hxxps://sport[.]tvp[.]pl/93264423/hiszpania-argentyna-ms-2026-final-na-zywo-transmisja-meczu-online-live-stream-1972026/

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sport.tvp.pl/93264423/hiszpania-argentyna-ms-2026-final-na-zywo-transmisja-meczu-online-live-stream-1972026/
Sample260804-w5gthaxeja

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303418227783323"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{76480FA3-162E-4A71-A712-CB8423836C86}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4184	4836	msedge.exe	85
PID 4836 wrote to memory of 4108	4836	msedge.exe	87
PID 4836 wrote to memory of 3268	4836	msedge.exe	88
PID 4836 wrote to memory of 3268	4836	msedge.exe	88
PID 4836 wrote to memory of 3268	4836	msedge.exe	88
PID 4836 wrote to memory of 4016	4836	msedge.exe	89
PID 4836 wrote to memory of 4016	4836	msedge.exe	89
PID 4836 wrote to memory of 2148	4836	msedge.exe	90
PID 4836 wrote to memory of 2364	4836	msedge.exe	91
PID 4836 wrote to memory of 2148	4836	msedge.exe	90
PID 4836 wrote to memory of 2148	4836	msedge.exe	90
PID 4836 wrote to memory of 2364	4836	msedge.exe	91
PID 4836 wrote to memory of 2364	4836	msedge.exe	91
PID 4836 wrote to memory of 4040	4836	msedge.exe	92
PID 4836 wrote to memory of 4740	4836	msedge.exe	93
PID 4836 wrote to memory of 4040	4836	msedge.exe	92
PID 4836 wrote to memory of 4040	4836	msedge.exe	92
PID 4836 wrote to memory of 4740	4836	msedge.exe	93
PID 4836 wrote to memory of 4740	4836	msedge.exe	93
PID 4836 wrote to memory of 3120	4836	msedge.exe	97
PID 4836 wrote to memory of 3120	4836	msedge.exe	97
PID 4836 wrote to memory of 3440	4836	msedge.exe	98
PID 4836 wrote to memory of 3440	4836	msedge.exe	98
PID 4836 wrote to memory of 4612	4836	msedge.exe	99
PID 4836 wrote to memory of 4612	4836	msedge.exe	99
PID 4836 wrote to memory of 4612	4836	msedge.exe	99
PID 4836 wrote to memory of 3420	4836	msedge.exe	100
PID 4836 wrote to memory of 3420	4836	msedge.exe	100
PID 4836 wrote to memory of 3420	4836	msedge.exe	100
PID 4836 wrote to memory of 3736	4836	msedge.exe	101
PID 4836 wrote to memory of 3736	4836	msedge.exe	101
PID 4836 wrote to memory of 3736	4836	msedge.exe	101
PID 4836 wrote to memory of 3492	4836	msedge.exe	102
PID 4836 wrote to memory of 3492	4836	msedge.exe	102
PID 4836 wrote to memory of 3492	4836	msedge.exe	102
PID 4836 wrote to memory of 2356	4836	msedge.exe	104
PID 4836 wrote to memory of 4528	4836	msedge.exe	115
PID 4836 wrote to memory of 1808	4836	msedge.exe	116
PID 4836 wrote to memory of 3728	4836	msedge.exe	117
PID 4836 wrote to memory of 640	4836	msedge.exe	119
PID 4836 wrote to memory of 2404	4836	msedge.exe	120
PID 4836 wrote to memory of 2404	4836	msedge.exe	120
PID 4836 wrote to memory of 2404	4836	msedge.exe	120
PID 4836 wrote to memory of 3504	4836	msedge.exe	121
PID 4836 wrote to memory of 3504	4836	msedge.exe	121
PID 4836 wrote to memory of 3504	4836	msedge.exe	121
PID 4836 wrote to memory of 3952	4836	msedge.exe	122
PID 4836 wrote to memory of 3952	4836	msedge.exe	122
PID 4836 wrote to memory of 3952	4836	msedge.exe	122
PID 4836 wrote to memory of 3092	4836	msedge.exe	124
PID 4836 wrote to memory of 3092	4836	msedge.exe	124
