hxxp://youtube[.]com

Resubmissions

29/10/2026, 21:31

261029-1c6pdas1gt7

29/10/2026, 21:28

261029-1bs2wsce573

29/10/2026, 21:28

261029-1bb4das1fs4

Analysis

user interaction
yes
max time kernel
120s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youtube.com
Sample261029-1bs2wsce57

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3468	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{DA92153E-4BCA-44AD-ABB0-AFEE19D212A5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{7D679BB7-CA76-41E2-9F81-3363CC81EF6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4320	4892	msedge.exe	89
PID 4892 wrote to memory of 3468	4892	msedge.exe	90
PID 4892 wrote to memory of 2188	4892	msedge.exe	91
PID 4892 wrote to memory of 2188	4892	msedge.exe	91
PID 4892 wrote to memory of 2188	4892	msedge.exe	91
PID 4892 wrote to memory of 4860	4892	msedge.exe	92
PID 4892 wrote to memory of 4860	4892	msedge.exe	92
PID 4892 wrote to memory of 4492	4892	msedge.exe	106
PID 4892 wrote to memory of 4440	4892	msedge.exe	93
PID 4892 wrote to memory of 4492	4892	msedge.exe	106
PID 4892 wrote to memory of 4492	4892	msedge.exe	106
PID 4892 wrote to memory of 4440	4892	msedge.exe	93
PID 4892 wrote to memory of 4440	4892	msedge.exe	93
PID 4892 wrote to memory of 1592	4892	msedge.exe	96
PID 4892 wrote to memory of 1592	4892	msedge.exe	96
PID 4892 wrote to memory of 1592	4892	msedge.exe	96
PID 4892 wrote to memory of 2000	4892	msedge.exe	97
PID 4892 wrote to memory of 2000	4892	msedge.exe	97
PID 4892 wrote to memory of 2000	4892	msedge.exe	97
PID 4892 wrote to memory of 4304	4892	msedge.exe	99
PID 4892 wrote to memory of 4304	4892	msedge.exe	99
PID 4892 wrote to memory of 4304	4892	msedge.exe	99
PID 4892 wrote to memory of 852	4892	msedge.exe	100
PID 4892 wrote to memory of 852	4892	msedge.exe	100
PID 4892 wrote to memory of 852	4892	msedge.exe	100
PID 4892 wrote to memory of 5456	4892	msedge.exe	101
PID 4892 wrote to memory of 2984	4892	msedge.exe	102
PID 4892 wrote to memory of 5456	4892	msedge.exe	101
PID 4892 wrote to memory of 2984	4892	msedge.exe	102
PID 4892 wrote to memory of 1940	4892	msedge.exe	103
PID 4892 wrote to memory of 3788	4892	msedge.exe	104
PID 4892 wrote to memory of 1940	4892	msedge.exe	103
PID 4892 wrote to memory of 4492	4892	msedge.exe	106
PID 4892 wrote to memory of 6120	4892	msedge.exe	107
PID 4892 wrote to memory of 6120	4892	msedge.exe	107
PID 4892 wrote to memory of 3196	4892	msedge.exe	108
PID 4892 wrote to memory of 3196	4892	msedge.exe	108
PID 4892 wrote to memory of 5472	4892	msedge.exe	111
PID 4892 wrote to memory of 5472	4892	msedge.exe	111
PID 4892 wrote to memory of 5472	4892	msedge.exe	111
PID 4892 wrote to memory of 3724	4892	msedge.exe	112
PID 4892 wrote to memory of 3724	4892	msedge.exe	112
PID 4892 wrote to memory of 3724	4892	msedge.exe	112
PID 4892 wrote to memory of 5492	4892	msedge.exe	113
PID 4892 wrote to memory of 5492	4892	msedge.exe	113
PID 4892 wrote to memory of 5492	4892	msedge.exe	113
PID 4892 wrote to memory of 5364	4892	msedge.exe	114
PID 4892 wrote to memory of 5364	4892	msedge.exe	114
PID 4892 wrote to memory of 5364	4892	msedge.exe	114
PID 4892 wrote to memory of 4608	4892	msedge.exe	116
PID 4892 wrote to memory of 1472	4892	msedge.exe	117
PID 4892 wrote to memory of 3488	4892	msedge.exe	118
PID 4892 wrote to memory of 5912	4892	msedge.exe	119
PID 4892 wrote to memory of 5912	4892	msedge.exe	119
PID 4892 wrote to memory of 5812	4892	msedge.exe	120
PID 4892 wrote to memory of 5812	4892	msedge.exe	120
PID 4892 wrote to memory of 2232	4892	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x290,0x7ff9ac88c188,0x7ff9ac88c194,0x7ff9ac88c1a0
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,477375576381111898,11108210102596341149,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,9079677449055089602,493513016275203337,262144 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,4562798375390844557,18440418190937497722,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3792,i,9245859773728857413,12688375632216667457,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3784,i,4315578523764849250,418803269966898947,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,16818327386809445252,5773428283955271010,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,9788259004238693308,14069282335489187935,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:9
