9c4
SHA1 9917e673588099f52515290514aa70e5a68edce1
SHA512 8b61c2304094bdfe5fc002d8310af6f90342c5cd81e5fec2103e10f934ffcde9386efcd7cd93b19c940662c3a778e44a46e8cc9f944a74c0e16d5b5c190a7b7c
SSDEEP 192:sxZZR8yM/jK1Ml8Mk9/f9sj8ybIdp0G61HW6+WNnda/YHQoHcIgrJ:sxZZmM9/f9soyEkHbI/19
TLSH
T14652FA126A345977CCDBD309F951BBA3E6F5447292A40E84ADFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 aa8fe38055c4edd62d941a72fa1f3fa25afa46e8f05f2ef7a55247750496ee7f
MD5 e77bd71ada823d137fe176fd94915d07
SHA1 34979cefa511b5f9ddc16d913224ff33634c23ea
SHA512 ebd6d093607e2eb29d1afb2007ce6a0cf7dc4f37daac12c1dfd127f0567bdd71fe435372d9388cbbc788ee84e3bd0fcba11ada7bf069f6fc6ccae5731947bc1f
SSDEEP 192:sxZZR8yM/jK1Ml8UQAk9/f9se8BbIdpiG61HW6+WNnda/YHM/scIg5KJ:sxZZmqT9/f9sJBEOHbI/PE
TLSH
T1D762C7566A345977CCDBE219F941BBA3E6F5847291A40E846DFCCA1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7a82895d1df3f1baae488faeadf8bf379cf806a741b5b40808b61d582cfef3c6
MD5 c110a3122c01a292536f7c519d5d1b50
SHA1 49c83dc2deeb31646ab703917d355a64beba7f9e
SHA512 b88058fc4a9d2200a22e9e30f93a7a46f36f7369047a4e8ad4e67db0d52a56c5c715676b07c656fe10903e5842fd17540451a0d0e4f5f31859e0f9f946371dcb
SSDEEP 768:gXUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RvroVPw0D:gXUZYTMWvg0Pou1ja7eLZmR8F/D
TLSH
T1D7D20A3B280CCB7E4F844E5DEC2A6F967ED801CB5A584D5447EA894C03CB7EB112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\945d9a9d-1b9e-453b-a445-770f44d81b88\index-dir\the-real-index
Size 576B
SHA256 3b9eabbcf47466680ac0d0c8c4835636dd361d87e811b9fe280a3de1183be7b7
MD5 46f09e2d5b68db44397d73dcd1b2a920
SHA1 9560f8ac5879c9be806e82c1de2b75cb3a658a1f
SHA512 309f92ce4f86e0a83268c931bfad39cce1037c76cf952a566ae0780ba3988d25ecae9815ce690a310843b14f992d92d57609cb9f1faadb04f6e8a0a9a6317df0
TLSH
T187F0ABBD6AA91C66CF12C534112A21802638E85D0AC6710730284023BE7B702498EDA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587318.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\945d9a9d-1b9e-453b-a445-770f44d81b88\index-dir\the-real-index~RFe587318.TMP
Size 48B
SHA256 73057b116a8e85b90ef7498757b23bc63eedc689eb3326b0bab71aa4db84f66f
MD5 ea34f214df4d1d1dc2be80fcf1c2b00b
SHA1 64b50a0c6a4bd526f303445b5f661187c9af5f30
SHA512 a68bfbafebb86844e99db7e1006c2f3109189bd79e2414f235089c58f3d1e33b4c46ec36148829a0258f41ecdfb416df1042b871da6421c74091d0932886ba85
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a6bee206-00d0-41f6-b940-112fab6a2cae\index-dir\the-real-index
Size 2KB
SHA256 6d39ad49a0dd1eae19ba7e34dd80fb60a43a8a461237ec1a393ec6941b81c42b
MD5 de8be7af1d7a5d64288f457d707e8edc
SHA1 f03a1581b73f8d98d9cd05ec5c5ac13f3c0dcea2
SHA512 cea199ed5fcf763eb6c3e1c7885fa165e06a09eb6b64445960e90b5269894d5700d38c5f2b412fa74cf68a8a68ffc8e3ede60b09c416c1011ed604202d04ab40
TLSH
T1DB41444CD894ABAEEC7691BE1D9818F257712D38FC18C3A285A4B2B534433B45B479FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5869e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a6bee206-00d0-41f6-b940-112fab6a2cae\index-dir\the-real-index~RFe5869e0.TMP
Size 48B
SHA256 473e6850a53abaa88690b8fd030834f72a08d40c1d36ed2401abc6b98e0a717b
MD5 1c909c489ef812394d7cac4d79a69d8c
SHA1 8ce574c0d81593f11cc90e6f5a73e307dc533e0f
SHA512 26bbfd1262afa5628ae5489605d06558ff72ab21673dfa6cf97b594b0e7bfcc0229c99378ded9f509ee7862ecd111d215f3026697a21bb85d2781ef5f115c9c1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 221B
SHA256 5e1fa534061744ec61470829a4d845577743936e80e6772527de26919daa63e8