PID 4836 wrote to memory of 4000	4836	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sport.tvp.pl/93264423/hiszpania-argentyna-ms-2026-final-na-zywo-transmisja-meczu-online-live-stream-1972026/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff947eac188,0x7ff947eac194,0x7ff947eac1a0
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12549296771331000469,2313931987892052105,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4359764299112790306,160500849541966236,262144 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,5636514738071942665,5945773511753296161,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,8549930966477623069,13557389620873409295,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17518845166110855025,8120539726964754197,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,3223355098745447682,5651293848618625191,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2767000616719366125,8464940065821797849,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,17364748136770956547,16528133501890043802,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,7835662122131124389,13906282749078467543,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5764,i,17953400824395573656,8444125272176166145,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6124,i,4059835875422052520,4469560240470318954,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5596,i,8398332284591767664,11091193035426237096,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6428,i,3578654019345620738,2324107826386740728,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,13472086804107598927,29760340434429680,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,13472086804107598927,29760340434429680,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,7396949390114435952,16855980873485271973,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,12064048339313083321,5124837725083219442,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,608339945103376928,16651068081870474550,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,16680776749962748229,9722737536906966796,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,16680776749962748229,9722737536906966796,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4452,i,1160574897490104639,6756753606289681938,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6424,i,7609760254319695180,5632637310177370932,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6964,i,14152057593034457632,3486814490804825632,2097152 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14813902557557111650,1519802427849798917,524288 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6924,i,11007616427912372612,14170301999974002776,262144 --field-trial-handle=2516,i,3413814294139602723,7623957385920389558,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a38114d99b6c05875ae9468596abb7e823cf9fd18f4fe2b6bc2180f73cdd21f
MD5 734ed32369a33092e5af169a5f1c6400
SHA1 0ab00a2f996579fe58c514dc8b219803cba9de47
SHA512 04030ded30cf60d41eb3764dfd5642f0188adcd4a84f6e384aea7e06d243aaac8ef80b76c3db8872468f568e5519ff4453a83b9566726f9db3ac7fbd22e36617
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 92258073994e13b52d3458b3856190ac4b24a811acb922ef807797a581c314cc