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3984,i,2474388320787180035,188944508973314569,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5248,i,10281179589852010712,9976745413373394578,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,14879864652359072374,1186523849396283203,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,2705448166425515301,5000574606458309156,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,9659810309150504495,7492552069285580691,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:12
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,1259021457266513566,1873034087386292605,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,16949974112008893714,9204198045405189834,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,16949974112008893714,9204198045405189834,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,4180028143856575222,16517646221284015644,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,7585903111607007511,8006470703675276780,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6748,i,7059079027751202787,8368877077200865632,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5460,i,12212392328024763413,14651787089015581834,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7148,i,2274135381129457186,10335839894408764594,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7132,i,13193862232296733790,15094312216000222768,2097152 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,15581524875233825671,806026350986322073,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,17523086052190878183,5075350935374753012,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,1700191503632305183,8961919571762139446,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,6833220073031496617,6076227845822478948,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,7250274572431430509,1927978619671708682,524288 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5192,i,4450580618554074923,14817966092810255462,262144 --field-trial-handle=2644,i,913773224798668736,1650790703602642323,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1258c603-9653-4e9f-bc0c-45abca6362a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1258c603-9653-4e9f-bc0c-45abca6362a4.tmp
Size 34KB
SHA256 2bd26884e6be6c6aff793ee4299d74cceba6fac2e0ed5b3c08680f168850b572
MD5 f93a5c1d66841700fcaa4378224cc822
SHA1 8a11563616120706ae5c7afb325af107f50690f7
SHA512 506609901f8f58200cc578b9fc416dbe4eb82d5f0f8896eac7ecef6f403e52903da1f596f345ea5c195ac3ec04f92f121675cf33bece03cee317a8d81db0dabf
SSDEEP 768:rp3FplR03wOND4H15fgGM1TnXMqOaNoaTZcMLF:rp3FusPfgt1TnxOK99h
TLSH
T1B8F2AE32A8559D734CE2E381F20A7692BEF18257CAC51E98D9DD6E0D019B29F135BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bfb18bf-d1b9-4eb8-b9b1-804c9414fa47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6bfb18bf-d1b9-4eb8-b9b1-804c9414fa47.tmp
Size 38KB
SHA256 c87b4f896b8c27f2e264cfc42bc47b64415e7c3f8f27e21d678ac61ed3347f31
MD5 5288680fb759857a0cae146540590fe6
SHA1 2a572ea888eeb436b53b396b9e61d1c15173d6cc
SHA512 40f04985d259d6aaebbef2c1c7b1594f18c0e37b27440f12cec4691d711f12e699dc8e6221ae2344553ae8e30ee9f274c9107ee81b22ef7576b03b579cd415d4
SSDEEP 768:B/UxvxjgC+93mp9IwOND4Hu5fgGM1TnXMqOaNOD:UZj3+93mYscfgt1TnxOKOD
TLSH
T11103B036A8556C735CF3E785B21A6793BEF14563C6C52DA889EC6E0E068725F430BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84fed279-93d3-4279-8e3e-f03cf1d34363.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84fed279-93d3-4279-8e3e-f03cf1d34363.tmp
Size 38KB
SHA256 937d03ec455e6b3915f1634383820cd20bca32a4eaabeaf64eea427a09775bff
MD5 5ebef9f4d453ae64965d38220292f16e
SHA1 0eaf71bdc9fa56ddeca03b54c6b2a81e3908adcc
SHA512 fa314aae5d4bae3e1e22f187784bb5cfc6b77f28da4e947cde66db56629f14d262032d85b5fb095e2be3a4b929c4f216c7feedd2a6e2492d4ff13ec0847e3916
SSDEEP 768:m/UxvxjgC+93kKwOND4Hu5fgGM1TnXMqO/NAaP8:bZj3+93Xscfgt1TnxOFAG8
TLSH
T1B203B036A85569779CF2D385B21EA353AEF14563C6C51EA48DEC3E0E068B35E430BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