MD5 ebe5ac964379a97778c8c95d35edbe4a
SHA1 76f1a9059270600db2888b7bc1204ce5fcbc1fe3
SHA512 df042f35cab005d9318160e185f6c315fb63223448ded9e602b98784a257fbc99b7c51f74c99fa2ffbfa3310943b9e57be87159bcc86e27d41b9070e5ae2ce5d
TLSH
T15CD022D6A63099B3DF31BB846834284D432F8C1ADC80CCF1B84AB4C270BCB13C508A26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 41b55ddc5cb30d6a4306d6fca6d965d255ce791cbbc5effcc5dd6ea942f5ff08
MD5 1f7380f6e04b77f5aa20e25313c5e6ee
SHA1 3aaca6c520c668afb4f5ac6515c1af603b5cda26
SHA512 ae6e64da13caa957b34cf3a370c7621aa9730eeec7bc4bc4557a93f5821ecc80c6f74932747f1d722aa1f852f3f60cd027b52a0f4b55c37d05fcadfbec7bf4f9
TLSH
T14EC09BE6942486BBCD70AFC430357A1D961B454CD8D0CCF4654D50816174B238901A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 647912546d60ecbe77522dd226c72a038e238fc12d4a7b013d48b62f562e63d8
MD5 e168704dea276d544bf68c09f4dce0e1
SHA1 08889526c3df7a558efc504f93527bb69fb35339
SHA512 6903bf10f2727b45badc5b0e7a2ac0e93eba053e9041ae02a1952c736a0896ad3c73a7592bdb48cbbf815a1ab99f1c8343235220f0d2a6240648dacc6a966bef
TLSH
T16ED0A7D27470425ADD305EE9343575AD821E8D48DC92CCA45258704262B5E23C912E28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 7b5c5b6377545704b3dffb7f7fd3c5bff1ee6291418a6e0d1afbe7398f5a8c57
MD5 9669e46ac50ea4a1d9e0c7c5d6e03be0
SHA1 d06ce67e57d908a1aa86dcc26772df3d5ccb2046
SHA512 f66482d793185897c16b2df969586a99678d647c0788e5809e400b121d39bfcca86f192a11c212e0be821bc1979c929d1cdf487978de64cedcde2e02adcd64e6
TLSH
T168D0A7D2B9610296DD309FE8343575AD861A8548DCA2DCA85A58808763B1D33D851D38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5811ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5811ed.TMP
Size 137B
SHA256 fd473730a03b25e180bab21e859719d7ccd4263840f092e024ababcb1b960d1a
MD5 9ec390e7b46df706fc4f6e69a958e73d
SHA1 5bf4b070a3dae172e16eea720f9c44d632e57fe9
SHA512 9129596c8fc6f9150bc0f4edb91fe1aea4e0508bd66a13403ab8152357d7d9bb8f2ca6c74c09ac4d26943d6f58023772f0906ab015b5d734290274a1b7d74996
TLSH
T1A3C092E6A43486B7CF71BAC570397A4E962F8C5DDCC1DCF4B50EB0827178A23C905A25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d7558db770efdae7a4f93c6b801267e368bf0ad5c1d64097bf09f38204edd6a7
MD5 9ce32ce73d9458e6569b5ee187719732
SHA1 b5cad2a01b41d9e000eb9322e1d00b249d79a1b9
SHA512 29ee70198766a74a0f89e9b6664e7309a88a023fbc5ca61de9da0d6f6737cbc555b984766db12f65eb6e65dfc0bc0724a7b4d81364db9457b7480ad996239187
TLSH
T1D2B001A908286596C9A90379D9920A8976692E241E1622A240A800B4C9A6680522656A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58629d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58629d.TMP
Size 48B
SHA256 0793232109d77effdf459dc6c6cbd11ebbc60d4a5eb94d54510e593f2c327d82
MD5 0d2fdf00a7b4ea6695f6e61c8a4070be
SHA1 d3737f8d792ee3f30e32c79fa907a5e728999449
SHA512 02586598904ef7aef36afad8e55492cf3905c74e7fa56c97f14949c37b03b0a3cf7f51917c488046e1720b46ddbe5d6a3ec4a8d537e7ef0e9026ff3a7209a736
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 6c9e7764375d96c059bc423c86eae9b29a2f4259044ce25d7d27768b62879abb
MD5 650bd0436784558655b0fe4659e476af
SHA1 9a629f46859b0039556abf31bc4ce8b7b62e9daa
SHA512 605c67c3c27ea9cdee4114a91b327409bcf13b0c895369ea41132f27e698c9d00af5435bcd716735a2ee63416b824988c3b2d3bdbd7f6df60926fecc2e63fad8
SSDEEP 96:KA1eK2A4hqKao060gKdSmnOKAwGyGPKMoU:EMXPoNDJ
TLSH