MD5 e7cd31980546df4e7e03b2af41f2662e
SHA1 08cef6e806a3a177f31eff233e8b9a2d1c5ba889
SHA512 bc643602cae94b049da9cab36a0ec69a4b4b6d6448e15a60db4e35c30ff6859d710b5174ca03fd3611d171d422056d439d0b21ddde6c18675993dfd22c006eb2
SSDEEP 48:6+SHqyBcWc/J7kBvFF6Ggjbgep8Br2N86KgvHj1JIhpvAX/2PL9t5IgQUw:PSKyG/5Gjgjbd8I6j0Q76DNUw
TLSH
T1CDA1FAF42A710868EB20047D98F92D16357957FAF60B4F8A71803C722F16BF149AAD6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f364.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f364.TMP
Size 3KB
SHA256 cbd9e993311cddc85a2b4a55bec6832b4060e5ea2e2113e2b4dafdeaa8eaa544
MD5 009d64f0b41b2d74fa5b6a772f13e451
SHA1 f1be19873e13b5366bcdb177d4911de33128fdfe
SHA512 78447bb0e7e42247d6f2b2d4f605950ba4ef7b5609b1d0c3a6544d59e598bdac88890e1097f7330c3531864289f6907f2f3ae61371bc2052f5b6246b95a44850
TLSH
T19C81D7F52A3200A0E720057D94F96E2A3A75A7EAFB0B5F5A31807C706D16FF24069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 e94247540400d8bc45c258871ad0cd7c68354505b2da25e3f9e6594216cc5d26
MD5 594b83e51f324cfe85ccd8b50347c061
SHA1 49c122becea88cbf654d15ff58d37be477175055
SHA512 b796569fa10153629bafc15ea993a3d9ad720f2b3c6cdfbff26bd4ccb6dcfdfab3b1ee43789fef302dd9cf2846096af7453201705633fd02d0863f63e7414ed9
SSDEEP 384:D8qxeBTpzewuexEYCeue5NXUm1+JJbaenrK8tjnKObmNj1/BzmQn6/fcGORg+q8n:NL4pOili7A
TLSH
T19342C0F6C7E5822EDE1112F096252D27DE2D0A8A47243C9A85E5EF4BA7F1470F2C1D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 676ca5327d69158b858ddae73e88b77c412df99e1fba940125a67fe5e5d1d942
MD5 7c2ab1c692371c4adfec44cec8928338
SHA1 14bade2aab1f815d751045aacb999c7e46e0ec3d
SHA512 a6d48fb796e6a4ce3aea18438d01fe60a0cd67a97f7b829513ba4264c948d0782b0e04290a5d0cf0a9a85bdc9354c27a45b96ea4d5f95e76323ccecb5e291081
SSDEEP 192:sxZRRIyM/jK1Ml8Mkk/f+sjsIeVaEdprCHW6+WN8xm/YvEjYvIgU1J:sxZR6Mk/f+sjsI2eHbD/rkUf
TLSH
T1D442E912AA386977CCCBD20DFA417F53D6F91562A2910E44AEFC9A1C04E6BDD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eebca81f0f41c18a59db2421af6e72c722dd9e8b278e3be3958570aace3bd54b
MD5 7cddd81cd8a5f7b1b182661c5a2869be
SHA1 da907847a4bb8c4e4b5d80837d27fe24c46e6591
SHA512 9836e5bfaca938a53e3fd7265cb3d32592baf22a06150ea90c0edd16e67311b92425163a6efdf4a1bd70f971c45236c389b0534dc1e53f58c2686eb5a56577a2
SSDEEP 192:sxZORIyM/jK1Ml8UQykk/f+sjsgeVaIdpFCHW6+WN8xm/YveejYvIg5ve1J:sxZOyqxk/f+sjsgecHbD/mkYf
TLSH
T14152E816AA389977CCDBD20DFA41BF53E6F5147292910E44AAFCDA1C04E6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 51b67635438f94ec2f019d2f22bfce2f79a02f911b10a033372645affd327116
MD5 4d7c6c6e2416e34c15ecfac5d12eb404
SHA1 b922649036e8cbedc58bddc8735ee874c8288d42
SHA512 4e0c1a1d38c5d2172b2b690eb939b92acc2191031cf914725dd2a137d8d914331f939c7f1768c1834088a8ecc492d3bbc015bc239fa9ae83e936735e61a6d115
SSDEEP 192:sxZORIyM/jK1Ml8Mkk/f+sjsgeVaIdprCHW6+WN8xm/Yv8ZjYvIg5ve1J:sxZOyMk/f+sjsgeeHbD/PkYf
TLSH
T1B352E816AA389977CCDBD20DFA41BF53E6F5157292910E44AAFCDA1C00E6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fb7b20e4299ae2992a2bb5b2831512e49bdd0a6a524e75e8ff2f4a89f72bb281
MD5 11398b69832a22037b422270acdab73e
SHA1 5233a16dfd10a1344ae26b7259bce0903827b569