0a0513d5-0124-4c08-bc00-6b4bb3030845.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a0513d5-0124-4c08-bc00-6b4bb3030845.tmp
Size 14KB
SHA256 ef56a3eb65080e9e985cb6ba1b8495f8c156c02757825704c79de650a43a7ae3
MD5 f1b11af266056ddc745f5cc99a4653f8
SHA1 417d9252185546f8bc21611df5fda45d0f4d7090
SHA512 7ecc8ed8d8f88ff9de1e099be0add69e1376111f9914d9906ac360cb1d0c524d4bc5264fd33a188f2ddba3750e963b069693623bfb3eebf3eb1eb33b8343c32f
SSDEEP 192:sxRemHcBzG/fss86Uq3pFoA8pFhTyIzTfcg/g6+WNcfaHUJm/YRXFNd3jQG/IgDE:sxReQmzG/fss8rEWR/5tT/YFLbc
TLSH
T1A162CA525924D97B4CCAD618FE767F13D7F95032A9915E4CAAFCC61C00EB6EE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d27ad54-5e6e-40fb-be28-9c3f4b61a6ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d27ad54-5e6e-40fb-be28-9c3f4b61a6ce.tmp
Size 15KB
SHA256 9297b16d90ee8c9c8f4675276b6dfaf1644198faafed3801721091751c9a98ce
MD5 5ae18f39ca94c93f0bd251db0eb65e47
SHA1 f5aefa8ff55bc045accbef9666d22be7e463c2de
SHA512 5a21cff161939af4dbec12526262dc9d42f5f2276f1e80ecae73138eab87efe508e4e603dbd3c76e08377f9d70376f340cb9b06e8da8e7f8e95296b1c5e8c567
SSDEEP 192:sxRemHcBWG/fss86Zq3pFoA8pFhTyIzTfcg/g6+WNcnVKHaHUJm/YR40NX3jQG/i:sxReQmWG/fss8mEWR/55cT/iDLdc
TLSH
T17962BA525924D97B4CCAD518FE767F13E7F55032A9915E4CAAFCCA1C00EB6EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

246b1440-b4aa-4b54-9dbd-568265c88a4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\246b1440-b4aa-4b54-9dbd-568265c88a4d.tmp
Size 15KB
SHA256 0dd2fdbdc5ff7ae15cae3391fe2a74928fce67241a7eeaf4f22ab35d06858f80
MD5 c47e34953cafab4e04603d588925f086
SHA1 8c0f352bdccead297dbfe102eeff02b1c82abc9d
SHA512 25a9cfe0eab67e9c9182631167d52d9a645c72740905390f830509b6c928357d348c2bb20086eb24b255e6ced2584eba86851bbb2f6f2c05f8362d6fd133854f
SSDEEP 192:sxRemZcBWG/fss86Zq3pFoA8p/hTyIzTfcg/g6+WNcnNVc2aHUJm/YRM0NX3jQGq:sxRe2mWG/fss8mEWP/50mT/SDLdc
TLSH
T1C762A9529924997B8CCAD518FE76BF12E7F5503299D15E4CAAFCC61C00EB6EE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