T18FD1440271FB16023DFD3A19A2648B2B4742B5633118F52B7BE800B54D6AE345DFE9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa58d08c-40e7-4af3-bbbe-fa1765556e6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa58d08c-40e7-4af3-bbbe-fa1765556e6d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f47d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f47d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 110a3c25d810fd5577e2c0c3065b59eac1f8bc4d1d5b95caa463eaa1c1d214fa
MD5 9cf0b701bbfa10740f04dcab6ea645a8
SHA1 689821950b69d185cb76fec71c54028bc1d8be40
SHA512 137ac879d4ce8b9a497ab9a88b9d034ff259ab8263a5059d8383137de0857264e2b0062e2388854e2c587ca69ac99e52cae5106eecadd35d426f229577be840f
SSDEEP 384:n3yFaeO8WsNcAmM4jJzX5od+2OO+ustJrT2r2Yq9m6BMMj5knM:n3IzhWBtxOTOOnWhT2aX9m6yMl
TLSH
T1D8929D33A8345CB6ACA2B251F44B3263EFA8406795D83FC495EC6B1D04DB2DC131BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e1b2d0250e6d0e79fb1f9aa1b8aa6979fcafec9ee68e8195b7fcb2eb072e2b09
MD5 4bb228a68eb1647cef0fbda767323654
SHA1 d74c0b755dd225693b24494d5923ecd3505bf10e
SHA512 020b811910b68eb64e6c32706a660ea072609d75f627caa7a9e9909c39b3ff7ee6e5aa17c6c521085fcb21b4d4c268280cf7cdddedcd857d96b9738bd7756533
SSDEEP 384:GiFZ3yFaeO8psNU8TUNTUlIltmM48JzX5od+2OO+ustJrJ2r2Yq9m6BMMj5knM:tFZ3IzhpxwgaSxOTOOnWhJ2aX9m6yMl
TLSH
T195C229F354D78876E99E6743A77E3D139EBCC067B4946A80B3985A1DCC961BFC30A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a2a76d598b3fbfd557ac63169d0f42a7bdfa795a9275bbe3e2c1f3dfed77c241
MD5 bf70777de3a6076bc24dd207032233b5
SHA1 692e14680b197dccf0c96fa2bbdde6c50ba8cd63
SHA512 edd80e461cc2cfb58453d8bd3469f83b07125fb717714c776f00b7ab158437d7462283814ebe7394b1cf8a75ac814bcd2ce7f5c09e77676a26cf73b50e5db3d7
SSDEEP 192:yONC61VWQmiUyORgGX5Obd+j6OuL+7/ajd3BcU6:yONC6WtgGX5od+2OO+ezcU6
TLSH
T15F02E836A9286C77CEE2BE49B48737235F95206BEA946F84D6EC1F1C00D765C2346C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d594da75c9a4a282d0c96a4bb5b7b1285a4b7d9511c226a9d6edfe348f2865f
MD5 25f55c56cc3f637216e9be7133392f07
SHA1 4b4bead5755a080174c7ee5f72679973cf27d8f3
SHA512 1cb007c314a6c16f994fa054185e674fed18f33afd50eedda5b9aaaf02e4f87653fd8f71fd19e1c5a2d9c14be8ee7929e47d9621cdb0d3109f30528d45a7ce31
SSDEEP 192:0ONd61iWQmiUy4RrGX5Obd+j6OuL+usySJrKjJjiqSU6:0ONd6jprGX5od+2OO+ustJrm2U6
TLSH
T16B121A326428AC379DD2B555F48732639FE55067EA897FC0D1EC2F2C01EB69C131AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fabae9c0a958891f960a826c8cc182fce0c2701b4c5f8dfc916897e173316b7b
MD5 596eb33b79ddeb45143299be99a66ac2
SHA1 c58b1f36897749322384b4decff231e5d630589a
SHA512 370339cfe376f73a20e620659876a2577050ffaa95ecb44b16d70bdd8981e9a10277f930ab1dd2ff405a4ff34025fd33e30a0c7f27f311191187e1892a621daa
SSDEEP 384:S3yFaeO8WsNctmM4jJzX5od+2OO+ustJrT2r2Yq9m6BMMj5knM:S3IzhWUtxOTOOnWhT2aX9m6yMl
TLSH
T1A3928D33A8345CB6ACA2B251F44B3263EFA8806B95D83FC495EC6B1D04DB6DC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3229dc98-13b1-4732-81f4-ec33ead1a855.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3229dc98-13b1-4732-81f4-ec33ead1a855.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f96a26f1eaf3c522e5eada49e716b364c87d2611b491ab7a1cc12d7dd4d3fe80
MD5 a1b7b48104886e4a547eebae59e3f64a
SHA1 31f812d10549d0a14191ad43ec29e970975a08f8
SHA512 3ffabe3cc24ad1c1f5c70868a64566c8579e0cb84d4da334c968ac2aee0e595b50d32d1ebef6629f67081457696f6013ac6f9090862ad598fc25fa183bd8945f
TLSH
T19141E64CB6EE1149B3B76F56EBF6A86E887F78772F06D55E00010D4F0A62A40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download