SHA512 4b394fd523ea1e051031112558fd0a839f6e7edc581d355ab09a6678b3849bd21799a0bf121d617ca5cbf9bdf5c2ed78e897b08d27499f97ead8d163ddf24ebb
SSDEEP 768:jPseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppIroSo:jPseJ3xWvhfynu1jaVcL88pzR
TLSH
T1E3D20B2B280CCB7E4F844E6DEC2A6F966EE801CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ab587abe42029361183a78a287b3943e7a22c9c669fef1d717d91c404596c824
MD5 4b128686ad3cbf9c851fe9f570f4e978
SHA1 a882bb953e1abf58b0515a3a7b6d9b908371cdb4
SHA512 1fcd37fe0f8fd76cb5931809be89b3d197e047e5d8b6062d15687073f624af419d6b959d3d40029470411afbb15e088ea11535ff49a88bfdb85a156da47ab9bf
TLSH
T16FB0220200E08FCACC0823B8B0830AC8302C8C22230A802320B830A08E33F00C30F0CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589313.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589313.TMP
Size 48B
SHA256 60454dfaec9aa00d5c0ce02b667af85180cd13ac34f59f990e9a4ef68e4a9de5
MD5 3b732f7f576b436fac12a0352966e06f
SHA1 847abeac6c5454c4374f4d891c52ad08f4f7e764
SHA512 04f7861761a1e37cdb2b33d98c6127a721544a35954cb1712964b28d900f761a2ebfedbdf8c5f67bf88354beb758add3c5b692d6f9ea1aa186b021b6f3520cec
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a07fcc3682f5be8d8b0174ee297754af04fcae5239af272c6a605bb09bebc9a7
MD5 7bc5f443a6ddd0d18e8ece186f4c55d3
SHA1 1253a0f93773ae9136fdc52d108bb0ef3f6069f4
SHA512 331b2f1517f9d79a5cb0263badf505c1209d146753fc4d6af79d37a499ce83485c1dcb741d78ce217d5b2b5fbd1e4d875abbdf9793025ede4b5f9462096f6ce7
TLSH
T142A002934D739C55E4091BB1508682412B1CF9241267C3055390C4858C64945A9C1440
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0e7400963cd424c12636787b99bcb1ff842c9023e6c59730693113d0490a3048
MD5 b930cc2974913cf273db8da0cc6be293
SHA1 b68ccf09933899604f68751e8e1baea4bb767ac8
SHA512 4945eae2e8c9b3d281df080f6739e958b75d835a29fe90fa26dddf9c7ad2c37dd9f6c2776968fa20d420751b0f1f26b1fb58745f1a44c962601281cb1a588dfe
SSDEEP 96:KYH+KggmSRkVBnTfkvTqP1ZkK9B1/kJhBKnh5eleKm02:49SRkVBnTfuTq9ZdB1/+hBKnh5hb
TLSH
T144915342353F02022CBE284DA296AA764F4275A33558A5FF7FB844A30E66E110DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 383c0031bf693f5ec1e4e75af165f55ab2af245334ff169f5c45ed9ff1525480
MD5 34e4c379054872afd753ba13f5cc82b6
SHA1 abb768877a5e2b16e4f2f81948299e28e8433007
SHA512 b0295924cc698b27f142599ec4e4941d18cf651454d33591d998b5009a095d9bdd0c29d189f7babdab328be4fb9d77badbde9e5fbc04fb101d794643db049fa0
SSDEEP 192:RLsNkmDQCRM708MQmiU1eprC4MTq4+FdLkxdtSJrG8z1VqRLR7:tsNkmDpq7Fc4ptJd4xGJrnMR7
TLSH
T168423B32B8749C3B99A3B286F04A32135EB0916B96C56F54EAED7F0D01DB79C130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a85342f46588fcbdc5a0623262d025819b63e00ae71ae8847600d876e5b22317
MD5 1d272908df82159cefa91314f028b23c
SHA1 66283a938492e3ef4257f7092c8c5454c326874d
SHA512 b7bf3db92bbe8912db9b97e0ead6cc6b6b7bbf355a9bfa0884b97288af6d52b2fd202d64379d1279c2dd769a51acbb0f69e5082f86df400730fcc4b3697e23f2
SSDEEP 192:uOm+xasuheOwQxMGsNkgDQCRM708MQmiU1epRC4MTq4+FdLkxdtSJr58z1VqRLEG:OZcIhsNkgDpq7Fc4jtJd4xGJreMEG
TLSH
T13A626D326C745C3B99E3B286F48A32135EF4D02796C55B94E6EDBF0D01DA7A8130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7e70d29398bbb0605080623e4a702197f6f2a862c18a8432c9c712ace45aeade
MD5 4b5d3d4f960aa7fdbfa92ffae8a97a7a
SHA1 413e7020c4b8f05e5aaf8bce4a940e0475b0d266