506f8773-0acc-4cbf-9691-0e4b640576a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\506f8773-0acc-4cbf-9691-0e4b640576a0.tmp
Size 23KB
SHA256 8da1ad836cb83dbe12ceb4256a79eb3aae3c81a497ec0311eb81d517b2ef7d1d
MD5 e58a1a45c96b662df02b80c39753dfc2
SHA1 660f171e06b9eb91f9528f7e8d42c03d0fb1bcec
SHA512 f69416850417b329693f3ff616cef23d6397af3c2144659121274a5cdda3c66fa59b7fb58d5592ee6747869d38e8b5c42ce2649d504178b9d4c83f97ea4b54c1
SSDEEP 384:Ua5g+TcfCtgflFfXHKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwE9tTRkMroqY6:UEg+TuWgf/fXH8F1+UoAYDCx9Tuqh0Vu
TLSH
T13FB2DB2F644CCB7E4FC10AAD9C1A6FD76D9802C797548E4047FE994C02C77FA921A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63d1e6d1-f2f1-4aad-a66f-8f8d69f773d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63d1e6d1-f2f1-4aad-a66f-8f8d69f773d0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 45KB
SHA256 e8673783a155bb04180378c200fffc8910f6f062c8bf07d56f02f8bbbd697319
MD5 a7106e6beb39ce4e98233a5b3c1772c8
SHA1 689082c31b53555feafeff4145cc438b0d70e7a7
SHA512 8ad167a66e583628cad724c054e8a3a1a507a48352fa55225cfab6aef32185dcbfb7672340442ce7e9ddb92b12e398693a7e7e73dfcb96abfa2e0607bc7be95d
SSDEEP 768:SLK4xOdpIA1Szu+48kvAG2kLhCQpGCETEiDq2XDzjpl+qEKLj:SLK4dVu+DqARyCQsCq9q2zR3
TLSH
T1E223F1408E48EA9FD8D264CE83D7D8D9A4CDD4801612E73A634638C2B4B21BDFD568B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 677563d3ea779d40344c1ffbff0478787b8dd221a05a2f7db368717a4d965826
MD5 ebcb326f6cee646a51fdb68056a28a10
SHA1 5a0200db35eb1e85a449fc6943d571804621c148
SHA512 5b05b65d067041e5b764cff1b3c6039954908f6c394c637da9992ae7d44685cdb87ef70a6253e8fa86ae5f2c7d814b0103804c22b93553f2c691fe96f368ffa2
SSDEEP 96:9PPheMPXaastVxRNwQPqPkkr1KSZTnXkBs6pS4xGsIuciKt+Im:p7vsn8bTySuJ
TLSH
T124B1628A629F73E4EF5E517A0ED968DFF53431C1A4435E031A7CE9749482BACB48E017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0307210b8a2276f8d58ca1ce2a228c965c3c80d7b96b42ce0d2cd8e8dc575955
MD5 500bd3f8238549b58bc4dd9c81580488
SHA1 3d11365b4e597b3e36073788d29e865b0134eaf0
SHA512 55016d07ed3c59195f73b5e43e8aa5461b8a5d9c77a0bf969285fb4b63a5feb8def7387d881c4830bcf51f12f6d152ded131edfa7f67dab9a9cd54f6a971ac7e
TLSH
T14361828C655343D8E79812768EDD14DFB6347981B083AE532FB5EAB8D8C23F8B04D058
MD5 SHA1 SHA512 TLSH

Submit Download

5090f097-2d71-44d0-8056-1c0a67ebf099.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5090f097-2d71-44d0-8056-1c0a67ebf099.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 217KB
SHA256 780bd02535eebd6e5d80474c71eec0bd135e67489e93580c1c961d575da1a232
MD5 2ce2757bbd61c3aaaf9151f9f631bf50
SHA1 39dacafaff2dcd622e933b800b8dda41794f4071
SHA512 2c9be21cb165397869545cc09b941e07b942e62f7317a0af186e325ba84607d4770e0242bd0ce78ff11b877496841b095de2d5fb35ec25ecb4de2e90a496217f
SSDEEP 3072:7CiMNCSZH2ipBd3co7KogoNb+z4iX6xOED/i+zDU:42aG
TLSH
T128240A2573A532D5F03E83BB05158D16D3BA6EC8555C7089F9B13A0D26FBB403B68B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 a0d4f7254fde4ee11fca782535b47e35bf6c178ab0dcb4407c1371252c5c68b6
MD5 fe2abccb7c378f7caa8be8a18a9bff25
SHA1 81c04a7b5e2ba24003a1b1b9df60c3aece12053c
SHA512 3ae668330cf51af803def583fb201ec22ed29826aa8143e0f4e2c0c7a23291e10fbe8bb140233a5835dec02dc944da40b2c9c93936bebc8e25f2d798454b2f1d
TLSH
T1C8E0682CC8C9D21F612424D60474BB0E9BA7611ED6CCBD950F04D900B04A048D4BE160
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

093fceb1-6f5a-46f2-9698-27e650a603f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\093fceb1-6f5a-46f2-9698-27e650a603f2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

41ae0ee9-4e25-4a02-8ffa-a0eb8a9ed578.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\41ae0ee9-4e25-4a02-8ffa-a0eb8a9ed578.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

87951b0e-48a5-4c8b-913d-6e31bbf3d9ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\87951b0e-48a5-4c8b-913d-6e31bbf3d9ad.tmp
Size 210B
SHA256 3a2f13c8f4399ced724dae11c98c953dd29b720a7dae6be2f22c4ac0d5a8748b
MD5 f0ee362155212e235a619c042a9d6337
SHA1 7f819d67b85c5b7412172853ca1db783a3bfefc5
SHA512 47094aa061e97a198c131f228c3639164b93b67614f4651754b04a7ac2ca4d0c1225490dfa60240feb06eef1a5886ada5174e4d0d7f002a29aff3a9cc609e1db
TLSH
T126D022233100B1B3926D69BA602AAC8EFBB210641807D5DA2490AACA79B5C2E448B4C9
MD5 SHA1 SHA512 TLSH

Submit Download

abeb78b8-09df-4877-b703-4dd0f2f0cdf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\abeb78b8-09df-4877-b703-4dd0f2f0cdf4.tmp
Size 7KB
SHA256 ed9af7c59dc8877a640f49078cd6b672df8c857277211e01247b40b37f57c655
MD5 324861971e35b87d6db5e5b45a3d2b1d
SHA1 f1f52f88e64c0c4af722023a8bd3132f6153878e
SHA512 544d2edd1cb8db92ce57f07ddcdcaecef3ed159d390a2de2fdac6f73e5a8238b5c34e21093998c4e8774883384362715e1417134903722efe7aa3928ebefe36c
SSDEEP 192:D+nCXFKG9gV8tVZaaQISFBawwrbvmi9D489sGDa:D+nCXFKG9gV8tVZaaQISFBawwrbvmi9K
TLSH
T10FF1ADF7C3E4862DD81156F4E6187E2BDE2D1D28935C3C1AC8E4AE4BA3F2471D245A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\570ebe67-b7bd-41da-857b-898635040acd\index-dir\temp-index
Size 2KB
SHA256 b18e735a3ed9eb05a0423c549027b2e0274855edab033c207650349ae9c3c820
MD5 8649ca36967fdf184445e85f772e0be3
SHA1 8cdd9f33b830e17459e8ba0995839773dc0ed68f
SHA512 591a544207dfeedff7e1bd2d7e9e33868ebc8c62a4c2a1c68a0f4c6732e7c67a024b065fa6c24df4f9b8849172aeaa7d04132094bce4cd0b418bd16ce253d24e
TLSH
T16541448CC89063AEEC7651BE3C9454B297B52C7AFC89C2528164B2A534439A4574B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\570ebe67-b7bd-41da-857b-898635040acd\index-dir\the-real-index
Size 48B
SHA256 44eba18295328621866a3070cbdeb6610a4f79ed15eb69bda9c6703189461816
MD5 96ddb6c1c179aeb303586800c6e869e0
SHA1 4d113c14f181783556e00d81cf64ad6b278a72f6
SHA512 af4a5f98bad9c6ca034dda91902f2d1e7251caa4f037aecece911c398b00af56fbb11d657463525a9bb320fbfc41f916bb1f605a3dc282cf691a03e48d9b65d9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 e75260f312afa51eb24689d53aefbb85657342ff936248f83d296d8aff4a88c5
MD5 4f7e87acd7572faf6f026639f4a6196a
SHA1 788b1587945ccdbecb660f9abeee91c5a9de73ac
SHA512 5cffb8a9eb4aa4b99eacaacad806bc84ef81956a9b2d2692ff27b627e97a35def836364afc0ebd00b65e25bb8e1e9b7be1d9493e05127d4097e0930a4e195487
TLSH
T12EC09BD315204B9707775FC8103CB35D991F4D4D98C5CCF8F115715171745178411AB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 214B
SHA256 de3460f1db3a757bcc24b08db8077908290e29daea773783bb684b701316fa1b
MD5 2ca3a81057f30f57d4e3f8782328b20d
SHA1 bb247ca49a1c3b24210d58841328af457905715e
SHA512 329646535aadeb9e8b180c2bb5200bb3efc4fd0424fb39d69fa1de8ae087562d2a6561f37ff6aaf821fb79e56e4f09caf2d79fcd98844f0fe0b8012bc31455fa
TLSH
T1E2D0A7C202308AA7176AEF441038725D441B4E09D4C9CCE8F410719268B4103C822575
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 130B
SHA256 bc15e2f89d8868006f16db1f23f00bdf15a2b59e2e6eacc78d8010417766a691
MD5 3c19599ead5b630b86b66cd1a3cec4da
SHA1 ebff3b40ea93c2a72224045c1dd75292e86f6231
SHA512 5918368938b478c9ca57f4e931fd2e3c3010aa171c25ea7562b1cd7b9d095415f6af408799f12d82be821b75d394fdaa5c1105abdd660806d234229361e77375
TLSH
T1A4C09BD315104B9B06779FCC113CB71D991F464C94C9CDF8F1145151657451744129B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 132B
SHA256 9307e08c3f73ba3beb693dd5f04ba59fbb3bbc25058f869a3b7c31b5749149b8
MD5 7d6bc755606946f55010c3502b455cfa
SHA1 d43a2be2d66c5fddf50b3c699109d698929d8eb1
SHA512 74d3814f36542b0e7e832de3fd9164dcf448d79c29008551e07cd2dda833bfa7830a97457cf3a6f0ad9890a2218cad01d02ab1262d1e51628a33b68526f9730d
TLSH
T1ABC04CD219104A9606779B882138B71D991F454894C9CCE8A9145152637451744119A5
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 48B
SHA256 363c28f74788d9008e7bbca8011747f688c2c5885188bbbc5f6986349eea2c30
MD5 580ddc3b3ed689d1eb5acbc53e6df13b
SHA1 5cd7a6bda045ed36ab4794f1caf5290342c164c9
SHA512 372ae33f15b1db253364a351f285979bf6ec86ac63497ccc7b8b0a2388c677b928d9ae5d35f725cf8db5ea839c2d9ef4e34ffad3b81ad97962a25dbc151f36c8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 e43404a891b0033bd4ea9b088df964df6610a904b80b2d4ab44d4d85c5cee28e
MD5 0bc0c56615c27e4725576fc71f06ad1f
SHA1 00ae911ae8dc2e5df2e0f0a3128c9afc5924022d
SHA512 7738f0fb49f2a24892ad44850955c468c5536660eb51c6818dd4b53cf65640bba6a9c6834ce3a303d66a40279348119d5f8a83b97fd7c019b36ee1078ddcacce
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