SHA512 a2973c03e6773f99107852cf82e015dc101e8debcab22ca3666a23629ea9eca2446125e2fc1aa5c72a6d7b65130e58ba90edfd003b6535be507bcf93c4609290
SSDEEP 192:uTm+xasuheOwQxMlnjsNkjDQCRM708fQmiU1epRC4MTq4+FdLkxdtSJr/8v1VqRn:1ZcIijsNkjDpq7Fh4jtJd4xGJrYMEG
TLSH
T196726D7268745C3B99E3B286F48A32135EF4D02796C55F94E6EDBF0D01DA7A8130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a6bd9bd0fbae9c644909bd4c7b256f71652d1a960f5a5039cb8de70be3d3b32
MD5 ca7df0907b16a903d69d99b867b17f5e
SHA1 4124960a555468bd16b5b4a97805c06af5b1f93a
SHA512 d4b74fcea2f0b4cc103e613f3eac2a9f66a59ab6fbb49087ceb5897a536113705158ca400bc24de0b79ddef6493692c3d7318c375af6aeddf5c771e9e92f4107
SSDEEP 192:lON7Zh6vMtPQmiUynUThTq4+FdLkxw847u64U/u:lON7D6UtRTTSd4xKgU/u
TLSH
T149021935AC786C7BAAA3AE46F08A37171FF4117FA5D01B54EAE82F1C00D724C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ae447ff5868aba77807aaa0cf40514dd336ebcacccb038c06d9c6caed483e170
MD5 a5c917dfcfda0778f1e792d266096d14
SHA1 b6599ef395298780225269394da445a6fcc02aa1
SHA512 5f5ccc1ea48b2788363446a01914a39744f097bf89881d6857cbcb6d6930e4ead80e415be9ae53aabfe53012e4c46265fe9a23a11b3d29173a392a5b1d3091de
SSDEEP 192:0ONV6vMiPQmiUySqUvhTq4+FdLkxdtSJr280IVqRLU/u:0ONV6UiRfpvSd4xGJrvMU/u
TLSH
T182121D32B8645C2BAD93B696F08B32175EF0916BDAC56B90FADD3F1C01DF65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c607fb0928b3011a698f507b85be2c6bb7b0a9f924e7b3945ed7fab0cae75385
MD5 070daa42f98f30a653572afa27c9087e
SHA1 80f52e2c539284bc11933dc62a6481e137dbe8cc
SHA512 f40d13c93af7bc263f0facc957568732b8b4f5e51ea31ca1dee4ee171fc55e3128205e44b61d9106ddc4a8604ba4c8ce955097e34bc1c4cc66200ca298e061fc
SSDEEP 192:ugm+xasuheOwQxM6sNkjDQCRM708fQmiU1epRC4MTq4+FdLkxdtSJr58z1VqRLEG:UZcINsNkjDpq7Fh4jtJd4xGJreMEG
TLSH
T1EC726D7268745C3BA9E3B286F48A32135EF4D02796C55F94E6EDBF0D01DA7A8130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 6fc1ab3ea89860614dc9b562d4e5336e09a77d99c6a5e09db18dad5b52c4182a
MD5 d9c31c3765616f6136ce586efe5a7b7e
SHA1 f0c1efc2601da11901c1655ba40cbdcdf10b8d44
SHA512 38b15db3c1c4f6b5d05b79a114164524ebdb3559f8d999ebd31fc9aed1e64c28cc6370a9bd20679d6049f9139502ef0e2ee7dbeab06f036eff6cea6db5771cfb
TLSH
T13451398105D522FF6EAA6BF05F408889823E7B4BB2A9E8CF58D08CB45673C5745C00A4
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe5878f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe5878f4.TMP
Size 583B
SHA256 dd6e247726a3509515784bec80a88a2200121e2ec04790c505cb919a6fb08b47
MD5 e91b20b00898d0d2f2ed752a72ad63fd
SHA1 53ee1e9362922d7e8fea2898f6ce0343ff81e09b
SHA512 563354e893c31ecbc8eb546fdd7571bab5441169195243140959e2f3a170524e47faca83fdd7901dde193ef7fd09b2ef0c33fc23c035d6e6abdbff208defc6b3
TLSH
T18AF04769D56A5C43DCC25EB51E174CAB10091A740C1161BDEC25157650CFDD50CDBBD2
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3127b8985801ae653b871bf567992ba54db423f14a5fdc30ddee4473488aeabb
MD5 1de3334ade644d632a2cfb7fdd1bbadb
SHA1 2b8d3a320dc3b772e49f3a2331be9610c4eca52e
SHA512 59a085d6649f61f9108f314025532d5a8ac029830579d89962f0fd6720d820b014b7c8b31e1e4babc311e1d994cd30aba8b9250962e64c7e05ad112cc4a57824
TLSH
T1CE41F958A6F91148B3776F5A9BF6A8AE087BBC372F07D45D10110E4F0A62B41C872737
MD5 SHA1 SHA512 TLSH

Submit Download