aa8a7fb0-cb15-4b3c-b93d-a4216b4674d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa8a7fb0-cb15-4b3c-b93d-a4216b4674d4.tmp
Size 15KB
SHA256 b1c435ae3c01e4d33c421ac6beaa5dbaf4f9245edbcc5f949727a5a53c70501d
MD5 928b503f9a35b6613bb86555714c45d0
SHA1 366e17c4ea1bcc5b153e17ad0fdb02e2e3ebbb9a
SHA512 2f8b15c0eea8755c0ccba0a98834eb549a9d7b3ba2be83b8092b6a17296993746ee5787864c4177e8721e8baaad7b63d989ae185ea423ec781ea3a959b091684
SSDEEP 192:sxRemHcBzG/fss86Zq3pFoA8pFhTyIzTfcg/g6+WNcnJGHaHUJm/YR00NX3jQG/i:sxReQmzG/fss8mEWR/5BcT/eDLdc
TLSH
T17262DB525924D97B4CCAD518FE367F13E7F55032A9915E4CAAFCC61C00EB6EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c799ce19-dced-4402-ba24-fd90daeb0763.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c799ce19-dced-4402-ba24-fd90daeb0763.tmp
Size 12KB
SHA256 eb72b03c6d40a5619e909553bb995d38cc71b410ebb440de637a113f8e471de1
MD5 d471bead1b1c9f5d321a32df0370e12f
SHA1 c88f83a66a6fe1707355d61b93e7bf5391577f31
SHA512 bf1a1e5e3f2e80b5bdda6469b0fcd3bd61e667649271f9da414fba390e694d9e4f7e7e5e840c2030a9fb3ecac456397a431c4f8c0eeb3427d70655cb15a7940e
SSDEEP 192:sxRFmbG/fssR6UqHzoA8pFWIWg/g6+WNlJm/YRAFNd3jQG/IgIJ:sxRF4G/fssRrd1/5G/zFLs
TLSH
T1FE42B7169D68A97B4CCBD219FB56BF13E6F91032A1D15E58EAFC861C00E77DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

478f9a78-6329-4ccc-9ecb-468d033fe41e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\478f9a78-6329-4ccc-9ecb-468d033fe41e.tmp
Size 22KB
SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
MD5 dc2dabfd9cbeadca467ec254d1aafed1
SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
TLSH
T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7523a36df8e9bc4b4c1d02e6a63f427bdac4ff5bcfa5038ee51ca9431a287480
MD5 1fb3d3d7e7cebe138122c9cbf83561b5
SHA1 c7ecac4774d21fd1273d603f6b1bed287639b4e4
SHA512 fb1972ba8a104d87e1f79e714ea218ee8a8c67c885a78e7199fe4635b4f88d26e40b02737fd2e2d5b501b05a319f4dd053350ae8c25dfb05482ba10f8185f74d
MD5 SHA1 SHA512

Submit Download

bf57ee38-596e-469a-9067-4f7e75c13960.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf57ee38-596e-469a-9067-4f7e75c13960.tmp
Size 37KB
SHA256 8941126ae97c700d278ee387be763b27280caab24e6b33eb9eb265885ea0f719
MD5 4a8877118309ffaefec8c014ce6e91c6
SHA1 eccb01d33f343ac44edc4d64c25f50d10b2aa70a
SHA512 00efed98b0c3f4a91bbe5b2e049f8c32b16727b3f258451e186c93503627f51d6c396affc5afeb60d71e126f63450e3315a8e26fe53342652f9d8eec2805bf6d
SSDEEP 768:5/UxvxjgC+93+BwONDru5fgGM1TnXMqOeJAaP8:sZj3+93Yrcfgt1TnxO2AG8
TLSH
T18003C036AC556C779CF2D384B30AA3A6AEF14463D5C11AA88DEC6E0E069735E530BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c69ca57f-ce83-4742-9fe3-409a38f2e328.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c69ca57f-ce83-4742-9fe3-409a38f2e328.tmp
Size 34KB
SHA256 caf2b3be0cb99c6799e95f17e32bae9875846b9d8de590163230104cc28afebc
MD5 bba00554d9e4fb47ab44eb509b9faf41
SHA1 4e39d3f34ae61ce1764140f4fb64e963af5360fe
SHA512 6c2c01e71651b113d0ab5b1e185eccaebdf4370e9cb37b5a7749435edbb5d277bb18991cd3b4957f99283c26b57a210f33abceb75225ec96ec7e877a324b2e49
SSDEEP 768:2p3mplR03wOND4H15fgGM1TnXMqOaNoaTZcMLF:2p3musPfgt1TnxOK99h
TLSH
T155F2AE32A8559D734CE2D381F20A7692BEF18257CAC51E98D9DD6E0D029B29F135BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec9cc779-c917-4551-892f-18fda35696f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec9cc779-c917-4551-892f-18fda35696f1.tmp
Size 392B
SHA256 557600ec6e0b5471d8e89fab68f597ef4ac0f30a0a99b88628852e15185b153a
MD5 7783163e7d125ac7bcc9b50a442eac82
SHA1 9dd8b812409ea5249ffd0f74ba0c32302a95a29f
SHA512 b24fb79b86695aa30c660d0deb79cd1da0a09d30d1f88b71fcef4f21cba4f9c4245b32ddd9238196e404f25153ce6492e9744135ff9c73821a43a3a3495654cc
TLSH
T15EE00206A70001F8D02D033052471F202FD2D11001F5470B4B30029C5C333007E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

eca9d46f-16d1-459d-a99f-8cc4d31201e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eca9d46f-16d1-459d-a99f-8cc4d31201e9.tmp
Size 41KB
SHA256 907002170ef1aae407a7a6ba1305ebed1f0bc0c09f1bc28d0ce836ddcd177746
MD5 09e181de0c16c0f2347cd38288fd1ae4
SHA1 ab7a05166d64050c3ddcb373828c756c5b71afc5
SHA512 686548cc140da3e885bfc2263c31deaa6d3d81bc619543ff4d85e9dc7a60f5abaeaceb1708b9dca1339ff11eb415ab4e90c2dccb9fb0d6cd39f7e78d359d3dbc
SSDEEP 768:qFdd3zwgJplHo503wOND4K5fgGM1TnXMqOaNoaTZcMLF:Kd3z9Vfgt1TnxOK99h
TLSH
T1A7135AF298C78937D8AE9783A33E2E52ADBCC153F5811954B7CD690CCD461BFC24A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a171f523-cb21-4409-8c09-07016327527d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a171f523-cb21-4409-8c09-07016327527d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download